Who deleted shared files over network?

[HotRod]

Everyone in our office is running either Windows 2000 or XP Pro. We have one
PC that we use to put shared files on that is running Windows XP Pro, almost
everyone in our small office has access to the shared folders. However over
the alst few months several folders (With some newely revised work) have
been deleted. From my stand point it seems to be random but I'm sure one of
the users is doing it to be an @ss. In some cases we've lost days of work.
SO

1) Where do files on the XP Pro machine go when they are deleted by a
network user? They aren't in the recycling bin.
2) Can we track who deletes certain folders and files?

 

[Bob I]

1) Away, bye-bye, gone. Recycle Bin is only used for the Local GUI deletes.
2) Enable Auditing. See Windows Help, Auditing.

 

[LVTravel]

Sounds like you need go to a real server system instead of a peer-to-peer
network so that information can be tracked. Win XP doesn't have the
capability in it AFAIK but there may be software that can track it. W2003
Server can track that information.

To prevent "days of work" to be lost, in the meantime, a scheduled backup of
the current drive should be done on a daily or every few hours basis to
another machine in the office. It can be done with xcopy in a batch file
with XP scheduler handling the start of Xcopy. (Of course it could also be
done to a Network Attached Storage drive like I do in my home office.)

 

[Jack \(MVP-Networking\).]

Hi
To be safe and functional computers has to be set ahead for such situation.
If every thing performed by a simple computer would be logged as default it
becomes none practical.
As a first step try to scan the Hard Drive with a Recovery (undelete
program), who knows you might be Lucy.
Then head On here, http://www.sbstestdrive.com/
Trial can be asked for here,
http://technet.microsoft.com/en-us/bb738394.aspx
Jack (MVP-Networking).

 

[Bruce Chambers]

Everyone in our office is running either Windows 2000 or XP Pro. We have one
PC that we use to put shared files on that is running Windows XP Pro, almost
everyone in our small office has access to the shared folders. However over
the alst few months several folders (With some newely revised work) have
been deleted. From my stand point it seems to be random but I'm sure one of
the users is doing it to be an @ss. In some cases we've lost days of work.
SO

1) Where do files on the XP Pro machine go when they are deleted by a
network user? They aren't in the recycling bin.

Files deleted via a networked connection are completely deleted (unless
you use a 3rd-party data recovery utility. They don't go anywhere,
especially not to the Recycle Bin.

2) Can we track who deletes certain folders and files?

Not on a workstation. If you were using a true server OS, you could
turn on auditing to determine who's doing what, and when.


--

Bruce Chambers

Help us help you:



They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. ~Benjamin Franklin

Many people would rather die than think; in fact, most do. ~Bertrand Russell

The philosopher has never killed any priests, whereas the priest has
killed a great many philosophers.
~ Denis Diderot

 

[Lanwench [MVP - Exchange]]

Everyone in our office is running either Windows 2000 or XP Pro. We
have one PC that we use to put shared files on that is running
Windows XP Pro, almost everyone in our small office has access to the
shared folders. However over the alst few months several folders
(With some newely revised work) have been deleted. From my stand
point it seems to be random but I'm sure one of the users is doing it
to be an @ss. In some cases we've lost days of work. SO

1) Where do files on the XP Pro machine go when they are deleted by a
network user? They aren't in the recycling bin.
2) Can we track who deletes certain folders and files?

In addition to the other replies - yes, a server is a good thing. Set up an
AD domain using W2003 and enable volume shadow copy & set up regular
automated backups, and you won't be completely screwed if this happens
again. However, even with auditing, it can still happen & be difficult to
trace. You'll probably want to divide up your data into different shares,
with not everyone having full access to everything across the network.

 

[Al Dunbar]

1) Away, bye-bye, gone. Recycle Bin is only used for the Local GUI
deletes.

and further to that, even if they used the GUI, they can make sure to leave
their recycle bin empty.

/Al

 

[LVTravel]

"Lanwench [MVP - Exchange]"

In addition to the other replies - yes, a server is a good thing. Set up
an AD domain using W2003 and enable volume shadow copy & set up regular
automated backups, and you won't be completely screwed if this happens
again. However, even with auditing, it can still happen & be difficult to
trace. You'll probably want to divide up your data into different shares,
with not everyone having full access to everything across the network.

I haven't read too much on it yet but looks like Windows Home Server will be
the way to go for these small home devices (auto backup, etc.) when it
becomes more widely available.

 

[Lanwench [MVP - Exchange]]

"Lanwench [MVP - Exchange]"

In addition to the other replies - yes, a server is a good thing.
Set up an AD domain using W2003 and enable volume shadow copy & set
up regular automated backups, and you won't be completely screwed if
this happens again. However, even with auditing, it can still happen
& be difficult to trace. You'll probably want to divide up your data
into different shares, with not everyone having full access to
everything across the network.

I haven't read too much on it yet but looks like Windows Home Server
will be the way to go for these small home devices (auto backup,
etc.) when it becomes more widely available.

If it has auditing & VSS capabilities, sure. But I don't put "home" stuff on
business networks.

 

[LVTravel]

"Lanwench [MVP - Exchange]"

"Lanwench [MVP - Exchange]"

Everyone in our office is running either Windows 2000 or XP Pro. We
have one PC that we use to put shared files on that is running
Windows XP Pro, almost everyone in our small office has access to
the shared folders. However over the alst few months several folders
(With some newely revised work) have been deleted. From my stand
point it seems to be random but I'm sure one of the users is doing
it to be an @ss. In some cases we've lost days of work. SO

1) Where do files on the XP Pro machine go when they are deleted by
a network user? They aren't in the recycling bin.
2) Can we track who deletes certain folders and files?

In addition to the other replies - yes, a server is a good thing.
Set up an AD domain using W2003 and enable volume shadow copy & set
up regular automated backups, and you won't be completely screwed if
this happens again. However, even with auditing, it can still happen
& be difficult to trace. You'll probably want to divide up your data
into different shares, with not everyone having full access to
everything across the network.

I haven't read too much on it yet but looks like Windows Home Server
will be the way to go for these small home devices (auto backup,
etc.) when it becomes more widely available.

If it has auditing & VSS capabilities, sure. But I don't put "home" stuff
on business networks.

Correct & OOPS. Should have read the OP again. I was responding to a
different issue for home based computer network from different area. Notice
in my earlier post from the 7th, I specified W 2003 server would accomplish
auditing.