you can gain SYSTEM privileges by scheduling cmd.exe as administrator. When the app starts it runs under SYSTEM. This was shown to me by MS support when I had some GPO stuff where one of my admins took to many righs away. When running cmd.exe scheduled, from there you can start mmc or any other app, that app will run under the same privileges. It allowed me to reset privileges on the GPO stuff and see them again on a normal MMC.
just my €.02 Wim -----Original Message----- From: Admin.mmm [mailto:[EMAIL PROTECTED] Sent: maandag 8 mei 2006 13:11 To: [EMAIL PROTECTED]; [EMAIL PROTECTED]; [email protected] Subject: RE: Tracking moved files? I vaguely remember something about a DLT system in w2k. It tracks the files for indexing purposes and creates a hidden log file. I dragged this off the MS site: "The DLT Client service monitors activity on NTFS volumes and stores maintenance information in a file called Tracking.log, which is located in a hidden folder called System Volume Information at the root of each volume. This folder is protected by permissions that allow only the system to have access to it. The folder is also used by other Windows services, such as Indexing Service." If you could log in as system you may glean something from there. J -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Monday, May 08, 2006 3:51 AM To: [EMAIL PROTECTED]; [email protected] Subject: Re: Tracking moved files? Did you check the recent items to look for a reference to the file on the thumb drive? All I could think of on a Sunday morning. Mike Mackrill -----Original Message----- From: Serge Jorgensen <[EMAIL PROTECTED]> To: [email protected] <[email protected]> Sent: Thu May 04 10:16:08 2006 Subject: Tracking moved files? Hello! I'm try to show that files were copied and/or moved off a W2K drive onto a USB stick. Obviously the registry and setupapi files show the USB installation info - but I can't find the log file (or other method?) that Windows must use to track files being moved and copied. I don't have the USB device - which would make this a whole lot easier. Any ideas would be great. Thanks. George
