# 2008 Server file deletion question

**URL:** <https://boards.straightdope.com/t/2008-server-file-deletion-question/564284>\
**Category:** Factual Questions\
**Created:** [December 15, 2010, 9:35pm UTC](https://boards.straightdope.com/t/2008-server-file-deletion-question/564284 "2010-12-15T21:35:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![XT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/xt/32/456_2.png) [@XT](https://boards.straightdope.com/u/XT)\
**Post date:** [December 15, 2010, 9:35pm UTC](https://boards.straightdope.com/t/2008-server-file-deletion-question/564284/1 "2010-12-15T21:35:59Z")

</div>

In a plain vanilla install of 2008 Server, is there any way to determine who deleted a file folder? I’m not as familiar with 2008 and I can’t seem to find out who deleted several folders on one of my customers servers (I was pretty easily able to restore them).

-XT

---

<div class="post-metadata">

**Author:** ![Quartz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/quartz/32/267_2.png) [@Quartz](https://boards.straightdope.com/u/Quartz)\
**Post date:** [December 15, 2010, 10:10pm UTC](https://boards.straightdope.com/t/2008-server-file-deletion-question/564284/2 "2010-12-15T22:10:49Z")

</div>

What auditing have you enabled?

---

<div class="post-metadata">

**Author:** ![XT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/xt/32/456_2.png) [@XT](https://boards.straightdope.com/u/XT)\
**Post date:** [December 15, 2010, 10:12pm UTC](https://boards.straightdope.com/t/2008-server-file-deletion-question/564284/3 "2010-12-15T22:12:21Z")

</div>

Well, that’s the trouble…the guy who set this up just went with the defaults. I can’t find any audit logs for file deletion…I was hoping maybe I’m missing them.

-XT

---

<div class="post-metadata">

**Author:** ![Quartz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/quartz/32/267_2.png) [@Quartz](https://boards.straightdope.com/u/Quartz)\
**Post date:** [December 15, 2010, 10:40pm UTC](https://boards.straightdope.com/t/2008-server-file-deletion-question/564284/4 "2010-12-15T22:40:04Z")

</div>

Auditing is not enabled by default. Audit logs tend to be huge anyway unless very carefully set up.