On my Server, what steps can I perform to determine which user is dragging a client folder into another clients folder?

I am running Windows 2008-R2 Server, and Windows 7 Professional on user computers.

A co-worker today reported that he cannot find client folder "Smith, Joe".  

Having searched the server, I discovered that it is located in folder "Snyder, Alan", and moved it back to its original location.

I believe several employees are using Windows Explorer, and accidentally dragging a client folder into another clients folder.

I only want to know who move the folder, so that I can go to them, and instruct them on how NOT to do this, because a lot of time is wasted "finding" lost client folders.

Your help is greatly appreciated!
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

NVITEnd-user supportCommented:
You need auditing enabled.

Do users need to see other users folders?

Maybe you could restrict this ability.
eemmpphAuthor Commented:
All client folders (about 6,000 of them) are on the Server as separate folders.  For example:

Ace, Jack
Apple, Joe
Bravo, Ann
Charlie, Cathy
Smith, Joe
Snyder, Alan
NVITEnd-user supportCommented:
So, each user is required and allowed to freely move files into any of those folders?
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

eemmpphAuthor Commented:
Yes, they can add, delete, remove, cut, paste, etc.
NVITEnd-user supportCommented:
OK. Then, I'm not sure if that can be prevented except by reminding them not to do that, like you said.
Hello ThereSystem AdministratorCommented:
Can you apply permissions on critical folders?

If you want to know precisely who did it, you have to enable Auditing and wait until this will happen again.

Would this work:

1) Make the creation, changes, and deletion / archiving of customer folder an 'admin' job (grant to a security group and put only designated users who have been trained carefully in that group - maybe only one or two people depending on the volume of changes?) - Normal users have only 'read / access' rights to those top level folders - they cannot delete, move, or rename them.

2) Break inheritance from the customer folders down (would be done by the 'admin' when creating a new folder).  Grant full access to the inside of the folders to normal users.

This seems practical for any new folders, but what about the existing ones?  How do you do that for all 6,000 'old' folders?

Scott SilvaNetwork AdministratorCommented:
This behavior is usually purely accidental, and is hard to "fix". I even occasionally catch myself "snagging" a folder... It might just be easier to teach users how to search if they find something missing, or just fix it when they ask and see it as part of the job...

Auditing will tell you who did it, but it will still happen...
eemmpphAuthor Commented:
I agree, this is being done by users accidentally (not on purpose).

I have told users many times, to be careful when "dragging" the mouse in Windows Explorer, because it moves client folders very quickly.

I also mentioned that as long as the user does not click anywhere else "after" the move, the move can be "undone" by clicking Edit, Undo Move.

All client folders are critical folders.

Evidently, folder/file "moves" are really "deletions" from there original location . . . so it would be helpful to know who is doing massive "deleting" of client files.  But then again, would this not fill up the event log?
NVITEnd-user supportCommented:
If you're open to third party tools...

I've heard good things about
Directory Monitor

There is a free download. The price seems reasonable, too... Considering your stress factor 8-)

Another popular, free tool is FolderChangesView  , by NirSoft.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
eemmpphAuthor Commented:
Thanks NVIT.  The tool FolderChangesView, by NirSoft shows deletions, but it does not show the "user" who deleted it.

After reviewing Directory Monitor, it looks like it will provide the information that I am looking for.

Thank you.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2008

From novice to tech pro — start learning today.