Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1193
  • Last Modified:

Find out who changed a fie name

Anyone know how to find out who changed a file name or a folder name?

Server 2008
Windows 7

Someone changed a folder name and a file name and we need to find out who did this. (inappropriate name)
0
GPPSD2357
Asked:
GPPSD2357
1 Solution
 
dcolvard2008Commented:
Have you turned on auditing?
If you haven't then you might not be able to determine who changed the file or folder.


To turn on auditing In Windows 7 or Windows 2008 member server
http://www.discoveryourpc.net/2010/01/auditing-access-to-files-on-windows-7-html/

To turn on auditing in Windows Server 2008 Domain
Enabling file auditing is a 2-step process.
 
 [1] Configure "audit object access" in AD Group Policy or on the server's
 local GPO. This setting is located under Computer Configuration-->Windows
 Settings-->Security Settings-->Local Policies-->Audit Policies. Enable success/failure
 auditing for "Audit object access."
 
 [2] Configure an audit entry on the specific folder(s) that you wish to audit.
 Right-click on the folder-->Properties-->Advanced. From the Auditing tab,
 click Add, then enter the users/groups whom you wish to audit and what actions
 you wish to audit - auditing Full Control will create an audit entry every
 time anyone opens/changes/closes/deletes a file, or you can just audit for
 Delete operations.
 
 After you have this setup you simply check the security logs for file or folder changes.
 


 
0
 
rowlowCommented:
If you have not setup auditing you can narrow down who the culprit was by checking the NTFS and Share permissions on that specific folder and file.
You can narrow down suspects even more  checking at what time and day this folder/file has changed, but you should prepare yourself that there is a chance you will not get conclusive evidence.
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now