File/Folder moves on a Win2003 File server without user intervention

Posted on 2010-01-05
Last Modified: 2012-05-08
I have an issue with files and folders on a Windows 2003 files server moving without user intervention.  The files and folders move on the same partition on the server.  At first I assumed one of my users accidently moved the data, but on furher investigation I found that some of the folders were only partually moved.  I would have expected all the files from all folders to be moved.

Has anyone seen this issue before or recommend any way to track access other that Microsoft Auditing.  I have auditing turned on, but find it very dificult to pinpoint specific access with all the data that accumulates.
Question by:tim_elliott
    LVL 31

    Expert Comment

    It is probably still user intervention.  If a folder is only partially moved, it is most likely because the move was canceled.  

    As far as tracking moves, enable auditing on the share.
     R-click the shared folder -> properties -> advanced -> auditing tab
     Add a group or account to audit. Then check successful create file/folder, delete subfolders/files and whatever else you want.


    Author Comment

    Thank you for the response.  Later after I made the post I thought about a user canceling the move and realized that would leave a folder split.  I do have auditing turned on but since the share has about 50 % of the companies networked files are stored here, the logs are full of file/folder access.  Is there a better way to filter the audit data to locate the info I need?
    LVL 31

    Accepted Solution

    I use Splunk for event log parsing:


    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How to improve team productivity

    Quip adds documents, spreadsheets, and tasklists to your Slack experience
    - Elevate ideas to Quip docs
    - Share Quip docs in Slack
    - Get notified of changes to your docs
    - Available on iOS/Android/Desktop/Web
    - Online/Offline

    Learn about cloud computing and its benefits for small business owners.
    Create your own, high-performance VM backup appliance by installing NAKIVO Backup & Replication directly onto a Synology NAS!
    This tutorial will walk an individual through the process of installing the necessary services and then configuring a Windows Server 2012 system as an iSCSI target. To install the necessary roles, go to Server Manager, and select Add Roles and Featu…
    This Micro Tutorial will teach you how to reformat your flash drive. Sometimes your flash drive may have issues carrying files so this will completely restore it to manufacturing settings. Make sure to backup all files before reformatting. This w…

    760 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    7 Experts available now in Live!

    Get 1:1 Help Now