Windows Server

Jefferson · Guest

Hi Guys,

I have had a user that left the company and she deleted a couple of Office
documents off her shared drive on the server.
I need to prove that she did this, and was hoping that someone out there
would have an idea of where i can get the information (Log File) and what i
would search for.
Thanks in advance.
Jefferson

David Copeland [MSFT] · Guest

Jefferson,

Something you might look at is using start run \\servername\c$ (for example
if the files were on the server's c: drive) and then go to the folder where
the files where and then right click on the folder and select Properties to
see if you have a Previous Versions tab. In the event that volume shadow is
enabled on the drive and see if there is a copy of the file(s) there. Note
that this would not necessarily prove that they were deleted or by whom.

To know if the person had deleted them then auditing would have needed to be
enabled to show that the files were deleted and by whom.

--

Hope that helps,
David Copeland
Microsoft Small Business Server Support

This posting is provided "AS IS" with no warranties, and confers no rights.

SBS Newsgroups:

SBS v4.x: microsoft.public.backoffice.smallbiz
SBS 2000: microsoft.public.backoffice.smallbiz2000
SBS 2003: microsoft.public.windows.server.sbs

"Jefferson" <originaljeffie@hotmail.com> wrote in message
news:02B3165D-B33A-4E68-983A-9E50907DB47F@microsoft.com...

Jefferson · Guest

Thanks for the information David, I have now enabled Shadow Copy.
How would i go about doing an audit to see what had happened, If i am not
mistaken, the auditing is enabled.

Thanks David

"David Copeland [MSFT]" wrote:

David Copeland [MSFT] · Guest

Jefferson,

Right click on the folder and click on Property then click on the Security
tab, then click on the Advanced button, from there click on the Auditing
tab. Is there anything listed in the auditing entries?

You'd also need to look at your group policies under Computer
Configuration/Windows Settings/Security Settings/Local Policies/Audit Policy
to see what/if anything is enabled.

If they both are enabled then you should be able to see the events in the
Security event log.

--

Hope that helps,
David Copeland
Microsoft Small Business Server Support

This posting is provided "AS IS" with no warranties, and confers no rights.

SBS Newsgroups:

SBS v4.x: microsoft.public.backoffice.smallbiz
SBS 2000: microsoft.public.backoffice.smallbiz2000
SBS 2003: microsoft.public.windows.server.sbs

"Jefferson" <originaljeffie@hotmail.com> wrote in message
news:AF4DEB3E-BD28-4B28-8AA6-E1A350C4174A@microsoft.com...

	Windows Server Forum Index -> Small Business Server 2003	All times are GMT
Page 1 of 1