Solved

How can I determine what’s or who's marking  folders on my file server as Protected Operating System Files?

Posted on 2013-01-18
5
324 Views
Last Modified: 2013-01-28
I have a 2008 server that I’m using as a file server.  Every couple of days I have two folders that disappear.  The only way to see them is to uncheck “hide protected operating system files”.   The option to unhide is grayed out so I have to unhide with the attrib -r -a -s -h *.* command, but then next time I look up, there hidden again.  I have made sure only domain admins have the right to change attributes.  Is there a way to track down the cause of this issue?
0
Comment
Question by:SpammyChicken
  • 2
  • 2
5 Comments
 
LVL 57

Expert Comment

by:giltjr
Comment Utility
Enable auditing?
0
 

Author Comment

by:SpammyChicken
Comment Utility
Do I enable it on the Domain Controller for on the File server?
0
 
LVL 57

Expert Comment

by:giltjr
Comment Utility
The file server.
0
 
LVL 4

Accepted Solution

by:
JustMy2Cents earned 500 total points
Comment Utility
Problem is, native Windows file auditing generates multiple entries for a single access event and typically lists thousands of entries per day.

You might want to use a 3rd-party solution like FileAudit that allows you to track, audit, report and alert on all access to files and folders on Windows servers:
http://www.isdecisions.com/products/fileaudit

I noticed there is a new version of the software coming soon (but still in beta for now):
http://community.isdecisions.com/knowledgebase/articles/142333-fileaudit-4-beta-testing-program-how-to
0
 

Author Closing Comment

by:SpammyChicken
Comment Utility
I was able to fix the issue by taking full access away from the domain admin group and giving it only to my user.  I have a couple consultants that have domain admin rights at the moment so that could be were the problem was.  I will check out the software you suggested, thanks for your help.
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

Suggested Solutions

Let’s list some of the technologies that enable smooth teleworking. 
Don’t let your business fall victim to the coming apocalypse – use our Survival Guide for the Fax Apocalypse to identify the risks and signs of zombie fax activities at your business.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now