Version

Windows Server 2008 – All versions

Date

30 Oct 2012

Summary

This article describes how users can enable auditing of file deletion events on a file share to track file deletion events.

Technical Background

File Deletion Events (Event ID 4660 & 4663) will be generated in the Security event log

Resolution

The following Microsoft article describes how to edit the auditing policy on a server:

http://support.microsoft.com/kb/921469

Once file auditing has been enabled, the auditing settings for each folder need to be activated.

1. Simply right click on a folder in Windows Explorer and select ‘Properties‘
   
2. Click ‘Edit‘ to define the audit items
   
3. Define which events to be tracked and click ‘OK‘.