How can I determine who deleted a file from a shared drive?

New Member

Is anyone aware of a log file that could be referenced to determine who deleted a file form a share drive? We have a couple apps that monitor the active directory (AD) and share drive activity but cannot find anything related to additions, deletions, or modifications.

0 Karma

Ultra Champion

Like @cpetterborg mentioned, it can be done.
you will need to enable special auditing on the folders you would like to keep track off.
this is not the most dated article but it explains how to enable the right auditing policies.
now you can monitor with Splunk
again like mentioned above, the auditing settings will not work retroactively.
hope it helps a little

0 Karma


There are windows events that you can turn on that will look at specific files or directories for changes (fine grain auditing) that can be used to detect changes. They are not retroactive, however, and they have to be set up for each file or directory that you want to have changes logged. You also have to use the Windows App to get the WinEvents into Splunk.

Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...