Deletion of NetApp cifs content is not audited when deleted from a Windows 8.1, Windows 10, or Windows 12 workstation (4269516)

When a file deleted on a cifs share (Netapp Cluster-Mode only), a delete event is not recorded by Change Auditor if the file is deleted using a workstation running Windows 8.1, Windows 10, or Windows 12

Windows 7 is will record a delete event correctly.

NetApp Release 8.2.2P2 Cluster-Mode is impacted.

NetApp changed how "File Delete" events are communicated.

WORKAROUND

None

STATUS

Issue fixed in version Change Auditor 6.7.1463. Once upgraded, "File Open" events also needs to be enabled on the NetApp auditing template. By enabling "File Open" events, Change Auditor is able to process the new format of the "File Delete" events.

Alternatively, upgrade to Change Auditor 6.7.1509 and "File Open" events will not be required to be enabled on the NetApp auditing template but Change Auditor will still be able to process the new format of the "File Delete" events.