How do i know who deleted file/folder in Windows 7 ?

Question

Someone deleted files from Windows 7,i do not know it is remote or local.
I want to know how was deleted ?
And can i know what anybody doing (delete,add anything and etc.) on Windows 7 ?

Answer 1

You need to enable auditing from either local policies or domain policies and apply it to the machine . you need to configure auditing on everything, you want to audit. Please following the given steps:
1.Configure audit object access in AD Group Policy or on the server's local GPO.
Computer Configuration --> Windows Settings --> Security Settings --> Local Policies --> Audit Policy --> Audit object Access
Once that is in place, go to the folder you want to monitor, right click and go to properties
2. Configure an audit entry on the specific folder's that you want to audit. Right-click on the folder-->Properties-->Advanced. From the Auditing tab, click Add and then enter the users/groups whom you want to audit and what actions you want to audit
- auditing Full Control will create an audit entry every time anyone opens/changes/closes or deletes a file, or you can just audit for delete operations. You are now auditing that folder. You will need to monitor the event logs for the particular events.
An alternate option available is here. You can try this utility (
http://www.fileserverauditing.com) to find out who deleted specific files or folder.