Tracking who deletes files on a cluster?

[adtrance]

There's auditing to enable log-tracking who deletes files by event 560. Folder properties > security tab > advanced > auditing tab. This, however, doesn't seem to work on a folder that is part of a clustered resource. Any one know exactly which auditing gp needs to be set so that I can view the event log of one of the 2 clustered server and see who deletes files?

 

[JDMnAR1]

Did you enable logging on the cluster virtual as opposed to the physical nodes?