where to turn on auditing for AD Domain

[bookouri]

I need to audit a couple of directories for file deletions. I can go to that directory and tell windows to audit deletions but nothing is being logged when files are deleted.

I think I need to "turn on" auditing. All the howto files Ive read talk about the local security policy or a gpo for the ou, but directory i want to audit is a share on a domain controller. I want to "turn on" auditing for the whole domain so that i can go to any machine and audit objects.. I cant figure out exactly where to go to make the changes, at what level, in what security policy???

can anybody tell me exactly where and how to turn on the auditing capability domain wide? I want to be able to go to any server in the domain and audit any directory or file necessary..

thanks for any suggestions..

 

[chipk]

http://support.microsoft.com/kb/300549

 

[bookouri]

thanks, ill take a look at that. Ive gone through a couple of microsoft documents already and they didnt seem to work as advertised...

 

[chipk]

Microsoft often makes assumptions in their documentation, which if you're not aware of them, will give you unexpected results.

 

[bookouri]

More often than not, it seems like you follow their instructions and find that nothing is in QUITE the exact place as the instructions describe it, and doestn QUITE do exactly what they instructions say it will, and once you finish it just plain doesnt work... then you start pushing buttons and eventually you get where you were going, but you couldnt begin to find you way back again if you had to do it over again

I did finally get the auditing to work though...