Re: Lost Disk Space

From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 12/09/04

  • Next message: Roger Abell: "Re: Automatic authentification" 
    Date: Wed, 8 Dec 2004 22:26:58 -0700

    Steve, can I add one to your otherwise rather complete
    sounding list of possible faults allowing entry which you
    provided in the opening paragraph?
    "or, indiscriminate web browsing while logged in as an admin" 

    -- 
Roger Abell
Microsoft MVP (Windows  Security)
MCSE (W2k3,W2k,Nt4)  MCDBA
"Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
news:WAItd.224912$R05.36591@attbi_s53...
> First off you should consider salvaging your data and doing a clean
install
> after taking steps to prevent such problems form happening again, but that
> is your call. My guess is that either your server was not close to being
> current with critical updates from Windows Updates, you have unneeded
> services installed, no or an incorrectly configured firewall is being
used,
> your antivirus definitions are not current and not scanning emails, and/or
> you are using weak passwords for administrator accounts. I suggest you
take
> advantage of the free Microsoft Baseline Security Analyzer to check your
> server for basic security issues.
>
> http://www.microsoft.com/technet/security/tools/mbsahome.mspx    --- MBSA
>
>
> Having said that. It might help if you go through each folder under the
> root/drive folder to see if you can find a folder that uses an usually
large
> amount of space. Of course you will need to first enable viewing of hidden
> folders and files. If you do find the folders you may have difficulty
> deleting the folders. Also run Check Disk on your server to see if it can
> find/repair problems on the hard drive. There are also RK tools at the
link
> below such as diruse that may be helpful in tracking down disk use.
>
> http://www.petri.co.il/download_free_reskit_tools.htm
> http://support.microsoft.com/?kbid=320081  -- dealing with hard to delete
> files
>
> "Brad E" <Brad E@discussions.microsoft.com> wrote in message
> news:9E0A795F-662A-407A-ACEB-3A85BF6EA68A@microsoft.com...
> >I was implementing security auditing on my w2k SBS server and i noticed
> >that
> > my d:> disk space started to diminish by about 100mb per minute.
Thinking
> > it
> > was the audit policy, I turned it off. It carried on, so I disconnected
> > the
> > internet and it stopped! So, I did a netstat and found that my server
was
> > connected to 150.188.1.10:3835, 195.70.236.164: on various ports. I
> > blocked
> > these ports and ip address's. Went into task manager and found the
> > following
> > strange services: server.exe, syshosts.exe, WinSRV.exe, syshost.exe and
> > SL14F2.tmp. I tried to stop all of them, but I was not allowed except
for
> > SL14F2.tmp. I ran Trend Anti-virus on all my workstations and server,
with
> > the latest pattern file. It came up with a few virus's which were
deleted
> > or
> > quarantined. I then ran adaware, which found a few bits and pieces and
> > removed them as well.
> > As it stands now, my d:> is 55GB in size. 26.92GB is accounted for in
> > files
> > and i have 2.98GB free space. Where did 14GB go? I have searched with
> > utilitities to no avail and have even done a attrib search in DOS. Has
> > anyone
> > got any ideas? Thanks for your time!
>
>
  • Next message: Roger Abell: "Re: Automatic authentification"

    Relevant Pages

    • Re: Advice request: Backdoor hack on Windows Small Business Server
      ... > administrator groups on the server and avoid using admin powers for mundane ... > the security logs if you have enabled auditing of logon events and increased ... > the size of the security log to at least 10MB. ... Just download it and the pattern file to the same folder, ...
      (microsoft.public.windows.server.security)
    • Re: Best Practices for deploying Windows 2000 in Remote Sites
      ... Your server has system disk configured as mirror. ... Your server has hot-plug disks to speed up recovery, ... If you are intersted in security recommendation guides, ...
      (microsoft.public.win2000.setup_deployment)
    • Re: Question on folder redirection
      ... I was looking about the server settings this ... morning and although I had removed disk quota limits on the volumes, ... Click My Computer icon and choose one disk label that the user folder ... Folder Redirection is a User group policy. ...
      (microsoft.public.windows.server.sbs)
    • RE: FrontPage XP web project; losing bots/theme in publishing to web
      ... from the disk based web to the server based web. ... sure that these files are part of the publishing process. ... >local disk by using Browse, creating a new folder, and ...
      (microsoft.public.frontpage.programming)
    • XP client security
      ... I have a question concerning client security. ... the copier uses an older method of authentication ... so it is incapable of accessing a folder on our Windows Small Business Server ...
      (microsoft.public.security)