Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Find out who changed a fie name

Posted on 2010-11-08
2
Medium Priority
?
1,176 Views
Last Modified: 2012-05-10
Anyone know how to find out who changed a file name or a folder name?

Server 2008
Windows 7

Someone changed a folder name and a file name and we need to find out who did this. (inappropriate name)
0
Comment
Question by:GPPSD2357
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 4

Accepted Solution

by:
dcolvard2008 earned 1000 total points
ID: 34088090
Have you turned on auditing?
If you haven't then you might not be able to determine who changed the file or folder.


To turn on auditing In Windows 7 or Windows 2008 member server
http://www.discoveryourpc.net/2010/01/auditing-access-to-files-on-windows-7-html/

To turn on auditing in Windows Server 2008 Domain
Enabling file auditing is a 2-step process.
 
 [1] Configure "audit object access" in AD Group Policy or on the server's
 local GPO. This setting is located under Computer Configuration-->Windows
 Settings-->Security Settings-->Local Policies-->Audit Policies. Enable success/failure
 auditing for "Audit object access."
 
 [2] Configure an audit entry on the specific folder(s) that you wish to audit.
 Right-click on the folder-->Properties-->Advanced. From the Auditing tab,
 click Add, then enter the users/groups whom you wish to audit and what actions
 you wish to audit - auditing Full Control will create an audit entry every
 time anyone opens/changes/closes/deletes a file, or you can just audit for
 Delete operations.
 
 After you have this setup you simply check the security logs for file or folder changes.
 


 
0
 
LVL 2

Expert Comment

by:rowlow
ID: 34088420
If you have not setup auditing you can narrow down who the culprit was by checking the NTFS and Share permissions on that specific folder and file.
You can narrow down suspects even more  checking at what time and day this folder/file has changed, but you should prepare yourself that there is a chance you will not get conclusive evidence.
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately. This Article and the Links apply to…
This article explains how to install and use the NTBackup utility that comes with Windows Server.
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…

715 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question