How to track moved files

[Jim]

On our network, a certain user (or users) persistently, yet by
mistake, moves folders (almost certainly by dragging and dropping
through Explorer). This causes a lot of disruption and it has started
to happen very frequently. The files are normally retrieved quite
easily as they've simply been "hidden" in the depths of some tree,
normally on the same drive.

The obvious solution is to give read-only access to all users on the
affected drives. But this would affect other users who need write
access.

I would like to know if anyone has any ideas how to easily track down
the culprit. I can see what time the files are accessed but there's no
exif info on who the user is, nor can i find any event logs. Are there
any available scripts that would allow us to find out who is moving
the files?

Thanks
Jim

 

[Bob I]

HOW TO: Audit Active Directory Objects in Windows Server 2003
http://support.microsoft.com/kb/814595/en-us