Solved

Files disappearing from server, should I audit?

Posted on 2010-11-15
3
588 Views
Last Modified: 2012-06-22
Hello,

When I came in this morning, files on the root of a specific share were gone.  Not folders, only files and not hidden files.  This share is publicly accessible to everyone in our organization.

Someone requested a few files and I restored them.  Within a few hours, those files were also gone.  We have had incidents before where someone had actually deleted files from this particular share.

Should I turn on auditing to see what is happening?  I am presently looking at this article:
How to set up and manage operation-based auditing for Windows Server 2003, Enterprise Edition: http://support.microsoft.com/kb/325898

Any help is greatly appreciated!

Thanks,

Maureen
0
Comment
Question by:maureen99
  • 2
3 Comments
 
LVL 7

Accepted Solution

by:
tstritof earned 500 total points
Comment Utility
Hi,

my post isn't strictly technical, but if you need specific help on auditing feel free to ask.

When auditing object access you can detect any action on an object by either anyone or a specific group of users. However - to audit an allowed deletion of a file (this is currently your situation) would require you to audit successful object actions. That can quickly fill up your security logs by loads of collateral events. That is because many system objects have auditing enabled by default and get busy logging immediately after you activate the policy.

A bit more "devious" and less event log expensive way would be to activate the policy to log only failures (significantly lower number of events), place a set of "bate" files on the share, and then allow the deletion only to yourself. That way if someone other than you tries to delete the file, they will get access denied, plus you will get the deletion attempt (failed) logged in security log.

If this is being done inadvertantly by a person (like someone using cut instead of copy) than they'll probably complain to you because they can't do what they want. If this is done on purpose then you will probably have harder time catching the culprit since they will be warned off by access denied message (however at least one failure will be logged). And if it's done by malware then you'll have events overflowing your log.

Regards,
Tomislav
0
 

Author Comment

by:maureen99
Comment Utility
thanks,

I am seeing entries adding up in the event log.   I like your idea however and I may give it a try, thanks alot!

Maureen
0
 
LVL 7

Expert Comment

by:tstritof
Comment Utility
You're welcome.

When (if) files get deleted, look for event ID 560. It's an event logged in Windows Server 2003 when process obtains a handle to the object, and in event description you should be able to find all you need: user, filename and access type (Accesses property - usually DELETE if file is accessed for deletion). Unfortunately since this is a Windows Server 2003 there's not much you can do in terms of smart filtering in event log.

Regards,
Tomislav
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

The question has been asked on multiple occasions as to how best to do printing in a remote desktop or terminal services environment.   It seems that this particular question has plagued several people and most especially as Terminal Services, as…
Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now