Home

Original File Location

%3CLINGO-SUB%20id%3D%22lingo-sub-858474%22%20slang%3D%22en-US%22%3EOriginal%20File%20Location%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-858474%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Everyone%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20a%20user%20within%20the%20organisation%20that%20has%20moved%20a%20file%20from%20a%20folder%20to%20a%20newly%20created%20folder.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThey%20seem%20to%20have%20lost%20track%20of%20where%20they%20had%20originally%20transferred%20the%20file%20from%20(original%20folder%20location).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20there%20a%20way%20I%20could%20find%20out%20where%20the%20original%20file%20location%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-858474%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EManagement%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EStorage%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EWindows%20Server%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-859719%22%20slang%3D%22en-US%22%3ERe%3A%20Original%20File%20Location%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-859719%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F403129%22%20target%3D%22_blank%22%3E%40Dwayne05%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWindows%20Server%20can%20provide%20auditing%20on%20files%20and%20folders%20to%20track%20who%20has%20create%2Fmoved%2Fdeleted%20a%20file%20or%20folder%2C%20but%20this%20needs%20to%20be%20set%20up%20beforehand%20and%20can't%20be%20done%20after%20the%20fact.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20you%20have%20auditing%20enabled%20on%20your%20shares%2C%20then%20you%20need%20to%20check%20the%20event%20log%20for%26nbsp%3B%3CSPAN%3E4660%20and%204663%20IIRC.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EIf%20you%20don't%2C%20then%20I'm%20afraid%20I%20don't%20have%20any%20advice.%20There%20is%20a%20document%20at%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fgallery.technet.microsoft.com%2FHow-to-enable-File-and-af674be4%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgallery.technet.microsoft.com%2FHow-to-enable-File-and-af674be4%3C%2FA%3E%26nbsp%3Bthat%20has%20information%20on%20setting%20this%20up%20in%20future.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-863020%22%20slang%3D%22en-US%22%3ERe%3A%20Original%20File%20Location%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-863020%22%20slang%3D%22en-US%22%3E%3CP%3EHello%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F383653%22%20target%3D%22_blank%22%3E%40HidMov%3C%2FA%3E%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAuditing%20is%20one%20option%2C%20but%20you'll%20need%20to%20have%20Active%20Directory%20audit%20logging%20enabled%3CBR%20%2F%3E(%3CA%20href%3D%22https%3A%2F%2Fblogs.technet.microsoft.com%2Fcanitpro%2F2017%2F03%2F29%2Fstep-by-step-enabling-advanced-security-audit-policy-via-ds-access%2F%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EStep-By-Step%3A%20Enabling%20Advanced%20Security%20Audit%20Policy%20via%20DS%20Access%3C%2FA%3E)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOther%20methods%20are%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CUL%3E%3CLI%3EShadow%20Copies%20(Previous%20Versions)%2C%20but%20this%20also%20needs%20to%20be%20configured%20and%20enabled.%3C%2FLI%3E%3CLI%3EBackups%2C%20browse%20older%20backups%20and%20search%20for%20the%20moved%20folder%20and%20you%20should%20see%20where%20it%20was%20originally%20located.%3C%2FLI%3E%3C%2FUL%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBest%20regards%2C%3CBR%20%2F%3ELeon%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-867462%22%20slang%3D%22en-US%22%3ERe%3A%20Original%20File%20Location%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-867462%22%20slang%3D%22en-US%22%3EThanks%20for%20your%20response.%3CBR%20%2F%3E%3CBR%20%2F%3ESo%20would%20this%20give%20me%20some%20sort%20of%20a%20log%20of%20all%20objects%20modified%20and%20display%20it%20in%20event%20viewer%3F%3CBR%20%2F%3E%3CBR%20%2F%3EThanks%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-867466%22%20slang%3D%22en-US%22%3ERe%3A%20Original%20File%20Location%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-867466%22%20slang%3D%22en-US%22%3EThis%20is%20great%2C%20I%20am%20reading%20through%20the%20PDF.%20I'm%20going%20to%20take%20have%20a%20look%20at%20whether%20this%20has%20been%20set%20up.%3CBR%20%2F%3E%3CBR%20%2F%3EThanks%3C%2FLINGO-BODY%3E
Dwayne05
Occasional Contributor

Hi Everyone,

 

I have a user within the organisation that has moved a file from a folder to a newly created folder.

 

They seem to have lost track of where they had originally transferred the file from (original folder location).

 

Is there a way I could find out where the original file location?

 

Thanks

4 Replies

Hi @Dwayne05 

 

Windows Server can provide auditing on files and folders to track who has create/moved/deleted a file or folder, but this needs to be set up beforehand and can't be done after the fact. 

 

If you have auditing enabled on your shares, then you need to check the event log for 4660 and 4663 IIRC.

 

If you don't, then I'm afraid I don't have any advice. There is a document at https://gallery.technet.microsoft.com/How-to-enable-File-and-af674be4 that has information on setting this up in future.

Hello @HidMov,

 

Auditing is one option, but you'll need to have Active Directory audit logging enabled
(Step-By-Step: Enabling Advanced Security Audit Policy via DS Access)

 

Other methods are:

 

  • Shadow Copies (Previous Versions), but this also needs to be configured and enabled.
  • Backups, browse older backups and search for the moved folder and you should see where it was originally located.

 

Best regards,
Leon

Thanks for your response.

So would this give me some sort of a log of all objects modified and display it in event viewer?

Thanks
This is great, I am reading through the PDF. I'm going to take have a look at whether this has been set up.

Thanks
Related Conversations
Extentions Synchronization
Deleted in Discussions on
3 Replies
Tabs and Dark Mode
cjc2112 in Discussions on
35 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
29 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
9 Replies