Question About "Previous Versions" in Server 2008 R2:
Hi. Is there an event in the Windows Event Viewer that can tell me if/when someone has restored a file to a previous version using Windows Shadow Copy?
I'm in a domain environment and have concerns about people restoring old versions without realizing the ramifications.
Thanks.
Windows Server 2008Microsoft Legacy OS
Last Comment
Scott C
8/22/2022 - Mon
Scott C
I don't think so. Everything I can find will log events if there is a problem restoring a file.
Now that being said...here is what you can do.
Perform a restore, note the time, then look in the logs to see if anything is generated during that time.
If it's successful, you would see an informational entry.
homerslmpson
ASKER
I did just that. No luck.
I was hoping I was missing something. I can't help but feel there must be SOME WAY to enable auditing of this. It's a pretty serious issue if someone mistakenly (or knowingly) restores a previous file (or folder) wouldn't you say? And the ability to not even know who did it?! That's crazy...
Now that being said...here is what you can do.
Perform a restore, note the time, then look in the logs to see if anything is generated during that time.
If it's successful, you would see an informational entry.