I have enabled auditing on my Windows 2008 file server. I am audinting who deletes files\folders. I am trying to understand what is the correct event ID to give me that information? I thought that event ID 4656 gives me the information. Is that correct?
Please help!!!