We are using windows 2000 server and need your kind help!

Is there a way one(a system administrator with all the
right access he needs) could modify contents of files
saved on server without leaving a trace(e.g. changed the
server clock backwards so the file date still looked the
same)? We suspect an ex-admin might have modified some
files without showing but don't know how we could
confirm.

Greatly appreciate your kind suggest/direction!

Sure...basically anybody with an administrator-level password can, with a
little bit of know-how, accomplish anything. Anybody calling the
SetFileTime() API can do what you're suggesting without fiddling with the
clock. Of course, fiddling with the clock might be simpler....

Why were the ex-admin's passwords not changed when he/she left?


--
John Phillips
MVP - Windows SDK



"sherry" <(E-Mail Removed)> wrote in message
news:2233801c45cd9$0bee1ef0$(E-Mail Removed)...
> We are using windows 2000 server and need your kind help!
>
> Is there a way one(a system administrator with all the
> right access he needs) could modify contents of files
> saved on server without leaving a trace(e.g. changed the
> server clock backwards so the file date still looked the
> same)? We suspect an ex-admin might have modified some
> files without showing but don't know how we could
> confirm.
>
> Greatly appreciate your kind suggest/direction!
>