I want to create a group policy to audit the file and folder deletion on my file server, domain controller as well. (DC is acting as file server)
So created a GPO and linked that GPO on Domain controllers OU.
Below is my Group policy
Enable Audit Policy: On the DC (File server) where I want to track file deletion, go to Administrative Tools->Local Security Policy->Audit Policy , double click "Audit Object Access" on the right pane and switch-on "Success" & "Failure".
Second thing I enabled audit on the folder on which I would like to enable the auditing.
Enable auditing for user/group:
I enabed and add user/security group for auditing on the folder which needs to be captured for file deletion.
- Right click on the target folder (ex. D:\share1), selected Properties and go to Security Tab.
- Clicked on Advanced , and select Auditing Tab.
- Added here the security group , I have added EVERYONE .
- On the next screen select "Successful" & "Failed" on "Delete subfolders and files" & "Delete". Apply new settings and exit from properties.
But when I deleted file or folder on share1, I haven't got any eventid related to file deletion, generally there should be eventid 560, but it's not....