Re: Disappearing .doc files

Weird. You can audit those files to see if it shows a particular user doing
that. See the link below for more details and I would be sure to just audit
the two delete permissions to keep the number of object access events down.
You will also find it helpful to use Event Comb to search the security log
for specific events and text strings such as filename and delete. If a user
name is found he may have malicious software installed on his computer or
another user could be impersonating him and not be doing it himself so keep
that in mind before you fire or reprimand him right away. As shown below
Event IDs 560 and 567 will have pertinent info.--- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;301640 --- note
that auditing of object access needs to be enabled on server first.
http://www.microsoft.com/downloads/details.aspx?displaylang=en&familyid=7af2e69c-91f3-4e63-8629-b999adde0b9e
--- Event Comb available here.

http://www.microsoft.com/technet/security/topics/auditingandmonitoring/securitymonitoring/smpgch04.mspx
--- excerpt copied below
Table 4.1: File Permission Change Events

Event IDs Occurrence Comments
560

Access granted to existing object

These events show where an object has successfully granted access to a
request, such as list, read, create, and delete. Check Primary Logon ID,
Client User Name, and Primary User Name fields to detect unauthorized
attempts to change file permissions. Check Accesses field to identify the
operation type. This event only shows that access was requested or
granted-it does not mean that the access took place. The acting user is the
Client User (if present); otherwise it is the Primary User.

567
A permission associated with a handle used
This event occurs on the first instance of an access type (list, read,
create, and so on) to an object. To correlate with event 560, compare the
Handle ID fields of the two events.



"Andy H." <andrew.harlan@xxxxxxxxxxxxxxxx> wrote in message
news:%23LNS0v2UGHA.4248@xxxxxxxxxxxxxxxxxxxxxxx
Hello,

We have a Windows 2003 server with a share setup for users to access and
store documents. In the past few days we noticed word documents
disappearing from various folders within this share. When we restore
these documents from tape to these directories they remain for a couple
minutes and then poof they all disappear. Only .doc files are gone. If
we move these files to another share on the same server they remain. When
we took away delete access from the users group the files remain. However
when those permissions are reinstated the files disappear. There is no
evidence in event logs. Any ideas on how to track these occurences?



.

Relevant Pages

  • Re: Disappearing .doc files
    ... If I audit a group will that show individual user actions or only the group ... and Primary User Name fields to detect unauthorized ... attempts to change file permissions. ... However when those permissions are reinstated the files disappear. ...
    (microsoft.public.windows.server.security)
  • Re: Disappearing .doc files
    ... and Primary User Name fields to detect unauthorized ... attempts to change file permissions. ... granted-it does not mean that the access took place. ... However when those permissions are reinstated the files disappear. ...
    (microsoft.public.windows.server.security)
  • Re: Disappearing .doc files
    ... Object Server: Security ... ID, Client User Name, and Primary User Name fields to detect unauthorized ... attempts to change file permissions. ...
    (microsoft.public.windows.server.security)
  • Re: Which auditing category?
    ... This will audit change to ntfs permissions, ... Try to audit bare minimum of settings for bare minimum of ... >> folder granted using global group. ...
    (microsoft.public.win2000.security)
  • New Tool: Windows Permission Identifier v1.0
    ... This tool enables administrators and penetration testers to review and audit the permissions of users on a windows machine. ...
    (Pen-Test)