Windows Server 2019 Deleted Files, how to find the user

Question

Hi Team,

We have a server 2019 which is using for IIS. Today some files from the live directory are missing. So how we can find which user deleted that files?

From event viewer before enabling the audit policy.

I would like to know, is it possible to get the logs before applying audit policy?

Thanks,

Shabin

Answer 1

Afraid that the files lost before the auditing was setup would not be documented anywhere.

--please don't forget to close up the thread here by marking answer if the reply is helpful--

Answer 2

@Shabin Suresh

You can use file system object access event auditing to identify a specific user who created, deleted, or modified a specific file. In this link, it will show you how to configure event auditing for files on a shared network folder on Windows Server. After configuring auditing, you can use the information from the Event Viewer to find the user who deleted specific file on the file server.

How to Detect Who Deleted a File on Windows Server with Audit Policy?

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

We use logtrace to record some important file behaviors in advance. After selecting the file and member record, you can get all the results in the report, including other shared file locations, SharePoint/outlook.