Solved

Moving files/folders...

Posted on 2009-05-05
8
442 Views
Last Modified: 2012-06-21
I have a frequent problem where users of my domain are accidently moving files and folders contained in shared folders on our server.  All users must have access to these folders, and must be able to perform read/write, but I would love to be able to stop block movement of items, or to at least be able to track these changes so I can properly train whoever is moving files/folders.

Any advice?
0
Comment
Question by:MrBookins
  • 3
  • 2
  • 2
  • +1
8 Comments
 
LVL 16

Expert Comment

by:warturtle
Comment Utility
The most basic way of tracking who is currently logged into the system and using shared folders is via Computer Management applet. Right-click on My Computer and select Manage. That will open the applet. Then you can click on Shared Folders/Shared Sessions to see who is logged on and in what shared folder.

I am sure that there are better methods of doing that, which other experts will suggest. I will also think of more options.
0
 
LVL 1

Author Comment

by:MrBookins
Comment Utility
I know who is using these directories.  Realistically, everyone in the domain is in those folders throughout the day.  I am  trying to track who is moving my files and folders, or I just want to block them.  We have a rather large file system, so it might be several days before anyone notices that a file/folder has been moved, so checking the Shares/Sessions will not give me relevant information.

Any other thoughts?
0
 
LVL 16

Expert Comment

by:warturtle
Comment Utility
Can you not just give read access to those folders that are being moved around and need to be blocked? You can remove the write access and let the users only copy stuff to their local computers to work on.
0
 
LVL 16

Expert Comment

by:speshalyst
Comment Utility
If you want to Audit Object access , you have have Audit enabled on these folders.
you can do that by going to the folder properties\security\advanced(button)\audit..
once you enable this, you can look at the Security Event Log to find out who accessed these folder objects.. but lemme warn you this will generate huge log files.. of you have everyone accessing these folders all day long
 
0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 33

Expert Comment

by:Todd Gerbert
Comment Utility
You can also get Process Monitor from www.sysinternals.com, and set filter to: Process Name = System, Operation = IRP_MJ_SET_INFORMATION, Event Class = File System, Detail contains "Delete", Path begins with "D:\Some\Interesting\Folder"

This should show you all deletions.

Also, you can deny (using advanced NTFS) the ability to delete and keep ability to create/modify files, however that would also prohibit ability to rename.
0
 
LVL 1

Author Comment

by:MrBookins
Comment Utility
speshalyst:
   
    I don't see an option for auditing the movement/copying of files and folders... Am I missing something?

tgerbert:

    Does Windows register the movement of files/folders as a deletion?  

Thanks for the suggestions, guys.
0
 
LVL 33

Accepted Solution

by:
Todd Gerbert earned 250 total points
Comment Utility
Yes, a move is a copy operation followed by a delete.

0
 
LVL 1

Author Closing Comment

by:MrBookins
Comment Utility
Great!  Thanks for the help!
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Roaming Profiles 8 57
Extending  a subnet 9 34
Options greyed out - Log on as a batch job 3 16
Linux as a middle box 7 9
PRTG Network Monitor lets you monitor your bandwidth usage, so you know who is using up your bandwidth, and what they're using it for.
A procedure for exporting installed hotfix details of remote computers using powershell
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now