Solved

How can I determine what’s or who's marking  folders on my file server as Protected Operating System Files?

Posted on 2013-01-18
5
341 Views
Last Modified: 2013-01-28
I have a 2008 server that I’m using as a file server.  Every couple of days I have two folders that disappear.  The only way to see them is to uncheck “hide protected operating system files”.   The option to unhide is grayed out so I have to unhide with the attrib -r -a -s -h *.* command, but then next time I look up, there hidden again.  I have made sure only domain admins have the right to change attributes.  Is there a way to track down the cause of this issue?
0
Comment
Question by:SpammyChicken
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 57

Expert Comment

by:giltjr
ID: 38794300
Enable auditing?
0
 

Author Comment

by:SpammyChicken
ID: 38794779
Do I enable it on the Domain Controller for on the File server?
0
 
LVL 57

Expert Comment

by:giltjr
ID: 38795518
The file server.
0
 
LVL 4

Accepted Solution

by:
JustMy2Cents earned 500 total points
ID: 38796221
Problem is, native Windows file auditing generates multiple entries for a single access event and typically lists thousands of entries per day.

You might want to use a 3rd-party solution like FileAudit that allows you to track, audit, report and alert on all access to files and folders on Windows servers:
http://www.isdecisions.com/products/fileaudit

I noticed there is a new version of the software coming soon (but still in beta for now):
http://community.isdecisions.com/knowledgebase/articles/142333-fileaudit-4-beta-testing-program-how-to
0
 

Author Closing Comment

by:SpammyChicken
ID: 38827259
I was able to fix the issue by taking full access away from the domain admin group and giving it only to my user.  I have a couple consultants that have domain admin rights at the moment so that could be were the problem was.  I will check out the software you suggested, thanks for your help.
0

Featured Post

Don't Miss ATEN at InfoComm 2017!

Visit booth #2167 to see the  new ATEN VM3200 32 x 32 Modular Matrix Switch. Other highlights include the VE8950 4K HDMI Over IP Extender, VS1912 12-Port DP Video Wall Media Player  and VK2100 ATEN Control System. Register now with Free Pass Code ATEN288!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
I was prompted to write this article after the recent World-Wide Ransomware outbreak. For years now, System Administrators around the world have used the excuse of "Waiting a Bit" before applying Security Patch Updates. This type of reasoning to me …
Internet Business Fax to Email Made Easy - With  eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, f…
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question