Warning

 

Close

Confirm Action

Are you sure you wish to do this?

Confirm Cancel
BCM
User Panel

Posted: 2/8/2006 9:05:57 AM EDT
Isn't there a way to look back and see what kind of activity has taken place recently?Specifically if any files have been deleted? I believe I've done it before, but I can't remember how to do it.

On one of my systems here at work, some software is not working properly anymore, like some critical files have been deleted. It was OK Friday and then for some reason Moday morning it was fucked up. There is a guy that has access to it at night and I need to see what if anything was deleted between the time I left Friday to Monday morning.

Link Posted: 2/8/2006 11:37:50 AM EDT
[#1]
Depends on how stupid the person doing the deleting is. Check the recycle bin. If they didn't empty it, all the files are there. You can restore them individually.
If they cleared it, then you need other software to bring back the deleted files.
If you just want to see what was accessed, check documents in the start bar menu.
Link Posted: 2/8/2006 11:40:48 AM EDT
[#2]
Why does this guy have an ADMIN account to install/uninstall software?

Each person should have a separate login and only a guest/other account that doesn't allow them to remove applications.
Link Posted: 2/8/2006 11:55:14 AM EDT
[#3]
Enable auditing, then set the appropriate audit entries on each file/folder.
Link Posted: 2/8/2006 12:03:35 PM EDT
[#4]

Quoted:
Isn't there a way to look back and see what kind of activity has taken place recently?Specifically if any files have been deleted? I believe I've done it before, but I can't remember how to do it.

On one of my systems here at work, some software is not working properly anymore, like some critical files have been deleted. It was OK Friday and then for some reason Moday morning it was fucked up. There is a guy that has access to it at night and I need to see what if anything was deleted between the time I left Friday to Monday morning.




Sounds fishy, you are trying to incriminate someone at home? j/k
Link Posted: 2/8/2006 12:07:20 PM EDT
[#5]
Use the Event Viewer under the Administrative Tools in the Start Menu.  It will tell you who logged on and when.  It can also tell you when certain things take place, but you need to set it up to be flagged ahead of time.
Close Join Our Mail List to Stay Up To Date! Win a FREE Membership!

Sign up for the ARFCOM weekly newsletter and be entered to win a free ARFCOM membership. One new winner* is announced every week!

You will receive an email every Friday morning featuring the latest chatter from the hottest topics, breaking news surrounding legislation, as well as exclusive deals only available to ARFCOM email subscribers.


By signing up you agree to our User Agreement. *Must have a registered ARFCOM account to win.
Top Top