Avatar of homerslmpson
homerslmpson
Flag for United States of America asked on

Question About "Previous Versions" in Server 2008 R2:

Hi. Is there an event in the Windows Event Viewer that can tell me if/when someone has restored a file to a previous version using Windows Shadow Copy?
I'm in a domain environment and have concerns about people restoring old versions without realizing the ramifications.
Thanks.
Windows Server 2008Microsoft Legacy OS

Avatar of undefined
Last Comment
Scott C

8/22/2022 - Mon
Scott C

I don't think so.  Everything I can find will log events if there is a problem restoring a file.  

Now that being said...here is what you can do.  

Perform a restore, note the time, then look in the logs to see if anything is generated during that time.

If it's successful, you would see an informational entry.
homerslmpson

ASKER
I did just that. No luck.
I was hoping I was missing something. I can't help but feel there must be SOME WAY to enable auditing of this.  It's a pretty serious issue if someone mistakenly (or knowingly) restores a previous file (or folder) wouldn't you say?  And the ability to not even know who did it?! That's crazy...
ASKER CERTIFIED SOLUTION
Scott C

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
ste5an

ScottCha is right. Cause there is no difference in making a mistake by restoring a file or just overwriting it directly.
All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat
William Peck
homerslmpson

ASKER
Guess I'll have to do that...
Thanks!
Scott C

Glad to help!