A user reports that each day some files are deleted from the department share. The administrator needs to find who deleted these files. Which of the following actions should the administrator perform?

Task Manager monitors running processes and performance; it cannot be used to configure file and folder auditing settings.

Audit Policy Change tracks changes to audit policies themselves, not access or deletion of files and folders.

Audit Object Access is the correct audit policy category that covers file and folder access events including deletions. After enabling this policy via Local Security Policy or Group Policy, the administrator must also configure auditing on the specific files or folders through their Security tab in Windows Explorer, selecting which access types (such as Delete) to audit and for which users. Both steps together produce Security event log entries identifying who performed deletions.

Performance Monitor tracks system resource metrics such as CPU and disk I/O but does not log user-level file operations or identify which user deleted a file.