Solved

How to find out which user have deleted the files from shared folder and who copied songs in that folder

Posted on 2004-09-12
5
245 Views
Last Modified: 2008-02-01
We are using 10 Servers 3 Domain Controllers and 7 Memeber Servers - I have to find out which user have deleted files from a particular network shared folder - also which user have put songs on shared network folder - We are using Windows 2000 Servers and Win 2k professional desktops
0
Comment
Question by:AzfarL
5 Comments
 
LVL 84

Accepted Solution

by:
oBdA earned 500 total points
ID: 12039052
If you haven't enabled auditing of the folder in question *before* the deletion took place, there's no possibility to find out which user deleted a file. Windows by itself doesn't log deletion or creation of files unless explicitly told to.
HOW TO: Set, View, Change, or Remove Auditing for a File or Folder in Windows 2000
http://support.microsoft.com/?kbid=301640
As for the songs: open the properties of the files, go to the Security tab, click the "Advanced" button, go the "Owner" tab, check who's the owner -- that's (very probably) your culprit. Note, though, that if an administrator copied those files, he might have been smart enough to change the owner of a file after copying ...
0
 
LVL 84

Expert Comment

by:oBdA
ID: 12039127
Oh, and (better to be safe than sorry) one word of caution: It's too late now to find out who deleted those files; but if you're going to enable auditing for future events, don't get too carried away. Auditing files can have a serious impact on your file server's performance if used excessively.
0
 
LVL 17

Expert Comment

by:Jared Luker
ID: 12039739
There are network based undelete utilities out there that can tell you the when/where/who of undeleted files.  Unfortunatly, the names of those utilites is currently escaping me.  I'll post another if I can think of them.

Good Luck

Jared
0
 
LVL 10

Expert Comment

by:jayca
ID: 12046919
Also, you might want to look into Windows SharePoint Services.  A web based document library application that is a free addon to Windows 2003 Server.  Great way to manage file repositories as well as audit and track everything including version control.
0
 
LVL 12

Expert Comment

by:alandc
ID: 12438262
Undelete 4.0 Server (currently $299)
http://smallbiz.executive.com/purchase/Undelete.asp
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Hello I read in a discussion about a person who configured a very simple mirror RAID with two hard drives; the system and data were on the same partition. He asked how to repair the system as it was not booting up anymore. In his case running …
I use more than 1 computer in my office for various reasons. Multiple keyboards and mice take up more than just extra space, they make working a little more complicated. Using one mouse and keyboard for all of my computers makes life easier. This co…
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…
Hi friends,  in this video  I'll show you how new windows 10 user can learn the using of windows 10. Thank you.

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question