Trace Logins When Files Were Deleted?

[jeannak]

Hi,

We've had employee theft and had several hundred files deleted from a machine running Windows XP. We've been able to recover most of the files, but I'd like to know if there's a way to see who was logged in and at what time when the files were deleted. I've already visited the Event Viewer (Admin Tools), which didn't really help. Any other tips?

Thanks!

[patrickjb]

You can turn on "Auditing" through "Group Policies". If Auditing was not turned on, I don’t believe Windows keeps any other record of who logs on. If you have a problem with employees deleting files that are not theirs, you can use NTFS to lock down your files. Are you using NTFS or FAT32?