Well, here's a very interesting item. We have our Update Packages created and
placed in the updateservicespackages, well, we have begun to notice the folders
disappearing. I turned on folder / file access audit / failure (local policy)
to capture what is occurring.
Great, security log archives with no issue. Started looking this morning and I
see 5145 Detailed File Share. Well, when I review the events I'm seeing this
access request information from the server. Ok, looks good. But in the
remaining search within 5145 (key word delete - no items show up). But when I
go to the folder on the server; that folder has disappeared, as if someone or
something has deleted it.
I've verified every scenario, but I'm just baffled.
Has anyone come across this before?
Subject:
Security ID: SYSTEM
Account Name: "SCCM Server Name"
Account Domain: "Domain"
Logon ID: 0x3E7
Network Information:
Object Type: File
Source Address: ::1
Source Port: 9371
Share Information:
Share Name: \\*\UpdateServicesPackages
Share Path:
\??\f:\updates\UpdateServicesPackages
Relative Target Name: windows 10_1511_10586
Access Request Information:
Access Mask: 0x100081
Accesses: SYNCHRONIZE
ReadData (or
ListDirectory)
ReadAttributes
Access Check Results:
SYNCHRONIZE: Granted by D:(A;OICI;FA;;;BA)
ReadData (or
ListDirectory): Granted by D:(A;OICI;FA;;;BA)
ReadAttributes:
Granted by D:(A;OICI;FA;;;BA)
Thomas Gonzalez
Windows Systems Engineer IV
[http://600a2794aa4ab5bae6bd-8d3014ab8e4d12d3346853d589a26319.r53.cf1.rackcdn.com/signatures/images/rackspace_logo.png]
[email protected]
phone: 210.312.4908
mobile: 210.332.8327
