intercept delete file event

[gadzail]

Hi all,

I would like to create a service that run on a server to intercept the users command that delete file (or move) on a specific folder.

This help me to create a log file of these events in case of an accidentally delete (or move) of an important file so I can try to restore or at least I could know what happened.

Is it possible?

I know how to create the service but I don't know how to intercept these events.

I didn't find a solution on the forum (but maybe I didn't search with the right words).

Thanks.

[PsaltyDS]

Hi all,

I would like to create a service that run on a server to intercept the users command that delete file (or move) on a specific folder.

This help me to create a log file of these events in case of an accidentally delete (or move) of an important file so I can try to restore or at least I could know what happened.

Is it possible?

I know how to create the service but I don't know how to intercept these events.

I didn't find a solution on the forum (but maybe I didn't search with the right words).

Thanks.

Go into Local Security Policy (assuming this is not an AD domain), Audit Policy, and enable auditing of object access. The go to the security tab on that file and/or directory and then hit the Advanced button. On the Advance Security Settings dialog, select the Auditing tab and add the required auditing events. Anything you configure to be audited will be logged to the Event Log.

[gadzail]

Go into Local Security Policy (assuming this is not an AD domain), Audit Policy, and enable auditing of object access. The go to the security tab on that file and/or directory and then hit the Advanced button. On the Advance Security Settings dialog, select the Auditing tab and add the required auditing events. Anything you configure to be audited will be logged to the Event Log.

Many thanks

[ptrex]

@all

Look in my signature for "File Monitor".

Enjoy !!

regards

ptrex