File/Folder moves on a Win2003 File server without user intervention

I have an issue with files and folders on a Windows 2003 files server moving without user intervention.  The files and folders move on the same partition on the server.  At first I assumed one of my users accidently moved the data, but on furher investigation I found that some of the folders were only partually moved.  I would have expected all the files from all folders to be moved.

Has anyone seen this issue before or recommend any way to track access other that Microsoft Auditing.  I have auditing turned on, but find it very dificult to pinpoint specific access with all the data that accumulates.
Who is Participating?
Justin OwensITIL Problem ManagerCommented:
I use Splunk for event log parsing:

Justin OwensITIL Problem ManagerCommented:
It is probably still user intervention.  If a folder is only partially moved, it is most likely because the move was canceled.  

As far as tracking moves, enable auditing on the share.
 R-click the shared folder -> properties -> advanced -> auditing tab
 Add a group or account to audit. Then check successful create file/folder, delete subfolders/files and whatever else you want.

tim_elliottAuthor Commented:
Thank you for the response.  Later after I made the post I thought about a user canceling the move and realized that would leave a folder split.  I do have auditing turned on but since the share has about 50 % of the companies networked files are stored here, the logs are full of file/folder access.  Is there a better way to filter the audit data to locate the info I need?
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.