Question About "Previous Versions" in Server 2008 R2:

homerslmpson used Ask the Experts™

on 2015-07-22

Hi. Is there an event in the Windows Event Viewer that can tell me if/when someone has restored a file to a previous version using Windows Shadow Copy?
I'm in a domain environment and have concerns about people restoring old versions without realizing the ramifications.
Thanks.

Comment

Watch Question

Do more with

EXPERT OFFICE^® is a registered trademark of EXPERTS EXCHANGE^®

View Solution Only

Scott CSenior Engineer

Verified Expert

Commented: 2015-07-22

I don't think so. Everything I can find will log events if there is a problem restoring a file.

Now that being said...here is what you can do.

Perform a restore, note the time, then look in the logs to see if anything is generated during that time.

If it's successful, you would see an informational entry.

homerslmpson

Author

Commented: 2015-07-22

I did just that. No luck.
I was hoping I was missing something. I can't help but feel there must be SOME WAY to enable auditing of this. It's a pretty serious issue if someone mistakenly (or knowingly) restores a previous file (or folder) wouldn't you say? And the ability to not even know who did it?! That's crazy...

Scott CSenior Engineer

Verified Expert

Commented: 2015-07-22

You could always enable auditing on the folder(s). This is going to be resource intensive but it would give you what you want.

http://www.techotopia.com/index.php/Auditing_Windows_Server_2008_File_and_Folder_Access