asked on Question About "Previous Versions" in Server 2008 R2:
Hi. Is there an event in the Windows Event Viewer that can tell me if/when someone has restored a file to a previous version using Windows Shadow Copy?
I'm in a domain environment and have concerns about people restoring old versions without realizing the ramifications.
Thanks.
I'm in a domain environment and have concerns about people restoring old versions without realizing the ramifications.
Thanks.
Windows Server 2008Microsoft Legacy OS
Last Comment
Scott C
ASKER
I did just that. No luck.
I was hoping I was missing something. I can't help but feel there must be SOME WAY to enable auditing of this. It's a pretty serious issue if someone mistakenly (or knowingly) restores a previous file (or folder) wouldn't you say? And the ability to not even know who did it?! That's crazy...
I was hoping I was missing something. I can't help but feel there must be SOME WAY to enable auditing of this. It's a pretty serious issue if someone mistakenly (or knowingly) restores a previous file (or folder) wouldn't you say? And the ability to not even know who did it?! That's crazy...
ASKER CERTIFIED SOLUTION
THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
ScottCha is right. Cause there is no difference in making a mistake by restoring a file or just overwriting it directly.
ASKER
Guess I'll have to do that...
Thanks!
Thanks!
Glad to help!
Now that being said...here is what you can do.
Perform a restore, note the time, then look in the logs to see if anything is generated during that time.
If it's successful, you would see an informational entry.