Solved

How to find out which user have deleted the files from shared folder and who copied songs in that folder

Posted on 2004-09-12
5
244 Views
Last Modified: 2008-02-01
We are using 10 Servers 3 Domain Controllers and 7 Memeber Servers - I have to find out which user have deleted files from a particular network shared folder - also which user have put songs on shared network folder - We are using Windows 2000 Servers and Win 2k professional desktops
0
Comment
Question by:AzfarL
5 Comments
 
LVL 83

Accepted Solution

by:
oBdA earned 500 total points
ID: 12039052
If you haven't enabled auditing of the folder in question *before* the deletion took place, there's no possibility to find out which user deleted a file. Windows by itself doesn't log deletion or creation of files unless explicitly told to.
HOW TO: Set, View, Change, or Remove Auditing for a File or Folder in Windows 2000
http://support.microsoft.com/?kbid=301640
As for the songs: open the properties of the files, go to the Security tab, click the "Advanced" button, go the "Owner" tab, check who's the owner -- that's (very probably) your culprit. Note, though, that if an administrator copied those files, he might have been smart enough to change the owner of a file after copying ...
0
 
LVL 83

Expert Comment

by:oBdA
ID: 12039127
Oh, and (better to be safe than sorry) one word of caution: It's too late now to find out who deleted those files; but if you're going to enable auditing for future events, don't get too carried away. Auditing files can have a serious impact on your file server's performance if used excessively.
0
 
LVL 17

Expert Comment

by:Jared Luker
ID: 12039739
There are network based undelete utilities out there that can tell you the when/where/who of undeleted files.  Unfortunatly, the names of those utilites is currently escaping me.  I'll post another if I can think of them.

Good Luck

Jared
0
 
LVL 10

Expert Comment

by:jayca
ID: 12046919
Also, you might want to look into Windows SharePoint Services.  A web based document library application that is a free addon to Windows 2003 Server.  Great way to manage file repositories as well as audit and track everything including version control.
0
 
LVL 12

Expert Comment

by:alandc
ID: 12438262
Undelete 4.0 Server (currently $299)
http://smallbiz.executive.com/purchase/Undelete.asp
0

Featured Post

Live: Real-Time Solutions, Start Here

Receive instant 1:1 support from technology experts, using our real-time conversation and whiteboard interface. Your first 5 minutes are always free.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Introduction How to create multiboot configuration with XP\Vista and Windows 7 on it? And most important question - how to do this correctly so not to have any kind of nightmares we get when system gets screwed? First of all one should realize t…
Just about everyone has an old PC laying around.  Ask anyone in the IT industry, whether they are a professional or play in it as a hobby.  From outdated Desktops to cheap "throwaway" laptops, they are all around and not as hard to "fix up" as you m…
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…
Hi friends,  in this video  I'll show you how new windows 10 user can learn the using of windows 10. Thank you.

785 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question