Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Files disappearing from server, should I audit?

Posted on 2010-11-15
3
Medium Priority
?
598 Views
Last Modified: 2012-06-22
Hello,

When I came in this morning, files on the root of a specific share were gone.  Not folders, only files and not hidden files.  This share is publicly accessible to everyone in our organization.

Someone requested a few files and I restored them.  Within a few hours, those files were also gone.  We have had incidents before where someone had actually deleted files from this particular share.

Should I turn on auditing to see what is happening?  I am presently looking at this article:
How to set up and manage operation-based auditing for Windows Server 2003, Enterprise Edition: http://support.microsoft.com/kb/325898

Any help is greatly appreciated!

Thanks,

Maureen
0
Comment
Question by:maureen99
  • 2
3 Comments
 
LVL 7

Accepted Solution

by:
tstritof earned 2000 total points
ID: 34139209
Hi,

my post isn't strictly technical, but if you need specific help on auditing feel free to ask.

When auditing object access you can detect any action on an object by either anyone or a specific group of users. However - to audit an allowed deletion of a file (this is currently your situation) would require you to audit successful object actions. That can quickly fill up your security logs by loads of collateral events. That is because many system objects have auditing enabled by default and get busy logging immediately after you activate the policy.

A bit more "devious" and less event log expensive way would be to activate the policy to log only failures (significantly lower number of events), place a set of "bate" files on the share, and then allow the deletion only to yourself. That way if someone other than you tries to delete the file, they will get access denied, plus you will get the deletion attempt (failed) logged in security log.

If this is being done inadvertantly by a person (like someone using cut instead of copy) than they'll probably complain to you because they can't do what they want. If this is done on purpose then you will probably have harder time catching the culprit since they will be warned off by access denied message (however at least one failure will be logged). And if it's done by malware then you'll have events overflowing your log.

Regards,
Tomislav
0
 

Author Comment

by:maureen99
ID: 34147753
thanks,

I am seeing entries adding up in the event log.   I like your idea however and I may give it a try, thanks alot!

Maureen
0
 
LVL 7

Expert Comment

by:tstritof
ID: 34149155
You're welcome.

When (if) files get deleted, look for event ID 560. It's an event logged in Windows Server 2003 when process obtains a handle to the object, and in event description you should be able to find all you need: user, filename and access type (Accesses property - usually DELETE if file is accessed for deletion). Unfortunately since this is a Windows Server 2003 there's not much you can do in terms of smart filtering in event log.

Regards,
Tomislav
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Some time ago I faced the need to use a uniform folder structure that spanned across numerous sites of an enterprise to be used as a common repository for the Software packages of the Configuration Manager 2007 infrastructure. Because the procedu…
Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
In response to a need for security and privacy, and to continue fostering an environment members can turn to for support, solutions, and education, Experts Exchange has created anonymous question capabilities. This new feature is available to our Pr…
Despite its rising prevalence in the business world, "the cloud" is still misunderstood. Some companies still believe common misconceptions about lack of security in cloud solutions and many misuses of cloud storage options still occur every day. …

963 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question