Solved

Who created a folder

Posted on 2006-07-20
2
339 Views
Last Modified: 2012-06-27
Basics:  I have a folder placed inside an NT4.0 Share.  We are running a W2K3 domain & the server is a leftover server being used for artwork.  I need to find out who created the folder inside the share.  Ownership Tab & Event Viewer Security shows ADMINISTRATOR GROUP as the owner.  I need to see a detail break down of who the actual user was.  We have several users who are considered ADMINS.

Any help or utility known would be greatly appreciated.

Rpierce1373
0
Comment
Question by:rpierce1373
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 25

Assisted Solution

by:mikeleebrla
mikeleebrla earned 250 total points
ID: 17149062
check the event log. If you didn't have logging turned on to log folder creation at the time it was created then you are SOL.  There is no way to go back in time and turn on logging after the fact.  Probably not the answer you were looking for, but just b/c you dont like the answer doesn't make in any less the correct answer.
0
 
LVL 43

Accepted Solution

by:
Steve Knight earned 250 total points
ID: 17149105
Agreed.  If the owner doesn't show anything then there is no hope.  Only thing you could check perhaps is the owner of any files inside the folder and/or the date/time of the folder creation and therefore maybe who was logged in at the time if you have any user login auditng on.

dir /tc gives you the creation dates
0

Featured Post

MS Dynamics Made Instantly Simpler

Make Your Microsoft Dynamics Investment Count  & Drastically Decrease Training Time by Providing Intuitive Step-By-Step WalkThru Tutorials.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I guess it is not common knowledge to most Wintel engineers/administrators: If you have an SNMP-based monitoring system in your environment (and it's common to have SNMP or Syslog) it's reasonably easy to enable monitoring of the Windows Event logs,…
Many of us need to configure DHCP server(s) in their environment. We can do that simply via DHCP console on server or using MMC snap-in on each computer with Administrative Tools installed in a network. But what if we have to configure many DHCP ser…
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…

623 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question