How can I find out who deleted a file or folder?
Applies to
ONTAP 9
Answer
- With default configurations for CIFS/SMB or NFS, the identity of a user who deleted or renamed a file/folder or modified permissions cannot be determined.
- Refer to the SMB/CIFS and NFS Auditing and Security Tracing Guide for more information on how this can be implemented with auditing or fpolicy.
- It is recommended that this be considered prior to implementing SMB/CIFS or NFS.
- If this is not configured or not configured properly and a file or folder has been deleted, the identity of the user who performed the delete cannot be determined.
Additional Information