How can I determine what’s or who's marking folders on my file server as Protected Operating System Files?

I have a 2008 server that I’m using as a file server.  Every couple of days I have two folders that disappear.  The only way to see them is to uncheck “hide protected operating system files”.   The option to unhide is grayed out so I have to unhide with the attrib -r -a -s -h *.* command, but then next time I look up, there hidden again.  I have made sure only domain admins have the right to change attributes.  Is there a way to track down the cause of this issue?
SpammyChickenAsked:
Who is Participating?
 
JustMy2CentsConnect With a Mentor Commented:
Problem is, native Windows file auditing generates multiple entries for a single access event and typically lists thousands of entries per day.

You might want to use a 3rd-party solution like FileAudit that allows you to track, audit, report and alert on all access to files and folders on Windows servers:
http://www.isdecisions.com/products/fileaudit

I noticed there is a new version of the software coming soon (but still in beta for now):
http://community.isdecisions.com/knowledgebase/articles/142333-fileaudit-4-beta-testing-program-how-to
0
 
giltjrCommented:
Enable auditing?
0
 
SpammyChickenAuthor Commented:
Do I enable it on the Domain Controller for on the File server?
0
 
giltjrCommented:
The file server.
0
 
SpammyChickenAuthor Commented:
I was able to fix the issue by taking full access away from the domain admin group and giving it only to my user.  I have a couple consultants that have domain admin rights at the moment so that could be were the problem was.  I will check out the software you suggested, thanks for your help.
0
All Courses

From novice to tech pro — start learning today.