Audit deleted files from Windows 2016 folders

Question

_{Wednesday, March 7, 2018 5:30 AM}

Hi,

We are having Windows 2016 shared folders with many sub folders. We need to audit and create report for the files which an end user deletes.

We need to know who deleted the file and which file was deleted.

Thanks

All replies (3)

_{Wednesday, March 7, 2018 6:41 AM}

Enable Object access audit from policy level else you can create only for disk level.

https://blogs.technet.microsoft.com/mspfe/2013/08/26/auditing-file-access-on-file-servers/

https://technet.microsoft.com/en-us/library/dd277403.aspx

_{Wednesday, March 7, 2018 7:26 AM}

Hi,

As suggested above, you could configure audit policy, you could filter event 4663 and 4656, those should log the deletion of an object

https://social.technet.microsoft.com/Forums/windowsserver/en-US/ed46b837-007f-474b-9a68-454c7f76f192/how-to-audit-delete-filesfolders-action-on-shared?forum=winservergen

And here is the combine audit policy and scripts to report this.

https://gallery.technet.microsoft.com/scriptcenter/How-to-audit-changed-39afba72#content

Best Regards,

Mary

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

_{Friday, March 9, 2018 9:29 AM}

Hi,
Could the above reply be of help? If yes, you may mark it as answer, if not, feel free to feed back
Best Regards,
Mary

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].