Sysmon and track deleted files on network share

Kania, Piotr 5

Hello

I've tried to use sysmon ver 15 to track detectedfiledeletion events on network share (windows 2022). Files deleted from local pc by user - works fine. But with remote access to share - As user is local system (not real user name).
Is any way to gather also the correct user name?

Thanks !

TravisL-8208 1 Reputation point

2023-09-13T16:23:27.9066667+00:00

I've been researching this same scenario and whether it would be possible or useful. It could be an architectural limitation or a design decision. Would you mind sharing the XML config you're using?
Atabatic 5 Reputation points

2023-09-14T04:20:18.4266667+00:00

Hello, Sysmon is not the right tool for this. You need to enable NTFS auditing and mark the share to be audited for Delete operations. The events will be in your security log.

Share via

Sysmon and track deleted files on network share

Your answer