Server 2012 Previous Versions accidental revert

Hi Experts,

We have a server 2012 HyperV VM running exchange 2010 SP3 and all running well.
Last night we got a call to say that the clients "Common" share was showing date modified of 29 September 2014, instead of 6 October 2014, upon further investigation we found that ALL shares on the server were reverted back to 29 September.
The onsite IT contact is sure that no one there would know how to use previous versions.
Even a share that only a few people (not our admin account) have access to, so it must be one of those users.
Can anyone tell me of a log somewhere which records such events?
I have been through the app and sys and sec logs but they show nothing to do with VSS at all.
Any help would be appreciated.

Cheers

Craig
LVL 3
TingathewingaAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

yo_beeDirector of Information TechnologyCommented:
Is this just a single Shared Directory or the entire server was rolled back to Sept 29?
Do you have restore previous version enabled (VSS) and if so do users have the right to apply?
0
TingathewingaAuthor Commented:
All shared folders were rolled back to that date, no other files on the drives.
Previous versions enabled at default times.
Just wanting an audit path really, I know someone did it, just can't prove it.
And yes, users could restore.
0
yo_beeDirector of Information TechnologyCommented:
Do you have Auditing enable on the share?
If not you are pretty much out of luck.

You can create a GPP to apply a registry setting change to remove the previous version tab from the users context and properties window of the share to try an prevent this from happening again.
http://www.experts-exchange.com/Software/Backup_Restore/Q_26268937.html

http://social.technet.microsoft.com/Forums/windowsserver/en-US/b78896ee-8364-4a02-a082-7f22e6417dc7/server-2008-and-shadow-copy-permissions?forum=winservergen
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2012

From novice to tech pro — start learning today.