On the machine, Properties for the drive, Security, Advance, Auditing. Pick and choose users but you will have to watch your logs for them filling but it will not be as bad as if you have all of them on the audit.
Jon On Mon, Aug 24, 2009 at 5:42 PM, Jim Majorowicz <jmajorow...@gmail.com>wrote: > Now I feel stupid…Where do I set that up? > > > > *From:* Jon Harris [mailto:jk.har...@gmail.com] > *Sent:* Monday, August 24, 2009 2:18 PM > *To:* NT System Admin Issues > *Subject:* Re: Troubleshooting a file problem > > > > Then just audit their actions only. I have a user that does this all the > time so auditing was turned on for them in an effort to build a termination > case for failing to follow orders. > > > > Jon > > On Mon, Aug 24, 2009 at 5:14 PM, Jim Majorowicz <jmajorow...@gmail.com> > wrote: > > It’s actually already setup like that. There are only 5 users that have > full control rights so they can copy the template and create new Project > folders. It’s got to be one of the 5, but they all flat refuse to admit > doing it. > > > > *From:* Erik Goldoff [mailto:egold...@gmail.com] > *Sent:* Monday, August 24, 2009 2:10 PM > > > *To:* NT System Admin Issues > > *Subject:* RE: Troubleshooting a file problem > > > > I've run into similar situations before, and in every case, it was someone > accidentally click-dragging folders and files from there intended location > to some obscure spot ... > > > > can you change the attributes on the folders where they can read/execute, > list, read, and write, but NOT modify or Full Control ? > > > > They can still have modify rights to the files within ( I *NEVER* recommend > Full Control for users, they don't need access change rights ) > > I'd bet that folder disappearances go away after that ... > > > Erik Goldoff > > *IT Consultant* > > *Systems, Networks, & Security * > > > > > ------------------------------ > > *From:* Jim Majorowicz [mailto:jmajorow...@gmail.com] > > *Sent:* Monday, August 24, 2009 4:51 PM > *To:* NT System Admin Issues > *Subject:* Troubleshooting a file problem > > I’ve got a tricky situation with disappearing files at one of my clients. > The server in questions is a Windows SBS 2003 R2 Std that is currently up to > date. Here’s the situation: > > > > They’ve got a series of folders for all the projects they work on that are > accessed by a number of different departments. The file structure for the > Projects is that they’re listed by project number then name, and under each > of those folders is a standard template that contains information from each > department in their own folders. It looks something like this: > > > > Projects: > > |-10000 – Project #1 > > | |-Billing > > | |-Drawings > > | |-Engineering > > | |-Proposal > > | |-Etc. > > |-10010 – Project #2 > > |-20132 – Project #3 > > . > > . > > . > > |- 99999 – Project Template > > |-Archive > > |-Etc. > > > > What happens is, about once every other month or so somewhere in that list > of projects one folder will lose about ½ of the folders and data inside it > and all the Project folders and other information below that spot > “disappear”. They can be successfully restored via Shadow Copy, but the > client wants to know exactly what is happening and prevent it from > happening. > > > > The only thing I can think of is that somebody has these folder all > expanded in Windows Explorer and somehow manages to click and select a > random folder in the list, select it and everything below it in that view > and delete it. But I can’t prove who, when and why and they want these > answers. > > > > I’m hesitant to turn on file access logging, as that would require a bunch > of hard drive space while we’re waiting for this to happen again. Their > onsite desktop support guy seems to want to blame the Shadow Copy service > since the last time this happened he was working with data in one of the > folders that got deleted that morning, but it was gone that afternoon after > the Shadow Copy had fired off at noon. > > > > Is there a better way to figure out what is happening, or do I just need to > suck it up, turn on file access logging, make some space for the logs and > wait for it to occur again? > > > > Regards, > > Jim Majorowicz, MCP > > Sr. Network Engineer > > [image: SBPI_US_rgb] > > Whitsell Computer Services > > (503) 297-8440x12 > > www.whitsell.com > > We can support you no matter where you are. Ask me for details. > > > > > > > > > > > > > > > > > > > > > > > > > > > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
<<image001.png>>
