I'm hoping someone knows a little about setting up Auditing for deleted files. I am trying to audit file systems that are on a NAS box using the Microsoft auditing tool, but have a slight issue. After making appropriate settings in Active Directory to allow for audit object access(I didn't do this myself) and running through 'Security>Advanced>Auditing' for the particular folder, I get Event ID 560 for files that users are deleting, however if I go into the folder myself, create a file and delete it, I do not get the event logged in the Security Event Log - I have created a file and waited overnight to delete, but same result. As I'm sure you can understand I need to know that the Auditing I'm setting is reliably recording ALL deletions.
I hope this makes sense.
Thanks
J
I hope this makes sense.
Thanks
J