KBI 310322 How To Track File Deletion Events On W2008


Windows Server 2008 – All versions


30 Oct 2012


This article describes how users can enable auditing of file deletion events on a file share to track file deletion events.

Technical Background

File Deletion Events (Event ID 4660 & 4663) will be generated in the Security event log


The following Microsoft article describes how to edit the auditing policy on a server:


Once file auditing has been enabled, the auditing settings for each folder need to be activated.

  1. Simply right click on a folder in Windows Explorer and select ‘Properties
  2. Click ‘Edit‘ to define the audit items
  3. Define which events to be tracked and click ‘OK‘.