¿¿¿¿ WHO deleted my files ????

Helpme please!

Someone intencionally deleted some files of the SBS 2000.
Those files are useful for our workgroup, and this is the second time.

I suspect of several guys, and i want to know who was.

Is there any way to know WHAT files and WHO, WHEN and WHERE did it.???
Is there any tool that i should install????

Thanks in Advance.
Joseph Pharrow

Marina
Sat Aug 14 12:36:05 CDT 2004

Hi Joseph,

You do make backups, right? You can turn up audit logging on files. Will
give you a lot of entries in the security log.

--
Regards,

Marina
Microsoft SBS-MVP

"Arzamm" <arzamm@hotmail.com> schreef in bericht
news:OrBVTPigEHA.596@TK2MSFTNGP11.phx.gbl...
> Helpme please!
>
> Someone intencionally deleted some files of the SBS 2000.
> Those files are useful for our workgroup, and this is the second time.
>
> I suspect of several guys, and i want to know who was.
>
> Is there any way to know WHAT files and WHO, WHEN and WHERE did it.???
> Is there any tool that i should install????
>
> Thanks in Advance.
> Joseph Pharrow
>
>
>
>
>
>
>
>
>
>

Tim
Sun Aug 15 22:02:50 CDT 2004

Don't forget about security auditing...
- Tim

"Arzamm" <arzamm@hotmail.com> wrote in message
news:OrBVTPigEHA.596@TK2MSFTNGP11.phx.gbl...
> Helpme please!
>
> Someone intencionally deleted some files of the SBS 2000.
> Those files are useful for our workgroup, and this is the second time.
>
> I suspect of several guys, and i want to know who was.
>
> Is there any way to know WHAT files and WHO, WHEN and WHERE did it.???
> Is there any tool that i should install????
>
> Thanks in Advance.
> Joseph Pharrow
>
>
>
>
>
>
>
>
>
>

Evacolors
Mon Aug 16 14:34:43 CDT 2004

Thanks Tim

Please.... can you tellme how can i do that????


************************
"Tim" <Tim@NoSpam> escribió en el mensaje
news:%23jP8$0zgEHA.1048@tk2msftngp13.phx.gbl...
> Don't forget about security auditing...
> - Tim
>
> "Arzamm" <arzamm@hotmail.com> wrote in message
> news:OrBVTPigEHA.596@TK2MSFTNGP11.phx.gbl...
> > Helpme please!
> >
> > Someone intencionally deleted some files of the SBS 2000.
> > Those files are useful for our workgroup, and this is the second time.
> >
> > I suspect of several guys, and i want to know who was.
> >
> > Is there any way to know WHAT files and WHO, WHEN and WHERE did it.???
> > Is there any tool that i should install????
> >
> > Thanks in Advance.
> > Joseph Pharrow
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
>
>

Evacolors
Mon Aug 16 14:35:35 CDT 2004

Thanks Marina

Yes i did a backup.

Please.... can you tellme how can i do that (Config and Turn on
security)????
*************************

"Marina Roos [SBS-MVP]" <marina@roos.nodontwantspam.nl.com> escribió en el
mensaje news:O3IywUigEHA.1656@TK2MSFTNGP09.phx.gbl...
> Hi Joseph,
>
> You do make backups, right? You can turn up audit logging on files. Will
> give you a lot of entries in the security log.
>
> --
> Regards,
>
> Marina
> Microsoft SBS-MVP
>
> "Arzamm" <arzamm@hotmail.com> schreef in bericht
> news:OrBVTPigEHA.596@TK2MSFTNGP11.phx.gbl...
> > Helpme please!
> >
> > Someone intencionally deleted some files of the SBS 2000.
> > Those files are useful for our workgroup, and this is the second time.
> >
> > I suspect of several guys, and i want to know who was.
> >
> > Is there any way to know WHAT files and WHO, WHEN and WHERE did it.???
> > Is there any tool that i should install????
> >
> > Thanks in Advance.
> > Joseph Pharrow
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
>
>

Robert
Tue Aug 17 01:54:37 CDT 2004

Just a suggestion, but I have similar problems with users deleting files
or folders. Executive Software makes a great Network Recycle Bin
program called UnDelete. Any files deleted on a server share from a
workstation are stored in the server recycle bin. Very handy for quick
restores instead of having to go to tape all the time.

RC

Evacolors wrote:
> Thanks Tim
>
> Please.... can you tellme how can i do that????
>
>
> ************************
> "Tim" <Tim@NoSpam> escribió en el mensaje
> news:%23jP8$0zgEHA.1048@tk2msftngp13.phx.gbl...
>
>>Don't forget about security auditing...
>>- Tim
>>
>>"Arzamm" <arzamm@hotmail.com> wrote in message
>>news:OrBVTPigEHA.596@TK2MSFTNGP11.phx.gbl...
>>
>>>Helpme please!
>>>
>>>Someone intencionally deleted some files of the SBS 2000.
>>>Those files are useful for our workgroup, and this is the second time.
>>>
>>>I suspect of several guys, and i want to know who was.
>>>
>>>Is there any way to know WHAT files and WHO, WHEN and WHERE did it.???
>>>Is there any tool that i should install????
>>>
>>>Thanks in Advance.
>>>Joseph Pharrow
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>
>>
>
>