Does deleting a file create an entry in Event Viewer ?

[raket]

We have a server where share a folder where we keep the documents that everybody needs to work with.

Is it possible in Windows 2000 server to log which user does what in this folder ?
I am specifically interested in moving and deleting (of files and folders)

 

[longhair]

raket,
i believe you will need to turn auditing on and select which events to audit.
hth
regards,
longhair

 

[raket]

Thanks!

where can I find this ?

 

[longhair]

racket,
right click the object, properties, security tab, advanced, auditing tab.
regards,
longhair

 

[raket]

Thanks again!
Final question:
I turned on the auditing for our network users.
Where is the log file that captures this ?
Event viewer ?

 

[PScottC]

You will also have to go into the local policy of the server and enable auditing for "object access". You probably only need to select "success"

PSC

Governments and corporations need people like you and me. We are samurai. The keyboard cowboys. And all those other people out there who have no idea what's going on are the cattle. Mooo! --Mr. The Plague, from the movie "Hackers

 

[raket]

thanks, it's setup

but I still can't find where to go to see the result ?
which log keeps these audits ?
event viewer ?

 

[raket]

Is it supposed to go into the Security log ?

Everything is setup on the (only) domain controller
1. auditing for that folder is enabled for the "domain users" group
2. local policy/object access/audit success

However, no "object access" entries appear in the Security log !?
Any ideas ... ?

 

[longhair]

raket,
should be in the security log. check out this link:

http://www.microsoft.com/windows200...000/en/advanced/help/acl_inherit_auditing.htm

regards,
longhair

 

[raket]

still nothing ...

Local policy / audit policy / audit object access
the column "local setting" says "success"
however, the column "effective setting" says "no auditing"

?

I also changed it to "success" in the
- "domain controller security policy"
- "domain security policy"
still nothing...