Windows Forum

Ask something
Discussion Locked

Vanishing folders - NT server file share

0 helpful
18 replies

by wilsonb

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
A few days ago a shared folder we use for user profiles went from having 250 objects in it down to 124. Performed restore and a couple hours later the same thing happened. Created a new share on a new server and 24 hours later most of the folders had vanished again. Had unshared the old share, ran the restore and nothing has vanished. No user has delete perms and there is no virus. What could be wrong?

18 replies

by flan

Someone is deleting them. Perhaps a hacker? Or maybe someone had admin privelidges and don't know. I thnk it's the latter.

by wilsonb

We have already gone over the Domain Admins group and there isn't anyone in it that shouldn't be. Same with the local admin acct. Since this is a private network not connected to the Internet, I don't think it's a hacker.

by ronnonf

Here we go.
1) Check the permissions on the parent and children.
2) You can enable auditting to see who is doing the deleting.
3) I have a funny idea that "nobody" is doing the actual deleting but more like a process. In English I think the Directory replication service is doing this. Due to the fact that these (personal) directories are not located in the exported directory but in the netlogon/import directory. Copy these directories into the Export:Scripts directory then watch.

If this does not work then give the autiting idea a shot. Gluck

by wilsonb

Have checked perms already, enabled auditing, didn't show anything but caused massive LSA DB synch requests which we had fix by turning off the audit. Even though these folder contain profile info, the aren't NT profiles by definition. They are not associated to the user through user manager nor do they exist in a replicated share. We use kixstart to associate the user to his folder.

by spydergst1

Here are a few things I would try.

restrict all rights even administrator to read only.

If you are running an anti virus program the program could be deleting them.

If you are running a backup program be sure the options are not set to purge the files after backup.

Try a different directory and a different share name.

If only some files are being deleted it may be related to a time stamp issue.

Sounds like you may have tried these sugestions already. Good luck!

by wilsonb

Norton hasn't deleted anything yet it won't even delete files it can't clean! Am running backup s/w but have changed any options recently. Also it would have to be a real selective purge as I backup the entire drive system and am only having problems with 1 share. If there was a time stamp issue, what would it be related to and where do I look for it? Thanks.

by ronnonf

Have you checked out the idea that maybe the Directory Replication service is doing the deleting?

by wilsonb

This share isn't a replicated directory.

Am about to turn auditing on again and try to reproduce problem.

by jun1cez1

Since you said its on a shared folder before, its definitely that someone or some mouse happy fella keeps on deleting them on purpose, no doubt. you can prevent this again by sharing the folder again but put the files on an NTFS volume and share it with read only attribute to non-admin accounts. Then you can run audit on whose accessing the files. If some of them dissapeared again, then at least you know or have the idea that someone with an admin account plays with it.

by c. hilbrandt

Just as an FYI, We were running an application called Dustman, which went out looking for certain files older than a certain date and deleted them (which was how it was supposed to work). Somebody went and added the date into the directory name forrecords retention purposes (ie. stuff 10/16/2000). The software misinterpreted the / to be a special character and whacked the whole directory. Something kinda weird, but has any software of this type loaded or has your directory names recently changed??

by gregory w. smith

Also, I caught that you are using the folder for user profiles.

IF you store files in \\server\share\profile1 and you also store the user profile in \\server\share\profile1, every logoff will remove the files in favor of keeping a "clean" profile. I've seen this for subdirectories too.
\\server\share\profile1\word will be removed of emptied since the word folder is not part of the profile.

The fix would be to have \\server\share\username\profile and \\server\share\username\datadirectoryso you keep the profile seperate.

Basically the profile directory and its subfolders can ONLY be used for the profile.

by meng

Does the folder have MS Office products? We had something like this happend to one our folders, apparently the software was not installed correctly. You might check the files that keep on disappearing and see if they are related to some software. Ifthey are, then call the software and check it out with them.

Meng Hang, MCP

This discussion is closed to new replies.