• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 178
  • Last Modified:

File/Folder moves on a Win2003 File server without user intervention

I have an issue with files and folders on a Windows 2003 files server moving without user intervention.  The files and folders move on the same partition on the server.  At first I assumed one of my users accidently moved the data, but on furher investigation I found that some of the folders were only partually moved.  I would have expected all the files from all folders to be moved.

Has anyone seen this issue before or recommend any way to track access other that Microsoft Auditing.  I have auditing turned on, but find it very dificult to pinpoint specific access with all the data that accumulates.
0
tim_elliott
Asked:
tim_elliott
  • 2
1 Solution
 
Justin OwensITIL Problem ManagerCommented:
It is probably still user intervention.  If a folder is only partially moved, it is most likely because the move was canceled.  

As far as tracking moves, enable auditing on the share.
 
 R-click the shared folder -> properties -> advanced -> auditing tab
 
 Add a group or account to audit. Then check successful create file/folder, delete subfolders/files and whatever else you want.

Justin
0
 
tim_elliottAuthor Commented:
Thank you for the response.  Later after I made the post I thought about a user canceling the move and realized that would leave a folder split.  I do have auditing turned on but since the share has about 50 % of the companies networked files are stored here, the logs are full of file/folder access.  Is there a better way to filter the audit data to locate the info I need?
0
 
Justin OwensITIL Problem ManagerCommented:
I use Splunk for event log parsing:

http://www.splunk.com

Justin
0

Featured Post

Get your problem seen by more experts

Be seen. Boost your question’s priority for more expert views and faster solutions

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now