Solved

Find out who changed a fie name

Posted on 2010-11-08
2
1,083 Views
Last Modified: 2012-05-10
Anyone know how to find out who changed a file name or a folder name?

Server 2008
Windows 7

Someone changed a folder name and a file name and we need to find out who did this. (inappropriate name)
0
Comment
Question by:GPPSD2357
2 Comments
 
LVL 4

Accepted Solution

by:
dcolvard2008 earned 250 total points
ID: 34088090
Have you turned on auditing?
If you haven't then you might not be able to determine who changed the file or folder.


To turn on auditing In Windows 7 or Windows 2008 member server
http://www.discoveryourpc.net/2010/01/auditing-access-to-files-on-windows-7-html/

To turn on auditing in Windows Server 2008 Domain
Enabling file auditing is a 2-step process.
 
 [1] Configure "audit object access" in AD Group Policy or on the server's
 local GPO. This setting is located under Computer Configuration-->Windows
 Settings-->Security Settings-->Local Policies-->Audit Policies. Enable success/failure
 auditing for "Audit object access."
 
 [2] Configure an audit entry on the specific folder(s) that you wish to audit.
 Right-click on the folder-->Properties-->Advanced. From the Auditing tab,
 click Add, then enter the users/groups whom you wish to audit and what actions
 you wish to audit - auditing Full Control will create an audit entry every
 time anyone opens/changes/closes/deletes a file, or you can just audit for
 Delete operations.
 
 After you have this setup you simply check the security logs for file or folder changes.
 


 
0
 
LVL 2

Expert Comment

by:rowlow
ID: 34088420
If you have not setup auditing you can narrow down who the culprit was by checking the NTFS and Share permissions on that specific folder and file.
You can narrow down suspects even more  checking at what time and day this folder/file has changed, but you should prepare yourself that there is a chance you will not get conclusive evidence.
0

Featured Post

Zoho SalesIQ

Hassle-free live chat software re-imagined for business growth. 2 users, always free.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A procedure for exporting installed hotfix details of remote computers using powershell
A safe way to clean winsxs folder from your windows server 2008 R2 editions
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

912 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now