How to identify in windows events log when a folder is deleted?

1

I have an application that uses a c:\temp folder in windows and I need to identify somehow if this folder has been deleted to re-create the directory. To recreate, I have in mind to use the windows task scheduler and use the event trigger (which uses the windows event log) and then run a VBS that will re-create such a folder if it does not exist.

Is there any way I can identify this deletion through the windows event log?

    
asked by anonymous 28.10.2014 / 14:21

1 answer

2

Deleted files and folders are logged in the Windows log in "Security" if file system auditing is enabled.

See how apply or modify audit policy settings in a local file or folder .

This other article may also be of interest to you: Audit in Windows .

You did not explain why you want to do this, but here are some suggestions:

  • An application that needs to write to a folder or read a folder should itself check for it before it can create the folder itself - you do not have to depend on an external agent for it.

    / li>
  • An application should not use the c: \ temp folder. Windows provides API to manipulate temporary folder or user data in the appropriate location, below% with%. How to use this API varies according to your programming language.

In C:\Users\user_name , for example:

Set fso = CreateObject("Scripting.FileSystemObject")

Const TemporaryFolder = 2
Set tfolder = fso.GetSpecialFolder(TemporaryFolder)

msgbox tfolder

This code will show VBS , which is the appropriate place for an application to write and read temporary files.

    
28.10.2014 / 14:49