locked
File / Folder Auditing RRS feed

  • Question

  • I want a log that tells me when a file or folder is created / deleted from the WHS.

    If there is a way to do this already please can someone post an idiot's guide / step-by-step instructions.

    If there is an add-in that does this that would be even better.

    Many thanks.

    Saturday, November 21, 2009 6:15 PM

All replies

  • I want a log that tells me when a file or folder is created / deleted from the WHS.

    If there is a way to do this already please can someone post an idiot's guide / step-by-step instructions.

    If there is an add-in that does this that would be even better.

    Many thanks.

    There is no way OOTB to do that, and I don't know of any add-ins that have that ability either.  The only possible way I can think of to do that would be to enable Auditing in the underlying OS, but that is unsupported and, to the best of my knowledge, never been tested by anyone that posts in these forums, so I would strongly advise against doing that.  Frankly, if you are that concerned about folders being created/deleted, just restrict the user's ability to read-only (or don't allow them access to the server at all).
    Saturday, November 21, 2009 7:37 PM
    Moderator
  • It should be possible to activate audit logging, which is built into Windows Server 2003, but I'm pretty sure you won't get useful information, because at some level all files are owned by the Administrator account or the Administrators group. The result is that all file creation, deletion, and change operations will be performed by the same user or user group as far as Windows is concerned, not by the individual user that actually performs the action. If you want to proceed, you'll find plenty of information on the Microsoft Support site, MSDN, Technet, etc. and online through search engines like Google .

    Also, as pointed out, it's not supported by Microsoft, so it's possible (though unlikely) that it will cause some sort of problem on your server. It's even possible that the problem will be severe enough that you'll need to reinstall the OS, or even wipe the server and start from scratch.

    I'm also not aware of an add-in that will activate audit logging.

    Might I ask why you need to turn audit logging on?
    I'm not on the WHS team, I just post a lot. :)
    Sunday, November 22, 2009 2:49 AM
    Moderator
  • Thank you for the replies so far.

    Ken, I am not bothered about who has done a delete / create just what.

    The reason being is that if a file is deleted I can then see at a glance wether or not I want to restore or wether I am happy for the file to have been deleted.

    I know that accounts can be locked down for 'read only' etc. but I want the users to have 'full control', It is just sometimes mistakes happen, knowingly and sometimes unknowingly. It is very easy for a user to hit delete and not having a recycle bin or reliable previous versions it is not simple to get the information back, or even to know if something was actually deleted in the first place.

    I just thought it was a simple request, like; would you like to log deleted / created files? [Yes|No]

    Regards,
    Sunday, November 22, 2009 12:37 PM