Solved

Find out who changed a fie name

Posted on 2010-11-08
2
1,077 Views
Last Modified: 2012-05-10
Anyone know how to find out who changed a file name or a folder name?

Server 2008
Windows 7

Someone changed a folder name and a file name and we need to find out who did this. (inappropriate name)
0
Comment
Question by:GPPSD2357
2 Comments
 
LVL 4

Accepted Solution

by:
dcolvard2008 earned 250 total points
Comment Utility
Have you turned on auditing?
If you haven't then you might not be able to determine who changed the file or folder.


To turn on auditing In Windows 7 or Windows 2008 member server
http://www.discoveryourpc.net/2010/01/auditing-access-to-files-on-windows-7-html/

To turn on auditing in Windows Server 2008 Domain
Enabling file auditing is a 2-step process.
 
 [1] Configure "audit object access" in AD Group Policy or on the server's
 local GPO. This setting is located under Computer Configuration-->Windows
 Settings-->Security Settings-->Local Policies-->Audit Policies. Enable success/failure
 auditing for "Audit object access."
 
 [2] Configure an audit entry on the specific folder(s) that you wish to audit.
 Right-click on the folder-->Properties-->Advanced. From the Auditing tab,
 click Add, then enter the users/groups whom you wish to audit and what actions
 you wish to audit - auditing Full Control will create an audit entry every
 time anyone opens/changes/closes/deletes a file, or you can just audit for
 Delete operations.
 
 After you have this setup you simply check the security logs for file or folder changes.
 


 
0
 
LVL 2

Expert Comment

by:rowlow
Comment Utility
If you have not setup auditing you can narrow down who the culprit was by checking the NTFS and Share permissions on that specific folder and file.
You can narrow down suspects even more  checking at what time and day this folder/file has changed, but you should prepare yourself that there is a chance you will not get conclusive evidence.
0

Featured Post

Promote certifications in your email signature

Has your company recently won an award or achieved a certification? They'll no doubt want to show it off. Email signature images used to promote certifications & awards can instantly establish credibility with a recipient and provide you with numerous benefits.

Join & Write a Comment

Normally after a failure of Domain Controller, when promoting new DC the DC is renamed, we will discuss the options in Dcpromo to re-create the DC with the same name. Scenario: You are a small IT shop with two Domain Controllers (Domain Contr…
I had a question today where the user wanted to know how to delete an SSL Certificate, so I thought that I would quickly add this How to! Article for your reference. WHY WOULD YOU WANT TO DELETE A CERTIFICATE? 1. If an incorrect certificate was …
This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now