Deleted Shared Folder

[neilmc]

Had a student come to me as saying he couldn't get onto the Student shared Homework to hand in folder. turns out its been deleted. Only me and the NM have permission to deleted the folders. and neither of us have done it, I haven't even used it ever, she was working on it at 11:00 its disapeared after that. it was there for this mornings shadow copy to take, but wasn't there for the 12:00 one.

 

Does anyone know how to find out who deleted a folder? is there a way of doing this? or is there something I could put in place which would tell me in the future if it happened again?

 

Thanks

[Guest TheLibrarian]

AFAIK there's no way to retrospectively find out who deleted what.

 

If you want to keep a track, then you need to look at configuring auditing.

[Michael]

I presume you've done a search in case it has accidentally been moved into another folder?

[chazzy2501]

you could look at the security logs for that computer, it may have some user names for that time period.

[neilmc]

It wasn't the actual folder which was deleted it was the subfolders. I just used this mornings shadow copy to get them back. I have no idea which computer it was deleted on, it just means that someone must have admin rights some how.

[Ignatius]

... it just means that someone must have admin rights some how.

 

A good time to change admin passwords, perhaps?

[OutToLunch]

It wasn't the actual folder which was deleted it was the subfolders. I just used this mornings shadow copy to get them back. I have no idea which computer it was deleted on, it just means that someone must have admin rights some how.

 

Check the members of the Administrators group under Builtin accounts in AD? Quick way of checking nobody has promoted themselves - if there's nobody unexpected there, change admin passwords and switch auditing on

[Elison]

hello

When you have files/folders/subfolders that you dont want to dissapear you need to monitor them constantly. when i was a student i used a program "Connection Monior" (see here) in our university network. I always knew who, when and how often connects to my shared folders. it allowed me to audit changes in my folders: creating new files, deleting. from logs I could know who did that. It really helped

about your problem....its almost impossible to find out who has deleted it. But from this you can learn that you need to monitor shared data using extra software.

Regards