G
Guest
Hello,
On our file server (Win2K Adv Server with DFS) we have a directory on which
only two people have the NTFS permissions to change files. Over the last few
months the have noticed that when the modify files the old version of some of
these files reappear after random time (not all changes to all of these files
revert to their original values). Also, SOMETIMES when they delete files from
this directory and they press F5 the deleted files reappear on the file
system.
Although I'm not known for having too much faith in end-users always telling
the truth it's is getting harder and harder for me to doubt all cases in
which these problems are reported. Only last week I authorized the payment to
an external partner which had an engineer changing some files in the
directory above. I have seen the changes made, I have seen proof of print
files which were produced with the changed files and I have seen the modified
file attributes. However, this morning all updated files were rolled back to
January 29, 2005.
It is impossible that someone recovered the files from backup (we have an
issue with our backup software which made it impossible to restore anything
since over one month). We use two virus scanners on the file system and they
both have up to date signatures ...
I have two questions:
- Has anyone noticed something like this before?
- In case it is someone screwing things up, how can I trace the actions on
these files? Which audit settings make sense and which not?
Any help is mostly appreciated.
Regards,
Jan
On our file server (Win2K Adv Server with DFS) we have a directory on which
only two people have the NTFS permissions to change files. Over the last few
months the have noticed that when the modify files the old version of some of
these files reappear after random time (not all changes to all of these files
revert to their original values). Also, SOMETIMES when they delete files from
this directory and they press F5 the deleted files reappear on the file
system.
Although I'm not known for having too much faith in end-users always telling
the truth it's is getting harder and harder for me to doubt all cases in
which these problems are reported. Only last week I authorized the payment to
an external partner which had an engineer changing some files in the
directory above. I have seen the changes made, I have seen proof of print
files which were produced with the changed files and I have seen the modified
file attributes. However, this morning all updated files were rolled back to
January 29, 2005.
It is impossible that someone recovered the files from backup (we have an
issue with our backup software which made it impossible to restore anything
since over one month). We use two virus scanners on the file system and they
both have up to date signatures ...
I have two questions:
- Has anyone noticed something like this before?
- In case it is someone screwing things up, how can I trace the actions on
these files? Which audit settings make sense and which not?
Any help is mostly appreciated.
Regards,
Jan