FIND OUT WHAT USER DELETED FILES 2

[gbecker]

Hello I currently have a windows 2000 Ad server running and the departments all have a shared directory on that server. The problem I am having is when a user goes to that directory and deletes the file, I can't tell who it was. We currently have a user that is finding it funny to delete files when I am not here and when I come in the next morning I have a people telling me that the files were deleted off of the directory and I have to do a restore from the tapes. I have rulled out computer problems because it does not happen on weekends and happens when I am not here. So the time will vary. Are there any third party programs or Microsoft programs that will allow me to see what user edited or deleted the file last.

Thank you;
Glen Becker

 

[mlichstein]

You need to enable audit logging of the files in question.

 

[gbecker]

Do you recommend audit logging for the whole server? The problem is I never know what file he/she/they are going to delete next. Very rarely id the files deleted the same. I was hoping for a program that would allow me to type the name of the deleted file and it would show the last user tha accessed it. Also, when a user deletes a file via the network where does it go? I know it does not go into the recycle bin on either machine, is there a way to retrieve it without the tape backup.

Thanks
Glen

 

[ricpinto]

The deleted file is gone but if you run 3rd party undelete programs (there are so many out there and mostly it will cost you) then you can recover the files and hopefully it has a feature that will tell you who's the culprit. The deleted files can be recovered from the harddisk where it was written to and that is from your server.

 

[gbecker]

Do you know of any good third party programs that will tell you the culprit and restore the files?

 

[AdmanOK]

I use Undelete by Executive Software... works pretty well... my problem was that the files were being deleted from a machine on the shop floor which is logged in 24/7 with a generic account... made it a little harder to work out what was going on, but at least I knew which machine and at what time!

 

[drew1701d]

pc inspector file recovery
free app that is great at retrieving deleted files
google it.

 

[constantijn]

Yuo should definitely turn on auditing. You know how, i assume. What you als can do is simply secure files and exclude them from possible deletion, by simply setting the security settings.

 

[GlenJohnson]

Hello I currently have a windows 2000 Ad server running and the departments all have a shared directory on that server

Audit that directory if that's the only one having files deleted. This won't show who deleted the files, but it will show you who accessed them and when, which will help narrow it down. Check out
Auditing
Good luck.

Glen A. Johnson
If you're from Northern Illinois/Southern Wisconsin feel free to join the Tek-Tips in Chicago, Illinois Forum.

TTinChicago
Johnson Computers