Solved

Files disappearing from Windows Server 2008 R2

Posted on 2013-02-01
9
6,884 Views
1 Endorsement
Last Modified: 2013-02-10
Here is the issue (and it is an odd one). We have a file server running 'perfectly' for at least 8 months - I am relatively new on the company, and the server was largely used before I join.

This week, a large amount of users started to complain that they Documents disappeared. We have a Folder Redirection GPO

That is pointing to this server. VSS is enable on this drive and the Access-based enumeration (ABE) is disabled for this share. Offline sync is enabled for this folder.

On another share (we call it 'P: Drive'), we host all department documents. This share is on the same logical drive as the first, but it has ABE enabled. Some random files\folders are also "disappearing" from there.

On the beginning, I thought was an 'offline synchronization' issue. But the P: drive is not sync’d.
We do not think it is a user's action, once it was random files\folders and personal folders (with distinct ACLs) that disappeared - Including from IT Staff. We do have a corporate anti-virus installed on the server (McAfee). It did not detected any threat.

I also don't believe it is a hardware malfunction, once we do have other virtual machines running on the same servers\SAN and no other presented similar issues.

Back to basics, this is the configuration:
Virtual Windows Server 2008 R2 (64bits)
Running over VMware ESXi 4.1
NTFS Partition
Roles:
- File Services
- Remote Desktop Services (Licensing only)
- Web Server (IIS) installed but hosting no site.

Additional Software:
- FileZilla 0.9.41 (rarely used)
- Symantec Backup Exec Remote Agent Utility
 (Backup Exec 2010 R3 runs on other server)
- McAfee Antivirus

Clients:
- All clients are running Windows 7 Professional. Most 32bits, some 64bits over desktops.
- Office 2010
- Some users access over Remote Desktop Server.

Changes on the environment before the issue:

Following a corporate policy, we renamed the File server. The old name was "QWERTY-FS" and we changed to "ASDF-FS".
Together with the name change, a new CNAME entry was created on our DNS pointing "QWERTY-FS" to "ASDF-FS". No IP Change.
We had an isolated incident of files disappearing on the P: drive before the name change.

2 weeks went by with no issues. I then changed the folder redirection policy (GPO), adjusting to the new name. Also changed the script that mapped the P: drive to the new names.
On the 'Documents Property' entry, of the GPO, the following is set:
Target tab:
- Setting: Basic Redirect Everyone’s folder to the same location
- Target folder location: Create a folder for each user under the root path
- Root path: "\\ASDF-FS\Users" (only value that was changed)
Settings tab:
(Unchecked) Grant the user exclusive rights to Documents
(Checked) Move contents of Documents to new location.
(Checked) Also apply redirection policy to windows (...)

For now, that was done:
- Full Scan with McAfee
- Windows Update
- Server reboot
- Around 5 hours of reading other forums looking for answers. A lot of people with the same issue, no real solution.

Apparently, one day the problem is simply 'gone'.
- Indexing service is not enabled on the server
- Some guy was pointing out that it happens after upgrading to Office 2007, and it was happening due the Microsoft Search service being enabled. We are a relatively new company and we always had Office 2010. It does not seems to be the issue.

Any suggestions will be deeply appreciated!
1
Comment
Question by:ahyor
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 7
  • 2
9 Comments
 
LVL 4

Expert Comment

by:ChanduNelluri
ID: 38843174
You may try enabling Auditing on folders which are disappearing to see who is doing it. Following link has the details.

http://technet.microsoft.com/en-us/library/cc771070.aspx

-Chandu
0
 

Author Comment

by:ahyor
ID: 38843211
Thanks Chandu, I actually have it enabled already since yesterday. I forgot to mention it on the post.
0
 

Author Comment

by:ahyor
ID: 38850185
Hello,

I am not sure if I was clear on the question, but this is still an issue for us.
I saw on some articles that for other people one day the problem was simply gone. Unfortunately it is not our case here [yet].

Any leads or suggestions will be much appretiated.
0
Edgartown IT Case Study

Learn about Edgartown's quest to ensure the safety and security of the entire town's employee and citizen data. Read the case study!

 

Author Comment

by:ahyor
ID: 38850212
Also,  Just checked the Scheduled tasks. Nothing out of normal (no user created).
0
 
LVL 4

Expert Comment

by:ChanduNelluri
ID: 38850603
-Did you find any clue on who is deleting the files from auditing events in Security eventlog? You may have to increase the Security eventlog size it gets full frequently

-On client side, do rsop.msc and check if there are any conflicting folder redirection GPO settings.

-Can you find out the pattern of deletion? Any particular time, event, or something? This would help us narrow down the issue. To find when the files get deleted, write a simple batch file (dir /s), dump the files list to a text file every 10 min or so.

-Take one user who is having this issue. Remove offline sync option for him and see if the files still get deleted

-By any chance, do you have any folder replication software like DFS setup? If so, it may be doing one-way replication from some server to problematic server and deleting the files
0
 

Author Comment

by:ahyor
ID: 38850694
Hi Chanadu,

Thank you again for your reply.

1 - No deletion event was recorded over the audit. I enabled it over local policy and GPO. I made a test creating, checking the audit configuration and deleting a .txt file. Nothing is recorded on the security log, despite the configuration.

2 - That's a good point. I will do it soon to check it.

3 - No pattern was identified yet. I think files are deleted durring the logon (I can normally restore the files from 7:00am VSS).

4 - The problem seems to affected all users once. Only one user reported twice but in distinct folders. It is hard reproduce it. if 2 doesn't work, I will try it.

5 - No DFS on this setup.
0
 

Author Comment

by:ahyor
ID: 38854724
A bit of a new information:

I noticed the following error on the client-side event log:

Failed to apply policy and redirect folder "Documents" to "\\QWERTY-FS\Users\user11\My Documents".
Redirection options=0x9021.
The following error occurred: "Failed to redirect because the destination directory "\\ASDF-FS\Users\user11\My Documents" is offline".
Error details: "The network path was not found.

The server is available, The client can both resolve QWERTY-FS and ASDF-FS to the same IP address but the user11 cannot access the share (it seems to be empty).
The shere is not with ABE enabled and the user11 has full permissions over the folder (and the share)

I am starting to think it is a Offinline synchronization issue again.

Did anyone experience this issue before?
0
 

Accepted Solution

by:
ahyor earned 0 total points
ID: 38858588
Okay,

After a lot of investigation we get to a simple conclusion:
The Folder redirection Policy was causing the files to desapear.
I am still not 100% about what I described as P: Drive.

My conclusion comes from the GPO properties:

As I described over the initial question, the following checkbox was enabled:
"(Checked) Move contents of Documents to new location."
It is now 'unchecked'.

Once the location was actually the same, the files were not able to 'move' between then.
I believe it was getting a conflit over the offline sync, resulting on files not being moved and eventually deleted. *speculation*

The problem stopped happening after I unchecked and applied the GPO to users.

Also, i reviewed the users permission by changing the following to 'check':
"(Unchecked) Grant the user exclusive rights to Documents"

Refferences:

http://blogs.technet.com/b/netro/archive/2010/04/09/how-the-synchronization-in-windows-7-offline-files-works.aspx
http://technet.microsoft.com/en-us/library/cc736916(WS.10).aspx
0
 

Author Closing Comment

by:ahyor
ID: 38872837
Unfortunately I found the solution by myself. No one was able to help me here.
0

Featured Post

Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Each year, investment in cloud platforms grows more than 20% (https://www.immun.io/hubfs/Immunio_2016/Content/Marketing/Cloud-Security-Report-2016.pdf?submissionGuid=a8d80a00-6fee-4b85-81db-a4e28f681762) as an increasing number of companies begin to…
I was prompted to write this article after the recent World-Wide Ransomware outbreak. For years now, System Administrators around the world have used the excuse of "Waiting a Bit" before applying Security Patch Updates. This type of reasoning to me …
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question