stevespence999
asked on
DFS system deleting files?
I have a client who has 3 sites, each with a 2003 server running DFS. The DFS system is configured with one replication group which replicates live and two groups which replicated during the evening. The DFS systems are running the latest DFS hotfixes MS KB922972 and KB931685.
The issue is, users have reported files are randomly being deleted. At first I was sceptical and installed Windows Auditing to monitor file deletions on the 3 servers DFS paritions.
The logs however somewhat support the users claims. For example a user had a Word document open, saved their changes and closed the file. The log shows the word temp file being deleted, with the users AD account details next to the deletion. However, 13 secs later the log reports the actual word document being deleted, but without any user credentials next to the deletion.
Here's an extract from the log:
Thu May 15 2008 16:14:38 "F:\Data\GBT\April 08\~$ge 0508.doc" deleted by DOMAIN\jtods
Thu May 15 2008 16:14:52 "F:\Data\GBT\April 08\~$ril 08.doc" deleted by DOMAIN\jtods
Thu May 15 2008 16:14:54 "F:\Data\GBT\To Be Filed\~$nouncement08.DOC" deleted by DOMAIN\jwadel
Thu May 15 2008 16:15:03 "F:\Data\GBT\April 08\april 08.doc" deleted
Thu May 15 2008 16:15:23 "F:\Data\GBT\April 08\~$blank.doc" deleted by DOMAIN\jtods
This is only one example, there have been instances of whole folders being deleted. The only common factor is all the files/folders deleted had recently been worked on prior to their deletion.
Has anyone any experience of similar issues?
The issue is, users have reported files are randomly being deleted. At first I was sceptical and installed Windows Auditing to monitor file deletions on the 3 servers DFS paritions.
The logs however somewhat support the users claims. For example a user had a Word document open, saved their changes and closed the file. The log shows the word temp file being deleted, with the users AD account details next to the deletion. However, 13 secs later the log reports the actual word document being deleted, but without any user credentials next to the deletion.
Here's an extract from the log:
Thu May 15 2008 16:14:38 "F:\Data\GBT\April 08\~$ge 0508.doc" deleted by DOMAIN\jtods
Thu May 15 2008 16:14:52 "F:\Data\GBT\April 08\~$ril 08.doc" deleted by DOMAIN\jtods
Thu May 15 2008 16:14:54 "F:\Data\GBT\To Be Filed\~$nouncement08.DOC" deleted by DOMAIN\jwadel
Thu May 15 2008 16:15:03 "F:\Data\GBT\April 08\april 08.doc" deleted
Thu May 15 2008 16:15:23 "F:\Data\GBT\April 08\~$blank.doc" deleted by DOMAIN\jtods
This is only one example, there have been instances of whole folders being deleted. The only common factor is all the files/folders deleted had recently been worked on prior to their deletion.
Has anyone any experience of similar issues?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Have the same issue as well.
I am having the same issue in 35+ offices as they replicate back to a farm of central servers at our data center for the purpose of off site backup. I have been working with Microsoft for over six months. They have been able to reproduce the "phantom deletions" in their lab. They have identified a bug in their DFSR algorithym. I have been told that the bug is in 2003 and also 2008. They state that the investigation/redesign/tes
Same problem...
But not luck for response...
But not luck for response...
hi, any news for this issue?
We're having the same problem. Could anything be worse than Enterprise-level file replication, intended to make valuable data MORE secure, actually deleting the very same data? How does a bug like that sneak in?
The bad news I'm afraid is that I never found out what the problem was. In the end I rebuilt the servers when the time for a hard-drive upgrade came, and I didn't reinstate the replicated drive. I would be very interested if anyone else has had these experiences, especially if someone has managed to find the cause.