All, We are experiencing some extremely odd behaviour on our systems. When users double click a file, rename a file, rename a folder (or any such combination) some files just disapear with no error messages or warnings. The files are on a shared drive that is located on a Windows 2003 R2 Enterprise edition server with Sophos Anti-Virus, all of which are fully patched and updated. any ideas would be most welcome as I am going mad over this one!! Many Thanks Rich

When you mean the files disapear, are the files being deleted ? I would create a new shared folder, re-check permissions and test it, I think there is something related with permissions on that share.

File disappear if there is any virus issue. If not you need to check for the permissions.under share tab check what permission is provided for everyone.Under security tab check the same for what permission is provided under everyone. How to Configure Share Permissions To configure share permissions: On the Sharing tab, click Permissions. Click Add. In the Select Users or Groups dialog box, double-click the appropriate user accounts or groups (for example, the Accountants and Sales groups) that you want. When you finish selecting the users and groups to which you want to grant permissions, click OK. The groups and users that you added, and the Everyone group, are displayed in the Group or user names list. In the Group or user names list, click each user or group, and then grant the permissions that you want to the user or group. For example, to grant Change permission to the Accounting group, click Accounting in the Group or user names list, and then for the Change permission, click to select the Allow check box. To grant Read permission to the Sales group, click Sales in the Group or user names list, and then for the Read permission, click to select the Allow check box. After you set the appropriate permissions for the user or groups that you want, click the Everyone group, and then click Remove. Click OK. Refer Link http://support.microsoft.com/kb/324267Please go through the below link for the making audit set up so that when check you have performeddelete activityfor the folder under share . http://support.microsoft.com/kb/301640 http://support.microsoft.com/kb/310399

Both the share and NTFS permissions have been set correctly. I have setup auditing on the folder and there is a DELETE entry showing when the file disapears, however, I have sat with one of the users when this has happened and they did not issue a delete command. All mcahines have been thoruoughly scanned for viruses and any other malware and nothing was found.

that should be a virus issue. provide the audit log..

I know it should be a virus, but all scans, with the latest updates come up clean. Can't really provide the audit log as this happens so sporadically that the related entries have already been over written. Also, I would have thought that if it were a virus it would be happening more often and to more people. I must admit in my 11 years in the industry I have NEVER heard of anything like this and it is driving me MAD!!

Just a quick thought on this, could dodgy cabling possibly cause something like this?

Maybe it's a common virus for systems all around...users.Are you sure nobody who is not supposed to has access to the files?

Users was my first thought, normaly is them, but this time it isn't.We use Access-based Enumeration so know for certain that only those who should have access do have access

What you need to do, is set audit log to see who access's the files. Download Filemon.exe or processmonitor.exe from sysinternals here: http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx monitor that folder and see what happens. Also you should disconnect the server from the network and test it locally to find out if the problem is not coming from the network.

A Hacker maybe?Or failing drives? Are you using DFS? Anti Virus gone crazy and flagging files as hazard and deleting them? Magnetic field? (Once in my life time I've know of a pc which drives got wiped eventually by magnetic interference. Solution was to put it on another table. Very rare but can happen.)

Have had no indication of security breach, so probably not hacker (and if it were a hacker why not delete more stuff)Shared Drive is on a 1 year old Dell 2950 with drives monitored by Server Administrator. There are no current failure or other such warnings, but we do need to run a chkdsk on the driveDid think that it could be the AV on either the client or the server causing this, but have re-installed on both and it has happened since.Server is in a rack with ohter boxes in a purpose built server room

Your troubleshoot needs to be on the hardisk level, to see which process is accessing that directory, have you done that... ???? install filemon or processmonitor and you will find out. btw are you using DFS ???

Not using DFS, used it before and hated it!I'll put some more detailed monitoring on as you suggest and see what we getCheers