MAC times

Hi we suspect one of our users has accidentally moved a directory on a share inside of another directory on a share. However, what NTFS read permission would they need to be able to move it from A to B, on the B folder? Or is there a way to see who copied this directory over, i.e. who moved it?

Also - the MAC (modified, accessed, created) times on this folder seem confusing. If a folder was created in say \\server\share\orig in march this year - and it was copied to \\server\share\new would it have a created time of today in new, or would it maintain the created time of orig. So if that directory was created in march in orig, and its copied inside of new, would it keep the march created time, or the time it was moved, i.e. yesterday?

Would love to solve whod done this. Its a 2003 server.
LVL 4
pma111Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

pma111Author Commented:
anyone?
0
MuraliCommented:
I dont think you can find it.. unless you have file level auditing enabled in your security policy...

I dont think the copy/move will change the timestamp of folders and files...
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
pma111Author Commented:
What NTFS permissions could we set on our directory (to allow them to read all data and create sub dirs) but would prevent anyone mistakenly moving it in the future?
0
Acronis True Image 2019 just released!

Create a reliable backup. Make sure you always have dependable copies of your data so you can restore your entire system or individual files.

pma111Author Commented:
What does a greyed out tick box on the NTFS permissions represent?

Im just on the security tab for our directory, our group has a solid black tick box next to the various NTFS options, but on the other groups, the tick box next to various NTFS permissions is grey and faded. Just wondered if thats relevant.
0
pma111Author Commented:
If you move a directory into another directory, and then move it back, does it collect all the NTFS permissions for the directory it was moved to? So if before it was just group A, but then someone moved it to a directory where group B, C and D were, if you move it back, will it now grant access to everyone.
0
newmathCommented:
In regard to permissions, if the parent folder has inheritance turned on, the files and folders underneath get those permissions when objects are moved or copied into them. To address the issue of finding out who is moving files and folders, turn on audit object access. This link shows where to turn it on in the local policy for deletes, but it's pretty much the same for copy / move operations: http://www.petri.co.il/forums/showpost.php?p=140674&postcount=15

If you are in an AD environment, just turn on the audit settings in the GPO scope that this server falls under.
0
pma111Author Commented:
Do they get these immediately? i.e parent has inheritence to all below switchedon, i.e. copy a file to

\\server\share\parent\copieddata - does that from second it was copied then inherit the permissions

Do them inhetied permissions stay with the data if you move it back to its original location? So if I kept moving my directory here there and everywhere within other directories it will accmulate a heap of inherited permissions from the parent directoies it was temporarily stored in?
0
newmathCommented:
Immediately. Almost always files and folders inherit the permissions of the parent folder. But there are a few exceptions -- see Microsoft's explanation: http://support.microsoft.com/kb/310316
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.