Unexplained user file deletions
This one has been bothering us for a while now.
We are running with Win2k8 and 2k8R2 servers, with Win7 and XP workstations.
We have a few users who regularly find that their network user area has been emptied. We are running with previous versions and daily backups so we can usually catch most things that have gone, but last night one of our users lost their area again
between a snapshot and backup, losing a couple of big documents in the process.
To try and correct this we have regularly changed passwords, reimaged computers, completely wiped and remade the user account in AD (with the same name and attributes), all to no avail. It happens whether XP or Win7 workstations are used, with no apparent
pattern.
Is there anybody else out there who has experienced this and can shed some light on the problem for me, as I only have so much hair left to tear out..
Many thanks in anticipation
September 6th, 2012 6:35am
Hiya,
How about removing "all rights" the the selected network areas, adding them one at the time. Then you can see which credentials are causing this.
Obviously make sure you always have at least one set of credentials with admin rights on the area :)
Free Windows Admin Tool Kit Click here and download it now
September 6th, 2012 7:38am
Hiya,
How about removing "all rights" the the selected network areas, adding them one at the time. Then you can see which credentials are causing this.
Obviously make sure you always have at least one set of credentials with admin rights on the area :)
September 6th, 2012 7:42am
hi,
Assuming that user error has been ruled out (for example I've had cases where the users didn't really understand the 'make available offline' functionality and that caused some mistakes)I would agree with Jesper - 1st step is a thorough review of the permissions.
Failing that, you should enable auditing. See this: http://technet.microsoft.com/library/dd277403.aspx
That should shed some light on what's happening.
Hope this helps
Cheers,
David
:: Please vote if the info helped you :: Please post back so everyone can benefit from the solution ::
Free Windows Admin Tool Kit Click here and download it now
September 6th, 2012 8:55am
Jesper
Thanks I'll have a go, but with it being sporadic it may take some time to figure out.
September 6th, 2012 9:36am
Techie Smurf
As you say, user error has been ruled out, someone else mentioned it may be a problem with FQDN and migrating from server 2003 to 2008 but not sure where to go with that yet.
As suggested by yourself and Jesper I have culled the permissions down to the user (with modify), administrator (with full control) and System (with full control).
Domain Admins and administrators groups were connected, but nothing else.
It is not a vindictive act as far as I can see as it happens during out of term periods too when the place is full.
Time will tell - i will report back as soon as i know anything
Free Windows Admin Tool Kit Click here and download it now
September 6th, 2012 9:48am
Hi,
Also make sure that you don't have any Virus/Worm infection in your server.
Some viruses delete the files, some convert the folder/files to a system hidden files so you cannot see the files.
try enabling the auditing and check which process/program/user deletes the files.
Apply or Modify Auditing Policy Settings for a Local File or Folder
technet.microsoft.com/en-us/library/cc771070(v=ws.10).aspx
http://www.neondemon.com/archives/how-to-monitor-file-and-folder-access-on-a-windows-file-server
Regards,
Rafic
If you found this post helpful, please give it a "Helpful" vote.
If it answered your question, remember to mark it as an "Answer".
This posting is provided "AS IS" with no warranties and confers no rights! Always test ANY suggestion in a test environment before implementing!
September 6th, 2012 9:57am
Hi,
Also make sure that you don't have any Virus/Worm infection in your server.
Some viruses delete the files, some convert the folder/files to a system hidden files so you cannot see the files.
try enabling the auditing and check which process/program/user deletes the files.
Apply or Modify Auditing Policy Settings for a Local File or Folder
technet.microsoft.com/en-us/library/cc771070(v=ws.10).aspx
http://www.neondemon.com/archives/how-to-monitor-file-and-folder-access-on-a-windows-file-server
Regards,
Rafic
If you found this post helpful, please give it a "Helpful" vote.
If it answered your question, remember to mark it as an "Answer".
This posting is provided "AS IS" with no warranties and confers no rights! Always test ANY suggestion in a test environment before implementing!
Free Windows Admin Tool Kit Click here and download it now
September 6th, 2012 10:01am
There is my Auditing experience:
http://blog.windowsnt.lv/2011/11/15/tracking-user-activity-english/Microsoft Certified Trainer; Microsoft Security Trusted Advisor; Cisco Certified Systems Instructor; Certified Ethical Hacker.
September 6th, 2012 12:44pm
There is my Auditing experience:
http://blog.windowsnt.lv/2011/11/15/tracking-user-activity-english/Microsoft Certified Trainer; Microsoft Security Trusted Advisor; Cisco Certified Systems Instructor; Certified Ethical Hacker.
Free Windows Admin Tool Kit Click here and download it now
September 6th, 2012 12:49pm