Announcement

Collapse
No announcement yet.

Who moved the folder?

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Who moved the folder?

    Someone on the network, with change rights, has moved a very important folder (Not the first time this happens, I think people drag 'n drop by misstake). This did cause a great stir because some co-workers thought the data was lost. I need to figure out who's moving the folders so that I can "educate" the person.

    Edit:
    Running Windows 2003 SBS, I've heard that auditing is disabled by default - looking in to that as you read this.
    Last edited by Anders; 14th June 2006, 08:49.
    A wise man once said: "Assumption is the mother of all fu*k ups".

    Any advice I give is to the best of my knowledge, there is no guarantee what so ever that it will actually work in your particular scenario. I will not accept any responsibility for unexpected consequences, after all - you are taking advice from a complete stranger over the internet. =)

  • #2
    Re: Who moved the folder?

    As you have quite rightly said you will need to enable auditing on that folder.

    Maybe this will help

    http://technet2.microsoft.com/Window....mspx?mfr=true

    Comment


    • #3
      Re: Who moved the folder?

      Thanks!
      I concider this thread closed, in conclusion - Make sure you enable Auditing on newly installed servers. It will be to late when you realise you needed it the most.

      A wise man once said: "Assumption is the mother of all fu*k ups".

      Any advice I give is to the best of my knowledge, there is no guarantee what so ever that it will actually work in your particular scenario. I will not accept any responsibility for unexpected consequences, after all - you are taking advice from a complete stranger over the internet. =)

      Comment


      • #4
        Re: Who moved the folder?

        Originally posted by Anders
        Thanks!
        I concider this thread closed, in conclusion - Make sure you enable Auditing on newly installed servers. It will be to late when you realise you needed it the most.


        Glad to see you got it fixed.

        Well done

        Comment


        • #5
          Re: Who moved the folder?

          Glad to see you got your problem fixed.

          I have just attempted to set this up on our server but when I view my security logs they are inundated with 1,000s of logon/logoff events and i can not locate any events of me moving some folders as a test. What error numbers am I looking for?

          Can anyone help on this please?

          thanks

          Graham

          Comment


          • #6
            Re: Who moved the folder?

            Filter the security log by your user account and by the time span you moved it

            Tom
            Tom Jones
            MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
            PhD, MSc, FIAP, MIITT
            IT Trainer / Consultant
            Ossian Ltd
            Scotland

            ** Remember to give credit where credit is due and leave reputation points where appropriate **

            Comment

            Working...
            X