Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Like a lot of offices we have a few public shares for different teams to save their data. Today I helped someone restore some folders from a shadow copy that had been deleted sometime last week. While I had the shadow copies (and backups elsewhere), I couldn't answer the obvious first question.

"Who deleted the files?"

We're running Windows 2003 server, everyone has active directory accounts.

share|improve this question
    
I also found this link to be useful, it talks about adding auditing entries on folders. intelliadmin.com/index.php/2008/03/… –  reconbot May 11 '10 at 18:07

1 Answer 1

up vote 8 down vote accepted

Do you have object access auditing enabled and did you have auditing configured for the files\folders that were deleted? If the answers are no, then you won't be able to find out who deleted the content in question.

share|improve this answer
    
@wizard, See here for details about auditing serverfault.com/questions/125310/… –  Zoredache May 11 '10 at 17:00
    
I had the same problem and it turns out a user accidentically dragged the missing folder into a nearby folder within the share. Its worth checking out to avoid duplication or someone working/saving to an incorrect directory unknowningly. –  iainlbc May 11 '10 at 17:05
1  
Tell the users that they have 24 hours to admit it until you higher the expensive forensics specialists. –  Kyle Brandt May 11 '10 at 18:33
    
@kyle I don't believe that most of them would know if they did it. –  reconbot May 13 '10 at 15:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.