Folders were moved on server and my IT person says he can't trace who did

My folders were moved on our server and my IT guy says he can't figure out who moved or renamed the folders and gave access to those folders to "everyone". Now the entire staff has access to personnel folders with social security numbers and applications and personal information on employees including salary history, etc. Why is my IT guy saying he has no idea how this happened and that there is no way he can determine who moved those file folders?

This conversation is currently closed to new comments.

3 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Answers

Collapse -

Which Server was it ?

by Sawan Gupta In reply to Folders were moved on ser ...

On a Windows server system logs be checked for the timestamp when the folder was moved and it can be determined who all were logged on to that system at that time.

Collapse -

He might be right

by markp24 In reply to Folders were moved on ser ...

he could say that for a few reasons:
1) he doesnt want to search an extensive log
2) HR may need to give approval to review logs due to company policy
3) Auditing is is Disabled and turned off for Filesystem modifications

but norally yes you should be able to trace that as said the the prior post.

Back to Security Forum
3 total posts (Page 1 of 1)  

Security Forums