Hello MarkUAIT,
Is it repetitive ?
No, it's an error of manipulation from one of th three user.
Regards.
Main Topics
Browse All TopicsI had a user come up to me yesterday and tell me their files had disappeared off our Windows 2003 server. They swore they hadn't done anything with them, and I believe that at least intentionally they hadn't. However, I had a hunch that they weren't deleted, just misplaced, and I found them in another directory. Again, the user said they didn't move them, and I've checked with the three people who have rights to that directory and each says that they didn't. Is there any way that something could be wrong with the server and move where files are located without user involvement? Here's the directory structure:
\\Server\data\folderA\fold
Any thoughts?
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
The only reason I suspect it wasn't a "click and drag" error is that when I went to move the files back, I had to respond to several system prompts, i.e. "move this read-only file", "thumbs.db is a system file, do you want to move?" I would think if someone inadvertantly clicked and dragged originally they would have received the same thing, and unless they are flat out lying--which I don't suspect--they couldn't have inadvertantly moved the file.
I wouldn't say this is repetitive, although about six months ago the same thing happened to a related but different directory. That time I suspected a click and drag mistake from someone, but since it had happened once before I've now become suspicious.
I've never turned on file auditing. Does that present any problems? Are there any reasons not to keep that enabled all the time?
I'd turn on file & folder auditing only on the suspect folder as it will fill security logs and a ferocious rate. Also, you may want to set the security log size on that server to 1GB and allow overwrite as necessary - depending on the files & folders and their usage, you're going to get a lot of events regardless.
Business Accounts
Answer for Membership
by: MikeHolcombPosted on 2009-11-07 at 06:57:04ID: 25766514
Without file auditing enabled (http://www.experts-exchan ge.com/Net working/ Ne twork_Mana gement/Aud iting_Soft ware/Q_226 31265.html ), there's really no way to tell for sure what happened.
I would still suspect a user having a "click and drag" issue. Otherwise, you could suspect more malicious activity that you'll want to monitor for.
Hope this helps...
Mike