Hi there,We've recenly lost a lot of data from one of our file servers running server 2003, looks like someone may have deleted it all by acident. I've restored from a backup.Is there any way to find out who did this, does server 2003 log this sort of thing?Cheers,Jonathon

Hi, Thanks for the post. I understand that some files were deleted by accident and you would like to track who did it. In Windows, the system has an Audit feature which enables you to track the access to some sensitive data, such as files and registries. When audit is enabled, success and/or failure access will generate events logged in the Windows Security log. If you have enabled audit on the deleted files, you can check the security log to analyze the file deletion operation. However, if you have not enabled audit before, you could not find the relevant information since the security settings are not enabled. For the future, you can use the Audit object access group policy to specify which users you want audited for what kind of access. The audits will end up in the security log. For more information, please take a look at the following article: Audit object accesshttp://technet.microsoft.com/en-us/library/cc776774(WS.10).aspx How To Set, View, Change, or Remove Auditing for a File or Folder in Windows 2000http://support.microsoft.com/?id=301640Hope this helps.

Hi,Unfortunatly auditing was not enabled, but I have now enabled it for the future.Many thanks,Jonathon

Hi Jonathon,I am glad to hear that the information was helpful to you. Hope you will enjoy our TechNet Forum.Thanks,Miles