Files repeately go missing from a server share. Can I find out who/what is responsible?

i have 2003 server site site vpn's xp clients. xp clients have server share on them users store files , data into. every files , data have been updated go missing, @ first put down user error , recovered files shadow copies, 5 time in month now, , data has been lost wasn't shadow copied or backed-up.

i tried turn on file auditing share event fire (un)successful deleteions, didn't seem generate event in logs. (not sure have got set right honest.)

so wondering how might able track down user or service, machine, , @ time removing these files? users swear "it wasn't me!", , maybe right, other idea had machine might have share sync'd via offline files , when syncs replaces server copy local copy, have no idea how track down.

does 1 have ideas out there?

 

regards

hi andrew,

here article provided detailed steps setup file auditing:

how audit file / directory delete operations on windows system using security auditing

http://www.monitorware.com/common/en/articles/audit_file_deletion.php

"how setup sync folder backup", know if users need update files in folder. if so, may not able use "sync" way protect files, "local copy" alwaysreplace updated copy. @ situation, backup such volume shadow copy better.

i tried create one-way-replication dfs share, can copy files saved in folder2 folder1 not other way. can protect files in folder2 files deleted in folder1 (you can share folder1 public) not replicated, keep saving files folder2 , let users using folder1.

however still not full solution as:

1. files saved folder1 not replicated folder2, if users update files or create new files in folder1, files not replicated folder2.

2. files in folder1 overwritten when there same file name in folder2.

Windows Server  >  File Services and Storage