Share via
Shabin Suresh 166Reputation points
Hi Team,
We have a server 2019 which is using for IIS. Today some files from the live directory are missing. So how we can find which user deleted that files?
From event viewer before enabling the audit policy.
I would like to know, is it possible to get the logs before applying audit policy?
Thanks,
Shabin
Internet Information Services
Microsoft web server software.
1,657 questions
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,922 questions
Sign in to follow
0{count} votes
Sign in to comment
Accepted answer
-
Anonymous
2023-09-28T20:11:01.7+00:00 Afraid that the files lost before the auditing was setup would not be documented anywhere.
--please don't forget to close up the thread here by marking answer if the reply is helpful--
Deleted
This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Anonymous
2023-09-29T10:04:18.9533333+00:00 Just checking if there's any progress or updates?
--please don't forget to close up the thread here by marking answer if the reply is helpful--
Shabin Suresh 166Reputation points
2023-09-29T10:20:35.53+00:00 Hi Dave,
Configured Audit policy, now getting logs from event viewer
Thanks
Anonymous
2023-09-29T10:22:10.42+00:00 Sounds good, you're welcome.
Sign in to comment
1 additional answer
Sort by: Most helpful
-
Sam Wu-MSFT 7,446Reputation points • Microsoft Vendor
2023-09-29T03:13:27.35+00:00 You can use file system object access event auditing to identify a specific user who created, deleted, or modified a specific file. In this link, it will show you how to configure event auditing for files on a shared network folder on Windows Server. After configuring auditing, you can use the information from the Event Viewer to find the user who deleted specific file on the file server.
How to Detect Who Deleted a File on Windows Server with Audit Policy?
If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Shabin Suresh 166Reputation points
2023-09-29T10:21:21.6233333+00:00 Hi Sam,
Thanks for the information. Now able to see the logs in event viewer.
Thanks
Sign in to comment
Sign in to answer
 – AirDroid)