Who deleted ODBC data source

Campbell, Dan(BER) 1 Reputation point
2021-06-21T13:11:59.723+00:00

We have a system DSN ODBC data source on a Windows Server 2012 R2 Standard server that was deleted. How can I determine who deleted the data source?

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,088 questions
{count} votes

4 answers

Sort by: Most helpful
  1. Dave Patrick 426K Reputation points MVP
    2021-06-21T13:45:04.887+00:00

    Unless you had some auditing setup (file system or registry) prior there probably isn't a way.

    --please don't forget to upvote and Accept as answer if the reply is helpful--

    0 comments No comments

  2. JiayaoZhu 3,911 Reputation points
    2021-06-22T08:40:55.253+00:00

    Hi,

    Thanks for posting on our forum!

    Yes, I agree with what @Dave Patrick said, you need to give us more details about your storage settings. If you haven't configured any audit policy for files and folders, you should configure it right now. Then you will see event log entry's for file deletion and so on. You need to be careful when setting "auditing". If you go over the top it can put a considerable overhead on the server. Here are some articles you can follow:

    Configuring Audit Policies

    https://learn.microsoft.com/en-us/previous-versions/tn-archive/dd277403(v=technet.10)?redirectedfrom=MSDN

    Advanced Security Audit Policy Step-by-Step Guide

    https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd408940(v=ws.10)?redirectedfrom=MSDN

    If you have already configured audit policy for your files and folders, you can go to run cmd command regedit to check if you use registry key, for instance. Then you can go to %SystemRoot%\System32\winevt to find out event log entry's for file deletion and so on.

    Thanks for your support!

    BR,
    Joan


    If the Answer is helpful, please click "Accept Answer" and upvote it.

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments No comments

  3. JiayaoZhu 3,911 Reputation points
    2021-06-22T08:41:23.88+00:00

    Hi,

    Thanks for posting on our forum!

    Yes, I agree with what @Dave Patrick said, you need to give us more details about your storage settings. If you haven't configured any audit policy for files and folders, you should configure it right now. Then you will see event log entry's for file deletion and so on. You need to be careful when setting "auditing". If you go over the top it can put a considerable overhead on the server. Here are some articles you can follow:

    Configuring Audit Policies

    https://learn.microsoft.com/en-us/previous-versions/tn-archive/dd277403(v=technet.10)?redirectedfrom=MSDN

    Advanced Security Audit Policy Step-by-Step Guide

    https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd408940(v=ws.10)?redirectedfrom=MSDN

    If you have already configured audit policy for your files and folders, you can go to run cmd command regedit to check if you use registry key, for instance. Then you can go to %SystemRoot%\System32\winevt to find out event log entry's for file deletion and so on.

    Thanks for your support!

    BR,
    Joan


    If the Answer is helpful, please click "Accept Answer" and upvote it.

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments No comments

  4. Dave Patrick 426K Reputation points MVP
    2021-06-22T12:04:28.753+00:00

    Just checking if there's any progress or updates?

    --please don't forget to upvote and Accept as answer if the reply is helpful--

    0 comments No comments