I have a Windows Server 2003 R2 with 48 GB of RAM; server has been running strong for quite some time. Recently our boot.ini was modified causing issues, most likely by our remote administrators. Now the server is only showing 14 GB of RAM. This has caused major performance issues for our end users.
Our remote administrators have stated "we don't change the boot.ini settings(switches)". However, I know for a fact that all of the local administrators have not modified the switches (due to lack of permissions).
The real question.. Is it possible to "audit" who has modified the boot.ini? If thats not possible, can the boot.ini be set via startup?
Any help would be greatly appreciated. This is an ongoing issue that I would love to resolve.