How to find out which user have deleted the files from shared folder and who copied songs in that folder

We are using 10 Servers 3 Domain Controllers and 7 Memeber Servers - I have to find out which user have deleted files from a particular network shared folder - also which user have put songs on shared network folder - We are using Windows 2000 Servers and Win 2k professional desktops
AzfarLAsked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
oBdAConnect With a Mentor Commented:
If you haven't enabled auditing of the folder in question *before* the deletion took place, there's no possibility to find out which user deleted a file. Windows by itself doesn't log deletion or creation of files unless explicitly told to.
HOW TO: Set, View, Change, or Remove Auditing for a File or Folder in Windows 2000
http://support.microsoft.com/?kbid=301640
As for the songs: open the properties of the files, go to the Security tab, click the "Advanced" button, go the "Owner" tab, check who's the owner -- that's (very probably) your culprit. Note, though, that if an administrator copied those files, he might have been smart enough to change the owner of a file after copying ...
0
 
oBdACommented:
Oh, and (better to be safe than sorry) one word of caution: It's too late now to find out who deleted those files; but if you're going to enable auditing for future events, don't get too carried away. Auditing files can have a serious impact on your file server's performance if used excessively.
0
 
Jared LukerCommented:
There are network based undelete utilities out there that can tell you the when/where/who of undeleted files.  Unfortunatly, the names of those utilites is currently escaping me.  I'll post another if I can think of them.

Good Luck

Jared
0
 
jaycaCommented:
Also, you might want to look into Windows SharePoint Services.  A web based document library application that is a free addon to Windows 2003 Server.  Great way to manage file repositories as well as audit and track everything including version control.
0
 
Aland CoonsSystems EngineerCommented:
Undelete 4.0 Server (currently $299)
http://smallbiz.executive.com/purchase/Undelete.asp
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.