Sep 17 2019 03:44 AM
Hi Everyone,
I have a user within the organisation that has moved a file from a folder to a newly created folder.
They seem to have lost track of where they had originally transferred the file from (original folder location).
Is there a way I could find out where the original file location?
Thanks
Sep 17 2019 12:17 PM
Hi @Dwayne05
Windows Server can provide auditing on files and folders to track who has create/moved/deleted a file or folder, but this needs to be set up beforehand and can't be done after the fact.
If you have auditing enabled on your shares, then you need to check the event log for 4660 and 4663 IIRC.
If you don't, then I'm afraid I don't have any advice. There is a document at https://gallery.technet.microsoft.com/How-to-enable-File-and-af674be4 that has information on setting this up in future.
Sep 19 2019 04:52 AM
Hello @HidMov,
Auditing is one option, but you'll need to have Active Directory audit logging enabled
(Step-By-Step: Enabling Advanced Security Audit Policy via DS Access)
Other methods are:
Best regards,
Leon
Sep 20 2019 08:35 AM
Sep 20 2019 08:37 AM