Delete Auditing: How to Determine Who Deleted a File In Windows Server

[@Illasera]

Great video, Thank you, one question, any idea how to store such a specific event log in a different volume / drive? in case of an SSD usage, i assume this auditing policy is going to write like a mother. symlink won't help here (I assume).

[@waiwai5690]

Thanks for this awesome video and very useful, may i know about how to separate (move/rename) from the list but remain the delete action?

[@SathishKamarala]

Wonderful

[@mohammedafeef7301]

Wow... That's awesome.. Only the best video on this topic....thank you, in this example you've set on folder, so I can set on volume if I need on all folders under it right?.... Liked and subscribe d.. :) I need more topics on servers, firewall,... Relevant it topics..thanks again

[@PhillcoAmaru]

Does this work when a resource is shared over a network? I mean, users are not part of any Windows Server user group. They are "external users". I hope you can understand me. 😅

[@xbriskx]

But how to search event viewer for the file name? I have so many events EVent Viewer doesn't load them it takes forever.

[@oluchristianfarinloye4804]

Is there a way to (1) find out who deleted, even though the policy in this video wasn't set up? (2) Recover the deleted document/file from registry

[@sharp615]

Awesome and very thorough video.

[@URTechDotCa]

Yep. Dell has streamlined their manufacturing process and unless you're a corporate and want to order dozens of machines you pretty much have to take what they give you these days

[@johnkill2k]

if the computer/user deleted the file is not a domain user, still there will be log?

[@calvinnguyen1699]

nice video

[@grix25]

Tnx aloooot :)

[@IT-AEA]

windows has built-in command cipher /W:yourDriver