>Would anyone help me with this? Someone deleted a couple of important files on NT Server ,maybe during the night, and it's not the first time;it happened before. The original of deleted files were saved in the owner's own HDD,as of now it's O.K, but everyone concerned want to know who did it and when ,finally why; by mistake or intentianally.
>Every clients doesn't log on NT Domain but instead every dept form their workgroup and there are service forders for each workgroups with security option. So the suspect(^^) must be one of members of the dept.
>So how can I arrest and get him ? Any tips or suggstion would be greatly of help to me.

You can't after the fact; you can turn on NT's auditing through User Manager, but it's going to eat the server's performance and lots of disk if you turn on all the necessary accounting options.

You have to log into the domain as an Administrator or equivalent, run User Manager for Domains, Policies/Auditing and go from there. The online help will describe what each of the variety of logging options do.

I don't know if the logs are sufficient to take legal action against someone; I'd strongly recommend consulting an attorney. I'd also have managemwent make it clear to all users on the system that they will take action to fire/prosecute based on the recorded results.