Thanks for the link, but been there before. Here's an edited event log from the server which shows the problem I have. There was in total 19 files which got deleted within 3 seconds of each other, and not all from the same directory.
05/09/2003 11:44:03 Security Success Audit Object Access 560 xxxxxxxxx\IAF xxxxxxxxx "Object Open:
Object Server: Security
Object Type: File
Object Name: \Device\HarddiskDmVolumes\PhysicalDmVolumes\BlockVolume1\TECH\Pol\Val03\Actives\ValActivesOngoing.xls
New Handle ID: 1944
Operation ID: {0,233827140}
Process ID: 8
Primary User Name: xxxxxxxxx$
Primary Domain: xxxxxxxxx
Primary Logon ID: (0x0,0x3E7)
Client User Name: IAF
Client Domain: xxxxxxxxx
Client Logon ID: (0x0,0xDD28AA4)
Accesses DELETE
Privileges -
"
05/09/2003 11:43:50 Security Success Audit Object Access 562 NT AUTHORITY\SYSTEM xxxxxxxxx "Handle Closed:
Object Server: Security
Handle ID: 1360
Process ID: 8
"
05/09/2003 11:43:50 Security Success Audit Object Access 564 NT AUTHORITY\SYSTEM xxxxxxxxx "Object Deleted:
Object Server: Security
Handle ID: 1360
Process ID: 8
"
05/09/2003 11:43:50 Security Success Audit Object Access 560 xxxxxxxxx\IAF xxxxxxxxx "Object Open:
Object Server: Security
Object Type: File
Object Name: \Device\HarddiskDmVolumes\PhysicalDmVolumes\BlockVolume1\TECH\Pol\Val03\Pensioners
New Handle ID: 1360
Operation ID: {0,233826009}
Process ID: 8
Primary User Name: xxxxxxxxx$
Primary Domain: xxxxxxxxx
Primary Logon ID: (0x0,0x3E7)
Client User Name: IAF
Client Domain: xxxxxxxxxx
Client Logon ID: (0x0,0xDD28AA4)
Accesses DELETE
Sophos is installed, and the drive is a raided SCSI drive. Offline files have been disabled, xp sp1 / server sp4 installed.
Tez
Women are like computers, you have to press a button to turn them on.