one of the CIFS folder is been deleted, have recovered it through windows "previous version" but just would like to know if I wanted to see which domain user has deleted that folder then what will be the way

[rashid_info]

one of the CIFS folder is been deleted, have recovered it through windows "previous version" but just would like to know if

I wanted to see which domain user has deleted that folder then what will be the way ??

Netapp system: FAS 3140 cluster Data Ontap 7.3

I've seen something like this : cifs audit save ?? will it serve the purpose ?? , plz help in auditing the folder deletion of the CIFS share.

[rashid_info]

Any one can help me on this ?????

[martin_fisher]

Hi,

Have you enabled the CIFS audting option? e.g:

>cifs.audit.enable on/off

If you enter "options cifs.audit" on your appliance, you will see all the available options for auditing.

The CIFS Audit log should capture the information you need, but obviously this will only be for future CIFS actions etc.

Check the log size and interval, otherwise your audit log maybe overwritten before you capture the information you require.

Hope this helps

Thanks

[rashid_info]

I can see "cifs.audit.enable  is "on" , I took edtaudit.evt file , opened through even viewer ....but it is not helping me to find out which domain user has deleted the particular folder.