How can I determine who deleted a file from a shared drive?

[rmyers1]

Is anyone aware of a log file that could be referenced to determine who deleted a file form a share drive? We have a couple apps that monitor the active directory (AD) and share drive activity but cannot find anything related to additions, deletions, or modifications.

[adonio]

Like @cpetterborg mentioned, it can be done.
you will need to enable special auditing on the folders you would like to keep track off.
this is not the most dated article but it explains how to enable the right auditing policies.
https://blogs.technet.microsoft.com/mspfe/2013/08/26/auditing-file-access-on-file-servers/
now you can monitor with Splunk
again like mentioned above, the auditing settings will not work retroactively.
hope it helps a little

[cpetterborg]

There are windows events that you can turn on that will look at specific files or directories for changes (fine grain auditing) that can be used to detect changes. They are not retroactive, however, and they have to be set up for each file or directory that you want to have changes logged. You also have to use the Windows App to get the WinEvents into Splunk.