No announcement yet.

Windows NT4 Auditing Question

  • Filter
  • Time
  • Show
Clear All
new posts

  • Windows NT4 Auditing Question

    I have a few servers here that are NT4, auditing is enabled.

    A few days ago some files were lost due to a user being a bad monkey. The mystery user must have gone into the shared folder (which has been taken care of) and deleted some files either by accident or on purpose.

    I have the "File and Object Access" audit enabled for success and failure, and was wondering if I can use that to see who deleted the files?
    I have tried sifting through those logs, but it's packed full of so much stuff I haven't had any success.

    Are there any ideas of what to search for, or am I going about this the wrong way?

    And no worries about me using NT4 still, the upgrade to 2003 is a month away!

    Thanks a lot
    "One thing a computer can do that most humans can't is be sealed up in a cardboard box and sit in a warehouse."
    -- Jack Handey [Deep Thoughts]