Subscribe

one of the CIFS folder is been deleted, have recovered it through windows "previous version" but just would like to know if I wanted to see which domain user has deleted that folder then what will be the way

one of the CIFS folder is been deleted, have recovered it through windows "previous version" but just would like to know if

I wanted to see which domain user has deleted that folder then what will be the way ??

Netapp system: FAS 3140 cluster Data Ontap 7.3

I've seen something like this : cifs audit save ?? will it serve the purpose ?? , plz help in auditing the folder deletion of the CIFS share.

Re: one of the CIFS folder is been deleted, have recovered it through windows "previous version" but just would like to know if I wanted to see which domain user has deleted that folder then what will be the way

Any one can help me on this ?????

Re: one of the CIFS folder is been deleted, have recovered it through windows "previous version" but just would like to know if I wanted to see which domain user has deleted that folder then what will be the way

Hi,

Have you enabled the CIFS audting option? e.g:

>cifs.audit.enable on/off

If you enter "options cifs.audit" on your appliance, you will see all the available options for auditing.

The CIFS Audit log should capture the information you need, but obviously this will only be for future CIFS actions etc.

Check the log size and interval, otherwise your audit log maybe overwritten before you capture the information you require.

Hope this helps

Thanks

Re: one of the CIFS folder is been deleted, have recovered it through windows "previous version" but just would like to know if I wanted to see which domain user has deleted that folder then what will be the way

I can see "cifs.audit.enable  is "on" , I took edtaudit.evt file , opened through even viewer ....but it is not helping me to find out which domain user has deleted the particular folder.