Why would auditing require a bunch of hard disk space? Just manage your log sizes and you should be OK. I do it all the time.
Unless I'm missing something... From: Jim Majorowicz [mailto:jmajorow...@gmail.com] Sent: Monday, August 24, 2009 4:51 PM To: NT System Admin Issues Subject: Troubleshooting a file problem I've got a tricky situation with disappearing files at one of my clients. The server in questions is a Windows SBS 2003 R2 Std that is currently up to date. Here's the situation: They've got a series of folders for all the projects they work on that are accessed by a number of different departments. The file structure for the Projects is that they're listed by project number then name, and under each of those folders is a standard template that contains information from each department in their own folders. It looks something like this: Projects: |-10000 - Project #1 | |-Billing | |-Drawings | |-Engineering | |-Proposal | |-Etc. |-10010 - Project #2 |-20132 - Project #3 . . . |- 99999 - Project Template |-Archive |-Etc. What happens is, about once every other month or so somewhere in that list of projects one folder will lose about ½ of the folders and data inside it and all the Project folders and other information below that spot "disappear". They can be successfully restored via Shadow Copy, but the client wants to know exactly what is happening and prevent it from happening. The only thing I can think of is that somebody has these folder all expanded in Windows Explorer and somehow manages to click and select a random folder in the list, select it and everything below it in that view and delete it. But I can't prove who, when and why and they want these answers. I'm hesitant to turn on file access logging, as that would require a bunch of hard drive space while we're waiting for this to happen again. Their onsite desktop support guy seems to want to blame the Shadow Copy service since the last time this happened he was working with data in one of the folders that got deleted that morning, but it was gone that afternoon after the Shadow Copy had fired off at noon. Is there a better way to figure out what is happening, or do I just need to suck it up, turn on file access logging, make some space for the logs and wait for it to occur again? Regards, Jim Majorowicz, MCP Sr. Network Engineer Whitsell Computer Services (503) 297-8440x12 www.whitsell.com We can support you no matter where you are. Ask me for details. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
<<image001.png>>
