I've run into similar situations before, and in every case, it was someone accidentally click-dragging folders and files from there intended location to some obscure spot ... can you change the attributes on the folders where they can read/execute, list, read, and write, but NOT modify or Full Control ? They can still have modify rights to the files within ( I *NEVER* recommend Full Control for users, they don't need access change rights ) I'd bet that folder disappearances go away after that ...
Erik Goldoff IT Consultant Systems, Networks, & Security _____ From: Jim Majorowicz [mailto:jmajorow...@gmail.com] Sent: Monday, August 24, 2009 4:51 PM To: NT System Admin Issues Subject: Troubleshooting a file problem Ive got a tricky situation with disappearing files at one of my clients. The server in questions is a Windows SBS 2003 R2 Std that is currently up to date. Heres the situation: Theyve got a series of folders for all the projects they work on that are accessed by a number of different departments. The file structure for the Projects is that theyre listed by project number then name, and under each of those folders is a standard template that contains information from each department in their own folders. It looks something like this: Projects: |-10000 Project #1 | |-Billing | |-Drawings | |-Engineering | |-Proposal | |-Etc. |-10010 Project #2 |-20132 Project #3 . . . |- 99999 Project Template |-Archive |-Etc. What happens is, about once every other month or so somewhere in that list of projects one folder will lose about ½ of the folders and data inside it and all the Project folders and other information below that spot disappear. They can be successfully restored via Shadow Copy, but the client wants to know exactly what is happening and prevent it from happening. The only thing I can think of is that somebody has these folder all expanded in Windows Explorer and somehow manages to click and select a random folder in the list, select it and everything below it in that view and delete it. But I cant prove who, when and why and they want these answers. Im hesitant to turn on file access logging, as that would require a bunch of hard drive space while were waiting for this to happen again. Their onsite desktop support guy seems to want to blame the Shadow Copy service since the last time this happened he was working with data in one of the folders that got deleted that morning, but it was gone that afternoon after the Shadow Copy had fired off at noon. Is there a better way to figure out what is happening, or do I just need to suck it up, turn on file access logging, make some space for the logs and wait for it to occur again? Regards, Jim Majorowicz, MCP Sr. Network Engineer SBPI_US_rgb Whitsell Computer Services (503) 297-8440x12 <http://www.whitsell.com> www.whitsell.com We can support you no matter where you are. Ask me for details. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
<<image001.png>>
