Solved

log files on small business server 2011

Posted on 2013-11-27
2
229 Views
Last Modified: 2014-01-22
My Boss wants me to find out something.  There are two admin accounts on an SBS 2011 server we have.  One of the admin's  "wasn't me" !!  un selected a few check boxes when doing a properties of a public folder in exchange, and it caused some email to get deleted faster than it should have.  He believes there should be an "audit trail" in the OS somewhere that would say who, and when said person might have made a change.  I can't find it anywhere, but that is not to see it's not there.   Would anyone out there have any idea where I might look for that kind of thing in the logs?
0
Comment
Question by:micromark1
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 

Assisted Solution

by:EdservG
EdservG earned 250 total points
ID: 39681723
Hi, Micromark1.

The log exist, but is not enable by default. You need to enable audit policys to obtain this.

Who and when make this in past are not possible to get.. However you can power on this audit configuration and take possible to view it on future.

Thanks,
Edserv
0
 
LVL 3

Accepted Solution

by:
Detlef001 earned 250 total points
ID: 39683406
If the changes are made then it is very difficult to guess who did what. You can check on the windows log but yes that too on a note that the auditing must be enabled.

You can check that at the security log events. That can enrich you the exact details. And for future instances you can have a look at an third party file server monitoring application.

Have a look.

Thanks.
0

Featured Post

Resolve Critical IT Incidents Fast

If your data, services or processes become compromised, your organization can suffer damage in just minutes and how fast you communicate during a major IT incident is everything. Learn how to immediately identify incidents & best practices to resolve them quickly and effectively.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Windows Update for Skype Meeting App? 1 27
Dual boot vs VM 11 72
Exchange 2016 Size restrictions. 13 49
Outlook search issues 5 20
This article aims to explain the working of CircularLogArchiver. This tool was designed to solve the buildup of log file in cases where systems do not support circular logging or where circular logging is not enabled
This article explains how to install and use the NTBackup utility that comes with Windows Server.
The viewer will learn how to successfully create a multiboot device using the SARDU utility on Windows 7. Start the SARDU utility: Change the image directory to wherever you store your ISOs, this will prevent you from having 2 copies of an ISO wit…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

696 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question