Are you looking at the DC or the server where the share resides? If the
share was NOT on a DC and you are looking there then I would suspect who
ever did it was using a local account for the server.
Jon
On Mon, Jan 25, 2010 at 3:42 PM, Miller Bonnie L. <
mille...@mukilteo.wednet.edu> wrote:
>
Hmm... since it's the share permissions, you'd probably have to audit changes
to the registry key where those are stored under
HKLM\System\CurrentControlSet\Services\LanManServer\Shares
-Bonnie
From: Kim Longenbaugh [mailto:k...@colonialsavings.com]
Sent: Monday, January 25, 2010 12:33 PM
To: N
