Looking for recommendations for auditing Windows file servers. I'm mainly looking to answer questions like, "Who moved/deleted that file?"
I know you can enable auditing, but is that reasonable to leave enabled for all servers all of the time? Long ago someone told me that you shouldn't leave it enabled outside of temporary troubleshooting because it would generate a ton of data.
With the built-in auditing, is it reasonable to go through the logs by hand, or are third-party tools usually required?