Unexplained user file deletions
This one has been bothering us for a while now. We are running with Win2k8 and 2k8R2 servers, with Win7 and XP workstations. We have a few users who regularly find that their network user area has been emptied. We are running with previous versions and daily backups so we can usually catch most things that have gone, but last night one of our users lost their area again between a snapshot and backup, losing a couple of big documents in the process. To try and correct this we have regularly changed passwords, reimaged computers, completely wiped and remade the user account in AD (with the same name and attributes), all to no avail. It happens whether XP or Win7 workstations are used, with no apparent pattern. Is there anybody else out there who has experienced this and can shed some light on the problem for me, as I only have so much hair left to tear out.. Many thanks in anticipation
September 6th, 2012 6:35am

Hiya, How about removing "all rights" the the selected network areas, adding them one at the time. Then you can see which credentials are causing this. Obviously make sure you always have at least one set of credentials with admin rights on the area :)
Free Windows Admin Tool Kit Click here and download it now
September 6th, 2012 7:38am

Hiya, How about removing "all rights" the the selected network areas, adding them one at the time. Then you can see which credentials are causing this. Obviously make sure you always have at least one set of credentials with admin rights on the area :)
September 6th, 2012 7:42am

hi, Assuming that user error has been ruled out (for example I've had cases where the users didn't really understand the 'make available offline' functionality and that caused some mistakes)I would agree with Jesper - 1st step is a thorough review of the permissions. Failing that, you should enable auditing. See this: http://technet.microsoft.com/library/dd277403.aspx That should shed some light on what's happening. Hope this helps Cheers, David :: Please vote if the info helped you :: Please post back so everyone can benefit from the solution ::
Free Windows Admin Tool Kit Click here and download it now
September 6th, 2012 8:55am

Jesper Thanks I'll have a go, but with it being sporadic it may take some time to figure out.
September 6th, 2012 9:36am

Techie Smurf As you say, user error has been ruled out, someone else mentioned it may be a problem with FQDN and migrating from server 2003 to 2008 but not sure where to go with that yet. As suggested by yourself and Jesper I have culled the permissions down to the user (with modify), administrator (with full control) and System (with full control). Domain Admins and administrators groups were connected, but nothing else. It is not a vindictive act as far as I can see as it happens during out of term periods too when the place is full. Time will tell - i will report back as soon as i know anything
Free Windows Admin Tool Kit Click here and download it now
September 6th, 2012 9:48am

Hi, Also make sure that you don't have any Virus/Worm infection in your server. Some viruses delete the files, some convert the folder/files to a system hidden files so you cannot see the files. try enabling the auditing and check which process/program/user deletes the files. Apply or Modify Auditing Policy Settings for a Local File or Folder technet.microsoft.com/en-us/library/cc771070(v=ws.10).aspx http://www.neondemon.com/archives/how-to-monitor-file-and-folder-access-on-a-windows-file-server Regards, Rafic If you found this post helpful, please give it a "Helpful" vote. If it answered your question, remember to mark it as an "Answer". This posting is provided "AS IS" with no warranties and confers no rights! Always test ANY suggestion in a test environment before implementing!
September 6th, 2012 9:57am

Hi, Also make sure that you don't have any Virus/Worm infection in your server. Some viruses delete the files, some convert the folder/files to a system hidden files so you cannot see the files. try enabling the auditing and check which process/program/user deletes the files. Apply or Modify Auditing Policy Settings for a Local File or Folder technet.microsoft.com/en-us/library/cc771070(v=ws.10).aspx http://www.neondemon.com/archives/how-to-monitor-file-and-folder-access-on-a-windows-file-server Regards, Rafic If you found this post helpful, please give it a "Helpful" vote. If it answered your question, remember to mark it as an "Answer". This posting is provided "AS IS" with no warranties and confers no rights! Always test ANY suggestion in a test environment before implementing!
Free Windows Admin Tool Kit Click here and download it now
September 6th, 2012 10:01am

There is my Auditing experience: http://blog.windowsnt.lv/2011/11/15/tracking-user-activity-english/Microsoft Certified Trainer; Microsoft Security Trusted Advisor; Cisco Certified Systems Instructor; Certified Ethical Hacker.
September 6th, 2012 12:44pm

There is my Auditing experience: http://blog.windowsnt.lv/2011/11/15/tracking-user-activity-english/Microsoft Certified Trainer; Microsoft Security Trusted Advisor; Cisco Certified Systems Instructor; Certified Ethical Hacker.
Free Windows Admin Tool Kit Click here and download it now
September 6th, 2012 12:49pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics