• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 332
  • Last Modified:

MAC times

Hi we suspect one of our users has accidentally moved a directory on a share inside of another directory on a share. However, what NTFS read permission would they need to be able to move it from A to B, on the B folder? Or is there a way to see who copied this directory over, i.e. who moved it?

Also - the MAC (modified, accessed, created) times on this folder seem confusing. If a folder was created in say \\server\share\orig in march this year - and it was copied to \\server\share\new would it have a created time of today in new, or would it maintain the created time of orig. So if that directory was created in march in orig, and its copied inside of new, would it keep the march created time, or the time it was moved, i.e. yesterday?

Would love to solve whod done this. Its a 2003 server.
0
pma111
Asked:
pma111
  • 5
  • 2
2 Solutions
 
pma111Author Commented:
anyone?
0
 
MuraliCommented:
I dont think you can find it.. unless you have file level auditing enabled in your security policy...

I dont think the copy/move will change the timestamp of folders and files...
0
 
pma111Author Commented:
What NTFS permissions could we set on our directory (to allow them to read all data and create sub dirs) but would prevent anyone mistakenly moving it in the future?
0
Worried about phishing attacks?

90% of attacks start with a phish. It’s critical that IT admins and MSSPs have the right security in place to protect their end users from these phishing attacks. Check out our latest feature brief for tips and tricks to keep your employees off a hackers line!

 
pma111Author Commented:
What does a greyed out tick box on the NTFS permissions represent?

Im just on the security tab for our directory, our group has a solid black tick box next to the various NTFS options, but on the other groups, the tick box next to various NTFS permissions is grey and faded. Just wondered if thats relevant.
0
 
pma111Author Commented:
If you move a directory into another directory, and then move it back, does it collect all the NTFS permissions for the directory it was moved to? So if before it was just group A, but then someone moved it to a directory where group B, C and D were, if you move it back, will it now grant access to everyone.
0
 
newmathCommented:
In regard to permissions, if the parent folder has inheritance turned on, the files and folders underneath get those permissions when objects are moved or copied into them. To address the issue of finding out who is moving files and folders, turn on audit object access. This link shows where to turn it on in the local policy for deletes, but it's pretty much the same for copy / move operations: http://www.petri.co.il/forums/showpost.php?p=140674&postcount=15

If you are in an AD environment, just turn on the audit settings in the GPO scope that this server falls under.
0
 
pma111Author Commented:
Do they get these immediately? i.e parent has inheritence to all below switchedon, i.e. copy a file to

\\server\share\parent\copieddata - does that from second it was copied then inherit the permissions

Do them inhetied permissions stay with the data if you move it back to its original location? So if I kept moving my directory here there and everywhere within other directories it will accmulate a heap of inherited permissions from the parent directoies it was temporarily stored in?
0
 
newmathCommented:
Immediately. Almost always files and folders inherit the permissions of the parent folder. But there are a few exceptions -- see Microsoft's explanation: http://support.microsoft.com/kb/310316
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 5
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now