In a plain vanilla install of 2008 Server, is there any way to determine who deleted a file folder? I’m not as familiar with 2008 and I can’t seem to find out who deleted several folders on one of my customers servers (I was pretty easily able to restore them).
-XT
What auditing have you enabled?
Well, that’s the trouble…the guy who set this up just went with the defaults. I can’t find any audit logs for file deletion…I was hoping maybe I’m missing them.
-XT
Auditing is not enabled by default. Audit logs tend to be huge anyway unless very carefully set up.