Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

How to find out which user have deleted the files from shared folder and who copied songs in that folder

Posted on 2004-09-12
5
Medium Priority
?
269 Views
Last Modified: 2008-02-01
We are using 10 Servers 3 Domain Controllers and 7 Memeber Servers - I have to find out which user have deleted files from a particular network shared folder - also which user have put songs on shared network folder - We are using Windows 2000 Servers and Win 2k professional desktops
0
Comment
Question by:AzfarL
5 Comments
 
LVL 85

Accepted Solution

by:
oBdA earned 1500 total points
ID: 12039052
If you haven't enabled auditing of the folder in question *before* the deletion took place, there's no possibility to find out which user deleted a file. Windows by itself doesn't log deletion or creation of files unless explicitly told to.
HOW TO: Set, View, Change, or Remove Auditing for a File or Folder in Windows 2000
http://support.microsoft.com/?kbid=301640
As for the songs: open the properties of the files, go to the Security tab, click the "Advanced" button, go the "Owner" tab, check who's the owner -- that's (very probably) your culprit. Note, though, that if an administrator copied those files, he might have been smart enough to change the owner of a file after copying ...
0
 
LVL 85

Expert Comment

by:oBdA
ID: 12039127
Oh, and (better to be safe than sorry) one word of caution: It's too late now to find out who deleted those files; but if you're going to enable auditing for future events, don't get too carried away. Auditing files can have a serious impact on your file server's performance if used excessively.
0
 
LVL 17

Expert Comment

by:Jared Luker
ID: 12039739
There are network based undelete utilities out there that can tell you the when/where/who of undeleted files.  Unfortunatly, the names of those utilites is currently escaping me.  I'll post another if I can think of them.

Good Luck

Jared
0
 
LVL 10

Expert Comment

by:jayca
ID: 12046919
Also, you might want to look into Windows SharePoint Services.  A web based document library application that is a free addon to Windows 2003 Server.  Great way to manage file repositories as well as audit and track everything including version control.
0
 
LVL 12

Expert Comment

by:Aland Coons
ID: 12438262
Undelete 4.0 Server (currently $299)
http://smallbiz.executive.com/purchase/Undelete.asp
0

Featured Post

[Webinar] Cloud Security

In this webinar you will learn:

-Why existing firewall and DMZ architectures are not suited for securing cloud applications
-How to make your enterprise “Cloud Ready”, and fix your aging DMZ architecture
-How to transform your enterprise and become a Cloud Enabler

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Many people tend to confuse the function of a virus with the one of adware, this misunderstanding of the basic of what each software is and how it operates causes users and organizations to take the wrong security measures that would protect them ag…
I don't know if many of you have made the great mistake of using the Cisco Thin Client model with the management software VXC. If you have then you are probably more then familiar with the incredibly clunky interface, the numerous work arounds, and …
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…
Hi friends,  in this video  I'll show you how new windows 10 user can learn the using of windows 10. Thank you.

963 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question