>Thank you Ed again.
>I, We don't think it's as serious as to take it to the court. We just only need to know why and who did it and are ready to listen to his excuse or whatever.
>Anyway I followed your instruction and checked two of options in the audit panel; 'loged on and off' and 'file ...access' (please understand we don't use English NT so I assume and translate every terms).
>Do you think it's enough to find all the history of the files from generating to deletion ?

No; it won't go back and recover what went on in the past. It will record login/logout of each user logging into it (presumably you have domain-level access control if you're running NT Server. It will record any time any file watched by the auditing on the server is accessed. The log will probably get very large very quickly with the selections you're made, and will have to be examined and cleared; there's a maximum size that the log can get to before it stops logging.


>Oh! Let me ask you one more thing. Where is the place that I can make all the deleted files moved to the trash bin ?

AFAIK, you can't - you can tell the system to never write deleted files into the RecycleBin's Property Sheet, but not force every deletion through RecycleBin. I wouldn't want this IAC, you generate lots of temp files that you aren't aware of constantly, and delete them when you're done...

You can simply open or explore RecycleBin, and once there, you can mark files in there to be restored or deleted permanently.

You might want to check www.ntfaq.com to see if there's anything there describing how to do this; I can't find it if it does exist as an option.