Dude, where is my file? Root cause analysis procedure for determining who deleted a file in a FRS/DFSR environment

A very technical but very informative article on finding out who deleted a file or folder in a FRS or DFS-R environment.

Three things I took away from this article

#1: Audit information is very important for tracking this kind of activity. It is pointless to try to determine who deleted the file if there is no tracking information to dig through.

#2: Most of the information needed from DFS-R is available through WMI. FRS requires additional programs. Yet another reason to move away from FRS and recreate your replicas in DFS-R.

#3: Pre-Vista operating systems have a 300MB event log size limitation.