A user reports that each day some files are deleted from the department share. The administrator needs to find who deleted these files. Which of the following actions should the administrator perform?

Task Manager monitors running processes and CPU/memory performance and cannot be used to configure file or folder auditing settings.

'Audit Policy Change' logs changes to the audit policy configuration itself, not file access or deletion events by users.

The 'Audit Object Access' policy in Local Security Policy or Group Policy enables Windows to log access events for securable objects such as files and folders. After enabling this policy, an administrator must open Windows Explorer, access the Security tab of the specific file or folder, and add an audit entry - this two-step process causes deletion events to be written to the Security event log with the responsible user's identity.

Performance Monitor collects system performance metrics such as disk I/O counters and does not log file-level access events tied to specific user accounts.