Windows Server

Dawn NM · Guest

I'd like to audit FRS to determine when the first instance of a morphed
folder was created (and the user if possible). I need to find out what is
causing these - whether it's human or a process.

Can you find this out? And if so, from where?

Guest

Dawn
I dont no if this will help but i have found serching the local client
computer for morphed files helps because some can be from profiles ect
that get replaced back on the on the server after a cleanout.

Renato Pereira · Guest

Hi!

Take a look at the text bellow. I hope it helps!

1. Whenever you see a morphed folder, before you rename the folder, generate
the

idTable Parser (from FRSDiag Utility) results for the DC on which you
currently

have the morphed folder (one DC is good enough).

2. Search for the morphed folder name in the "idTable_FullPaths.txt" (you
can do a

Ctrl + F -> search for "_ntfrs" <without quotes>)

3. Find the Originator GUID in the same file.

4. Map the Originator GUID to the user friendly names of the DC from the
GUID2name

table.

(To genertare GUID2Name table form FRSDiag -> Tools -> Build GUID2Name for
Target

Server)

EXAMPLE:

=========

1. Output from "idTable_FullPaths.txt" showing morphed folders with
Originator DC

GUID:

FileCreateTime OriginatorGuid IsDir
Filepath

-------- ---------- -----
---------

Thu Apr 25, 2002 14:57:29 4f6fa915-80dd-4e2d-a7b8d744ad1906f1 True

..\scripts_NTFRS_146c7b45

Tue Jul 8, 2003 10:42:23 4f6fa915-80dd-4e2d-a7b8d744ad1906f1 True

..\Policies_NTFRS_146c3f65\{878BF165-A6C2-4362-A6FB-D86D87CEA20C}

2. Output from GUI2Name Table:

GUID MEMBER NAME SERVER NAME

---- ----------- -----------

4f6fa915-80dd-4e2d-a7b8d744ad1906f1 DVDC01 10.54.250.60

So, we know that DVDC01 was the originator for these morphed files/folders.

Cheers mate!

Renato Pereira

"user@domain.invalid" wrote:

	Windows Server Forum Index -> DFS and FRS	All times are GMT
Page 1 of 1