Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to create a group policy to audit the file and folder deletion on my file server, domain controller as well. (DC is acting as file server)

So created a GPO and linked that GPO on Domain controllers OU.

Below is my Group policy

Enable Audit Policy: On the DC (File server) where I want to track file deletion, go to Administrative Tools->Local Security Policy->Audit Policy , double click "Audit Object Access" on the right pane and switch-on "Success" & "Failure".

Second thing I enabled audit on the folder on which I would like to enable the auditing.

Enable auditing for user/group:

I enabed and add user/security group for auditing on the folder which needs to be captured for file deletion.

  • Right click on the target folder (ex. D:\share1), selected Properties and go to Security Tab.
  • Clicked on Advanced , and select Auditing Tab.
  • Added here the security group , I have added EVERYONE .
  • On the next screen select "Successful" & "Failed" on "Delete subfolders and files" & "Delete". Apply new settings and exit from properties.

But when I deleted file or folder on share1, I haven't got any eventid related to file deletion, generally there should be eventid 560, but it's not....

share|improve this question

closed as off topic by slhck Feb 26 '13 at 20:36

Questions on Super User are expected to relate to computer software or computer hardware within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

The Local Security Policy is not the same as Group Policy, so I'm a little confused as to what you linked to the DC OU? – Ƭᴇcʜιᴇ007 Jun 10 '12 at 15:38
I have been fighting this problem for a long time. Have not been able to find a proper instruction for auditing deletes on the DFS files. This is by far the best but I need one that starts from the server desktop… – Jake Feb 20 '13 at 3:45
This might be a better question for severfault, fyi. – BigHomie Feb 26 '13 at 14:48
It can't be migrated there, so I suggest re-asking in a similar form. – slhck Feb 26 '13 at 20:36