User Actions - Server '03

[addle_brains]

I'm at work, using server '03 to manage the student network. A class just lost a few weeks worth of work in one hit when a folder "disappeared." This was a public folder that could have been accessed by anybody on the student network. Is there a way, in Server '03 that I can look at a log of user actions and find out who deleted the folder? Thanks. This is the first time this has happened so it's about time I learnt.

 

[Camper]

If you setup auditing for that folder you can see who deleted it.
http://technet2.microsoft.com/windowsserver/en/technologies/featured/audit/default.mspx

You should setup auditing on your public folders. You should also setup NTFS permissions prevent students from deleting the folders.

 

[addle_brains]

Ah, ok it's a little late now. Also, the permissions are set in stone by a special app we use to set permissions. By department policy I can't change them. Also, it's a public directory so this teacher shouldn't have been using to store children's work; they have their own private drives. I managed to get the backup tape from last week, I still want to lay some knowledge on the kid that did it.

 

[Camper]

Unfortunately when you tell someone not to do something it goes in one ear and out the other. Just because it's easer. At lest now they know why they need to to save student work to there drives. It also to bad you did not have auditing turned on for that folder so you can catch the offending troublemaker.