Sysmon and track deleted files on network share

Kania, Piotr 5 Reputation points


I've tried to use sysmon ver 15 to track detectedfiledeletion events on network share (windows 2022). Files deleted from local pc by user - works fine. But with remote access to share - As user is local system (not real user name).
Is any way to gather also the correct user name?

Thanks !

Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.
999 questions
{count} vote