Here is a puzzler for all you google gurus

[Jake]

We are having somewhat of a problem with admin staff moving files around, deleting them, renaming them, putting them into folders etc. They are doing this on a shared storage area. This is causing some issues where people cant find stuff, and then results in "I didnt move it" "I didnt rename it" and so on.

 

So what we are looking for is something which will track everytime someone renames/moves/deletes/copies a file, the filename, when it was done, which user, what the new filename/location is. Then produce a log of that information (either after the event or live), and automatically save that log each day.

 

Looking around we found http://www.data-security-software.com/ , which tracks stuff pretty well but doesnt automatically save the log, requiring us to save the log each day and clear the log ready for the next day which isnt awfully practical.

 

Bit of a long shot I know, but anyone seen/heard of anything which will do what we want?

[Ravening_Wolf]

I think software like this should be installed as standard on any network which teachers might access

[Geoff]

What about turning the Indexing Service on. That'd at least speed up searches so people could find things when they get moved.

 

Also, if these are mainly documents. What about using a Document Management System such as SharePoint?

[Jake]

Yeah, its become pretty annoying, with admin staff insisting that the server is losing/deleting files. Interestingly the files seem to eventually turn up, in a totally different directory, under a different name several days later.

 

If we could find something to do the things above, then at least we can turn round and say "oh yes you did rename it and move it...lookie...shows right here that you renamed it to "I am a flid.doc" on Tuesday and moved it into the "Self Evaluation" folder

[Jake]

Its not so much just the moving of stuff, its that stuff is being renamed and moved about , deleted etc, and of course "nobody" did it.

 

Did wonder about Sharepoint, will it track renaming/moving/deleting to the username/time/date of the event?

[Ravening_Wolf]

Sharepoint will allow you to keep one copy of a document in a specified location which is then accessible to users according to their permissions. People can take local copies and do what they like to them, but the original is effectively set in stone unless the user has the right permissions to modify said file.

 

Very, very useful system - I want our school to implement it so we can rid ourselves of the dreaded Winpool.

[Jake]

hmm...will that allow a document to be edited on the server, and be accessible by others. But not allow the person editing the file to be allowed to rename the file. We have a need for files to be edited and then read by another member of admin, but obviously we wouldnt want them to be able to rename the file that they can edit otherwise we still end up in the situation where people randomly rename stuff

[mac_shinobi]

you got R2 for server 2003 ( obviously ) ?

[Jake]

We have it yeah, but not installed on the admin server as it wanted to upgrade the forest. We could go to R2, but because of the forest would be a slightly lengthier (in terms of time to setup) solution than we are hoping for

[acb_]

Its not so much just the moving of stuff, its that stuff is being renamed and moved about , deleted etc, and of course "nobody" did it.

 

Oh yes, oh yes, oh yes.

 

I have been known, on occasion, to trawl through the Audit Logs to prove to the individual who reported the mysterious loss that it was caused by a human agent, in fact, quite often by them...

[mac_shinobi]

If these files are on a shared drive, why not just change the permissions for that shared drive so they can only copy from it to there home area and hence the stuff on the shared drive wouldnt allow them to move, delete or w/e else , that way if they wanna do that they can copy it to there home area and alter it as they ( as in that particular end user ) see's fit then there wont be any need to trawl through logs to see who did what and when

 

Just a thought

[mac_shinobi]

Not sure how much this helps but faronics seem to have some good products available :

 

http://www.faronics.com/html/product.asp

[mac_shinobi]

Found something that may help but will probably cost :

 

http://manageengine.adventnet.com/products/roboiq/

 

Has file system monitors that can monitor specific files, folders etc and has other features as well

[Jake]

If these files are on a shared drive, why not just change the permissions for that shared drive so they can only copy from it to there home area and hence the stuff on the shared drive wouldnt allow them to move, delete or w/e else , that way if they wanna do that they can copy it to there home area and alter it as they ( as in that particular end user ) see's fit then there wont be any need to trawl through logs to see who did what and when

 

Just a thought

 

Well the problem is that multiple people need to amend files and then upload those files to the shared area for others to use/amend. For example, a folder called Reports has Document A in it on the shared area. User 1 , needs to make amendments to Document A, then at some point later, User 2 needs to use Document A and alter it again, then the next day User 3 needs to use Document A.

 

IF I am reading what you wrote right, it wont work because User 1 can only alter Document A in their own area and cant then re-up it to the Reports folder on the Shared area for User 2 , 3, 4 etc to amend and use. Unless User 1 has write permissions to the Reports folder...but then that will allow User 1 to also rename the files/plonk stuff in there which shouldnt be there etc , which will continue to cause the problem of stuff being renamed and not being able to be found by other Users

 

Thanks for the other 2 links, we have some Faronics products, so will take a look at those tomorrow

[mac_shinobi]

how many users are you planning on doing this for because if its only say 10 teachers or so then you could just give them one folder each that way they only have permission to copy the original and then put it back into there own folder on the same shared drive and give each person rights only to there own folder and that way they each have there own copy and ammended version of the original.

[plexer]

What about a wiki at least you'd have revision history for the page edits then.

 

Ben

[Jake]

how many users are you planning on doing this for because if its only say 10 teachers or so then you could just give them one folder each that way they only have permission to copy the original and then put it back into there own folder on the same shared drive and give each person rights only to there own folder and that way they each have there own copy and ammended version of the original.

 

Its only about 10 people, but not teachers. Its the admin staff. To give you some idea of the weight of content in our Admin fileserver, we have around 23,000 documents in over 100 folders (ballpark figure, definately over 100 though), not including the past pupil reports and information as that is merely scanned stuff onto a document server, I mean 23k of created publisher/word/powerpoint/excel documents. Everything from simple letters/memos to governors, right through to extensive powerpoint publisher articles for the church diocese. Pretty much all the documents are worked on by multiple members of the admin staff, and they each need to have full access to any documents including the amendments made by other admin staff members. Which is why when amendments are made, the altered file must be accessible by the rest of admin, so that they can work on the file with the changes included, adding and altering themselves, and then having *their* changes then accessible by the rest of admin.

 

As you can see, just making an amendment and keeping the amended file in an area only accessible by them is no good. The amended file will be worked on by several other people, all of whom will then make amendments themselves, before it being worked on by someone else.

 

Frankly our admin server is a complete mess in terms of file structure, but the admin folks carry quite some "political" weight and are firmly stuck in the "this is the way we do it so shutup" category

[ajbritton]

Windows auditing will track all this for you, but you need to enable it on PCs/drives.

[Jake]

Sounds good, so if I was to enable it on the Server shared area drives, it will generate a log of who moves/renames/deletes/copies all the files on the shared area drive, with the time and date?

 

EDIT : Can it keep track of who moves and renames files/folders? and when? A quick browse of the Ms support info on it only states it can "events that relate to creating, opening, or deleting files". Would that include people renaming files and moving them to other folders? (which are our 2 biggest issues)

[ChrisH]

Windows auditing will track all this for you, but you need to enable it on PCs/drives.

 

You need to enable it in Group Policy as well.

[ajbritton]

When a file gets 'moved', what really happens is this...

 

1 - A new file is created in the target location

2 - Data from the source file is copied to the target file

3 - Source file is deleted

 

You should be able to see these events in the audit logs

 

A folder move would look more complex, depending on what was in it, but it should still be possible to track down the events.

 

It may be that renaming a file would show as writes to the file attributes or extended attributes.

 

The thing to do would be to set up a test environment and enable auditing. Do some file operations and see what gets logged. Trim out the auditing events you don't need to see.

[MkII]

Good thread Jake. I want exactly the same thing too. Thinking Sharepoint is the answer to our dreams, but need to know lots more about it.

[kxv2020]

We have a kind of system like yours - basically all the Senior Leaders (about 8 staff) have all the school documents [sEF, minutes, memos]mapped to a drive that has permissions for full access on it for all 8 senior leaders.

 

There is a sutiable file structure in place and it follows the convention:

1. The name of category - E.g. School Evaluation Form / Staff Handbook/etc.

2. Within this their are subdirectories of academic years e.g 06-07

 

We have found having "Previous Versions" Volume Shadowing Service enabled on the share which has proved to be a great benefit. Staff themselves can go back to previous copies that they may worked on yesterday or the day before.

 

This system has worked generally well - we haven't yet had folders/files being renamed on this drive - its the one that's accessible to all curriculum teachers that things go missing and get renamed.

[GrumbleDook]

We have a very splatted structure to the stuff the admin staff use ... and we take the view that if someone deletes the work of someone else then they can argue between themselves.

 

They keep it fairly well structured ... but it is just so spread out and I know there is a lot of duplication. I can't wait to get them into document management ... the Office Manager (also the Head's PA) has already thrown a fit at my suggestion of working towards ISO 9001:2000 ...

 

I am *really* going to enjoy this one ... just gotta sort out the new server for it.

[_Bob_]

We played with Sharepoint but the learning curve is quite steep and I had a feeling that it would provide new interesting ways for staff to hurt/confuse themselves.

If you go the Windows file auditing route you could use something like logparser (http://www.logparser.com/) to drop the appropriate logs onto a mySQL server, so that at a later date you could quickly construct queries to locate your culprits. I started doing something similar a while ago to keep track of user logon events but it never really got past the 'this will be nice if it works' stage.