Who deleted shared files over network?

Sounds like you need go to a real server system instead of a peer-to-peer
network so that information can be tracked. Win XP doesn't have the
capability in it AFAIK but there may be software that can track it. W2003
Server can track that information.

To prevent "days of work" to be lost, in the meantime, a scheduled backup of
the current drive should be done on a daily or every few hours basis to
another machine in the office. It can be done with xcopy in a batch file
with XP scheduler handling the start of Xcopy. (Of course it could also be
done to a Network Attached Storage drive like I do in my home office.)


"HotRod" wrote in message

> Everyone in our office is running either Windows 2000 or XP Pro. We have
> one PC that we use to put shared files on that is running Windows XP Pro,
> almost everyone in our small office has access to the shared folders.
> However over the alst few months several folders (With some newely revised
> work) have been deleted. From my stand point it seems to be random but I'm
> sure one of the users is doing it to be an @ss. In some cases we've lost
> days of work. SO
>
> 1) Where do files on the XP Pro machine go when they are deleted by a
> network user? They aren't in the recycling bin.
> 2) Can we track who deletes certain folders and files?
>
 >> Stay informed about: Who deleted shared files over network? 

Hi
To be safe and functional computers has to be set ahead for such situation.
If every thing performed by a simple computer would be logged as default it
becomes none practical.
As a first step try to scan the Hard Drive with a Recovery (undelete
program), who knows you might be Lucy.
Then head On here, http://www.sbstestdrive.com/
Trial can be asked for here,
http://technet.microsoft.com/en-us/bb738394.aspx
Jack (MVP-Networking).

"HotRod" wrote in message

> Everyone in our office is running either Windows 2000 or XP Pro. We have
> one PC that we use to put shared files on that is running Windows XP Pro,
> almost everyone in our small office has access to the shared folders.
> However over the alst few months several folders (With some newely revised
> work) have been deleted. From my stand point it seems to be random but I'm
> sure one of the users is doing it to be an @ss. In some cases we've lost
> days of work. SO
>
> 1) Where do files on the XP Pro machine go when they are deleted by a
> network user? They aren't in the recycling bin.
> 2) Can we track who deletes certain folders and files?
>
 >> Stay informed about: Who deleted shared files over network? 

HotRod wrote:
> Everyone in our office is running either Windows 2000 or XP Pro. We have one
> PC that we use to put shared files on that is running Windows XP Pro, almost
> everyone in our small office has access to the shared folders. However over
> the alst few months several folders (With some newely revised work) have
> been deleted. From my stand point it seems to be random but I'm sure one of
> the users is doing it to be an @ss. In some cases we've lost days of work.
> SO
>
> 1) Where do files on the XP Pro machine go when they are deleted by a
> network user? They aren't in the recycling bin.


Files deleted via a networked connection are completely deleted (unless
you use a 3rd-party data recovery utility. They don't go anywhere,
especially not to the Recycle Bin.


> 2) Can we track who deletes certain folders and files?
>
>

Not on a workstation. If you were using a true server OS, you could
turn on auditing to determine who's doing what, and when.


--

Bruce Chambers

Help us help you:
http://dts-l.org/goodpost.htm
http://www.catb.org/~esr/faqs/smart-questions.html

They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. ~Benjamin Franklin

Many people would rather die than think; in fact, most do. ~Bertrand Russell

The philosopher has never killed any priests, whereas the priest has
killed a great many philosophers.
~ Denis Diderot
 >> Stay informed about: Who deleted shared files over network? 

HotRod wrote:
> Everyone in our office is running either Windows 2000 or XP Pro. We
> have one PC that we use to put shared files on that is running
> Windows XP Pro, almost everyone in our small office has access to the
> shared folders. However over the alst few months several folders
> (With some newely revised work) have been deleted. From my stand
> point it seems to be random but I'm sure one of the users is doing it
> to be an @ss. In some cases we've lost days of work. SO
>
> 1) Where do files on the XP Pro machine go when they are deleted by a
> network user? They aren't in the recycling bin.
> 2) Can we track who deletes certain folders and files?

In addition to the other replies - yes, a server is a good thing. Set up an
AD domain using W2003 and enable volume shadow copy & set up regular
automated backups, and you won't be completely screwed if this happens
again. However, even with auditing, it can still happen & be difficult to
trace. You'll probably want to divide up your data into different shares,
with not everyone having full access to everything across the network.
 >> Stay informed about: Who deleted shared files over network? 

"Bob I" wrote in message

> 1) Away, bye-bye, gone. Recycle Bin is only used for the Local GUI
> deletes.

and further to that, even if they used the GUI, they can make sure to leave
their recycle bin empty.

/Al

> 2) Enable Auditing. See Windows Help, Auditing.
>
> HotRod wrote:
>
>> Everyone in our office is running either Windows 2000 or XP Pro. We have
>> one PC that we use to put shared files on that is running Windows XP Pro,
>> almost everyone in our small office has access to the shared folders.
>> However over the alst few months several folders (With some newely
>> revised work) have been deleted. From my stand point it seems to be
>> random but I'm sure one of the users is doing it to be an @ss. In some
>> cases we've lost days of work. SO
>>
>> 1) Where do files on the XP Pro machine go when they are deleted by a
>> network user? They aren't in the recycling bin.
>> 2) Can we track who deletes certain folders and files?
>
 >> Stay informed about: Who deleted shared files over network? 

"Lanwench [MVP - Exchange]"
wrote in message

> HotRod wrote:
>> Everyone in our office is running either Windows 2000 or XP Pro. We
>> have one PC that we use to put shared files on that is running
>> Windows XP Pro, almost everyone in our small office has access to the
>> shared folders. However over the alst few months several folders
>> (With some newely revised work) have been deleted. From my stand
>> point it seems to be random but I'm sure one of the users is doing it
>> to be an @ss. In some cases we've lost days of work. SO
>>
>> 1) Where do files on the XP Pro machine go when they are deleted by a
>> network user? They aren't in the recycling bin.
>> 2) Can we track who deletes certain folders and files?
>
> In addition to the other replies - yes, a server is a good thing. Set up
> an AD domain using W2003 and enable volume shadow copy & set up regular
> automated backups, and you won't be completely screwed if this happens
> again. However, even with auditing, it can still happen & be difficult to
> trace. You'll probably want to divide up your data into different shares,
> with not everyone having full access to everything across the network.
>
I haven't read too much on it yet but looks like Windows Home Server will be
the way to go for these small home devices (auto backup, etc.) when it
becomes more widely available.
 >> Stay informed about: Who deleted shared files over network? 

LVTravel wrote:
> "Lanwench [MVP - Exchange]"
> wrote in
> message
>> HotRod wrote:
>>> Everyone in our office is running either Windows 2000 or XP Pro. We
>>> have one PC that we use to put shared files on that is running
>>> Windows XP Pro, almost everyone in our small office has access to
>>> the shared folders. However over the alst few months several folders
>>> (With some newely revised work) have been deleted. From my stand
>>> point it seems to be random but I'm sure one of the users is doing
>>> it to be an @ss. In some cases we've lost days of work. SO
>>>
>>> 1) Where do files on the XP Pro machine go when they are deleted by
>>> a network user? They aren't in the recycling bin.
>>> 2) Can we track who deletes certain folders and files?
>>
>> In addition to the other replies - yes, a server is a good thing.
>> Set up an AD domain using W2003 and enable volume shadow copy & set
>> up regular automated backups, and you won't be completely screwed if
>> this happens again. However, even with auditing, it can still happen
>> & be difficult to trace. You'll probably want to divide up your data
>> into different shares, with not everyone having full access to
>> everything across the network.
> I haven't read too much on it yet but looks like Windows Home Server
> will be the way to go for these small home devices (auto backup,
> etc.) when it becomes more widely available.

If it has auditing & VSS capabilities, sure. But I don't put "home" stuff on
business networks.
 >> Stay informed about: Who deleted shared files over network? 

"Lanwench [MVP - Exchange]"
wrote in message

> LVTravel wrote:
>> "Lanwench [MVP - Exchange]"
>> wrote in
>> message
>>> HotRod wrote:
>>>> Everyone in our office is running either Windows 2000 or XP Pro. We
>>>> have one PC that we use to put shared files on that is running
>>>> Windows XP Pro, almost everyone in our small office has access to
>>>> the shared folders. However over the alst few months several folders
>>>> (With some newely revised work) have been deleted. From my stand
>>>> point it seems to be random but I'm sure one of the users is doing
>>>> it to be an @ss. In some cases we've lost days of work. SO
>>>>
>>>> 1) Where do files on the XP Pro machine go when they are deleted by
>>>> a network user? They aren't in the recycling bin.
>>>> 2) Can we track who deletes certain folders and files?
>>>
>>> In addition to the other replies - yes, a server is a good thing.
>>> Set up an AD domain using W2003 and enable volume shadow copy & set
>>> up regular automated backups, and you won't be completely screwed if
>>> this happens again. However, even with auditing, it can still happen
>>> & be difficult to trace. You'll probably want to divide up your data
>>> into different shares, with not everyone having full access to
>>> everything across the network.
>> I haven't read too much on it yet but looks like Windows Home Server
>> will be the way to go for these small home devices (auto backup,
>> etc.) when it becomes more widely available.
>
> If it has auditing & VSS capabilities, sure. But I don't put "home" stuff
> on business networks.
>
Correct & OOPS. Should have read the OP again. I was responding to a
different issue for home based computer network from different area. Notice
in my earlier post from the 7th, I specified W 2003 server would accomplish
auditing.
 >> Stay informed about: Who deleted shared files over network?