Hi, How can I audit on one of my File Server who has delete or edit create files or directory? I am using SCOM 2019 server. Regards
To achieve this, we need to 1) enable file system auditing for the target computers; 2) crate a monitor/rule based on the specific Event ID generated above. For the step-by-step guide, we may refer to:
Note: the above articles are not from MS, just for your reference.
If the response is helpful, please click "Accept Answer" and upvote it.
May be consider using MARTELLO SCOM Files and Folders Monitoring Management Pack
4 people are following this question.