I had a reader write me a few days ago:
...I'm in a school environment and a student has deleted some files and I would like to know how I can do this in Win2k server to catch this sucker. Please advice and more power to you.This can be accomplished through auditing. Lets start out by identifying what folder we want to watch - and be careful where you turn on auditing...turn it on too many folders with too many options and you can have huge performance issues.
We find the folder we want, and right click on it and go to properties

This will bring up the properties page for the folder. Move over to the security tab, and click on the advanced button:

The advanced page will appear. Click on the Auditing tab, and click the add button:

A user dialog will come up. I chose to put the "Everyone" group here. This...