topic Re: one of the CIFS folder is been deleted, have recovered it through windows &quot;previous version&quot; but just would like to know if I wanted to see which domain user has deleted that folder then what will be the way in Network and Storage Protocols https://community.netapp.com/t5/Network-and-Storage-Protocols/one-of-the-CIFS-folder-is-been-deleted-have-recovered-it-through-windows-quot/m-p/66673#M6101 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P>Have you enabled the CIFS audting option? e.g:</P><P>&gt;cifs.audit.enable on/off</P><P></P><P>If you enter "options cifs.audit" on your appliance, you will see all the available options for auditing.</P><P>The CIFS Audit log should capture the information you need, but obviously this will only be for future CIFS actions etc.</P><P>Check the log size and interval, otherwise your audit log maybe overwritten before you capture the information you require.</P><P>Hope this helps</P><P>Thanks <SPAN __jive_emoticon_name="happy" __jive_macro_name="emoticon" class="jive_macro jive_emote" src="https://community.netapp.com/4.0.8/images/emoticons/happy.gif"></SPAN></P></BODY></HTML> Wed, 02 Feb 2011 10:18:20 GMT martin_fisher 2011-02-02T10:18:20Z one of the CIFS folder is been deleted, have recovered it through windows "previous version" but just would like to know if I wanted to see which domain user has deleted that folder then what will be the way https://community.netapp.com/t5/Network-and-Storage-Protocols/one-of-the-CIFS-folder-is-been-deleted-have-recovered-it-through-windows-quot/m-p/66664#M6096 <HTML><HEAD></HEAD><BODY><P><STRONG style="font-size: 14pt; ">one of the CIFS folder is been deleted, have recovered it through windows "previous version" but just would like to know if </STRONG></P><P><STRONG style="font-size: 14pt; ">I wanted to see which domain user has deleted that folder then what will be the way ??</STRONG></P><P></P><P><SPAN style="font-size: 14pt;">Netapp system: <STRONG>FAS 3140 cluster Data Ontap 7.3</STRONG></SPAN></P><P></P><P><SPAN style="font-size: 14pt;"><STRONG>I've seen something like this : cifs audit save ?? will it serve the purpose ?? , plz help in auditing the folder deletion of the CIFS share.</STRONG></SPAN></P></BODY></HTML> Thu, 05 Jun 2025 07:01:04 GMT https://community.netapp.com/t5/Network-and-Storage-Protocols/one-of-the-CIFS-folder-is-been-deleted-have-recovered-it-through-windows-quot/m-p/66664#M6096 rashid_info 2025-06-05T07:01:04Z Re: one of the CIFS folder is been deleted, have recovered it through windows "previous version" but just would like to know if I wanted to see which domain user has deleted that folder then what will be the way https://community.netapp.com/t5/Network-and-Storage-Protocols/one-of-the-CIFS-folder-is-been-deleted-have-recovered-it-through-windows-quot/m-p/66669#M6099 <HTML><HEAD></HEAD><BODY><P>Any one can help me on this ?????</P></BODY></HTML> Wed, 02 Feb 2011 08:38:41 GMT https://community.netapp.com/t5/Network-and-Storage-Protocols/one-of-the-CIFS-folder-is-been-deleted-have-recovered-it-through-windows-quot/m-p/66669#M6099 rashid_info 2011-02-02T08:38:41Z Re: one of the CIFS folder is been deleted, have recovered it through windows "previous version" but just would like to know if I wanted to see which domain user has deleted that folder then what will be the way https://community.netapp.com/t5/Network-and-Storage-Protocols/one-of-the-CIFS-folder-is-been-deleted-have-recovered-it-through-windows-quot/m-p/66673#M6101 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P>Have you enabled the CIFS audting option? e.g:</P><P>&gt;cifs.audit.enable on/off</P><P></P><P>If you enter "options cifs.audit" on your appliance, you will see all the available options for auditing.</P><P>The CIFS Audit log should capture the information you need, but obviously this will only be for future CIFS actions etc.</P><P>Check the log size and interval, otherwise your audit log maybe overwritten before you capture the information you require.</P><P>Hope this helps</P><P>Thanks <SPAN __jive_emoticon_name="happy" __jive_macro_name="emoticon" class="jive_macro jive_emote" src="https://community.netapp.com/4.0.8/images/emoticons/happy.gif"></SPAN></P></BODY></HTML> Wed, 02 Feb 2011 10:18:20 GMT https://community.netapp.com/t5/Network-and-Storage-Protocols/one-of-the-CIFS-folder-is-been-deleted-have-recovered-it-through-windows-quot/m-p/66673#M6101 martin_fisher 2011-02-02T10:18:20Z Re: one of the CIFS folder is been deleted, have recovered it through windows "previous version" but just would like to know if I wanted to see which domain user has deleted that folder then what will be the way https://community.netapp.com/t5/Network-and-Storage-Protocols/one-of-the-CIFS-folder-is-been-deleted-have-recovered-it-through-windows-quot/m-p/66676#M6103 <HTML><HEAD></HEAD><BODY><P>I can see "cifs.audit.enable&nbsp; is "on" , I took edtaudit.evt file , opened through even viewer ....but it is not helping me to find out which domain user has deleted the particular folder.</P></BODY></HTML> Wed, 02 Feb 2011 10:55:33 GMT https://community.netapp.com/t5/Network-and-Storage-Protocols/one-of-the-CIFS-folder-is-been-deleted-have-recovered-it-through-windows-quot/m-p/66676#M6103 rashid_info 2011-02-02T10:55:33Z