How can I see if a user deleted a folder in a shared resource using AD?

Question

Is there any way to see if a user deleted a folder in a shared resource (we have Active Directory)?

I need to see if someone is removing folders or if they do actually "magically disappear".

Solution 1

I'm sure you should be able to audit the delete events.

In Group Policy audit for Object Access - Success.

Then at the folder you want to trigger the events, set the Audit for successful deletion of files and folders. Here is a website that talks about that.

When a file/folder is deleted, an event log entry will be made. You may have to search through the event log entries to find the specific file/folder of interest.

Solution 2

There's an "inspection" tab in the advanced security properties, though you need to configure group policy in addition to this.

Comments

[rkl]

How to set up this group policy?

[kinokijuf]

Unfortunately I have no idea :(