Re: [ActiveDir] Who keeps creating this folder files?!
No,I'm gettingthem, but lately it seems that messages are taking an inordinate amount of time to go through. We have R2 on some of our file servers... unfortunately, this one doesn't have it. I think that - for the time being - I will remove the files and turn on auditing for the folders that these files keep reappearing in... I do appreciate all the suggestions and help: thanks! - Original Message - From: Laura A. Robinson To: ActiveDir@mail.activedir.org Sent: Thursday, October 05, 2006 4:47 PM Subject: RE: [ActiveDir] Who keeps creating this folder files?! Okay, this is now my third time recommending FSRM in response to this query; are my replies not getting through to the list? *Seriously*, just address the issueby using FSRM and not allowing .mp3 files to be saved on the server in the first place. If anybody complains, you'll have your culprit, to boot. :-) If the link is needed again, please let me know. Laura From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of J BSent: Thursday, October 05, 2006 4:58 PMTo: ActiveDir@mail.activedir.orgSubject: Re: [ActiveDir] Who keeps creating this folder files?! I was hoping that there was some way to see who created it rather than wait until it happened again, or wait until someone accessed it... I'll have to settle for the auditing though. Thanks! - Original Message - From: Brian Desmond To: ActiveDir@mail.activedir.org Sent: Thursday, October 05, 2006 11:14 AM Subject: RE: [ActiveDir] Who keeps creating this folder files?! Set some auditing on the folder that this is happening in and watch the security log for the relevant audits Thanks, Brian Desmond [EMAIL PROTECTED] c - 312.731.3132 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of J BSent: Thursday, October 05, 2006 12:57 PMTo: ActiveDir@mail.activedir.orgSubject: [ActiveDir] Who keeps creating this folder files?! Argh! On one of our file servers, there is a "public" directory that allows any authenticated user to do anything within it (minus changing permissions). MP3 files and folders appear there every so often and are removed soon thereafter. Is there some way for me to tell who has created these folders and MP3 files? Every time I check, no one is currently accessing the files - which would be an easy way for me to know...
RE: [ActiveDir] Who keeps creating this folder files?!
Set some auditing on the folder that this is happening in and watch the security log for the relevant audits Thanks, Brian Desmond [EMAIL PROTECTED] c - 312.731.3132 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of J B Sent: Thursday, October 05, 2006 12:57 PM To: ActiveDir@mail.activedir.org Subject: [ActiveDir] Who keeps creating this folder files?! Argh! On one of our file servers, there is a public directory that allows any authenticated user to do anything within it (minus changing permissions). MP3 files and folders appear there every so often and are removed soon thereafter. Is there some way for me to tell who has created these folders and MP3 files? Every time I check, no one is currently accessing the files - which would be an easy way for me to know...
RE: [ActiveDir] Who keeps creating this folder files?!
Drop filemon on the box with a filter for mp3 and just let it stay running in a disconnected ts window would probably be one method. Kurt Falde From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of J B Sent: Thursday, October 05, 2006 12:57 PM To: ActiveDir@mail.activedir.org Subject: [ActiveDir] Who keeps creating this folder files?! Argh! On one of our file servers, there is a public directory that allows any authenticated user to do anything within it (minus changing permissions). MP3 files and folders appear there every so often and are removed soon thereafter. Is there some way for me to tell who has created these folders and MP3 files? Every time I check, no one is currently accessing the files - which would be an easy way for me to know...
Re: [ActiveDir] Who keeps creating this folder files?!
Audit the folder. J B wrote: Argh! On one of our file servers, there is a "public" directory that allows any authenticated user to do anything within it (minus changing permissions). MP3 files and folders appear there every so often and are removed soon thereafter. Is there some way for me to tell who has created these folders and MP3 files? Every time I check, no one is currently accessing the files - which would be an easy way for me to know...
RE: [ActiveDir] Who keeps creating this folder files?!
Try this http://www.watchdirectory.net/wdhelp/plugins/wdopAuditInfo.html From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of J B Sent: Thursday, October 05, 2006 12:57 PM To: ActiveDir@mail.activedir.org Subject: [ActiveDir] Who keeps creating this folder files?! Argh! On one of our file servers, there is a public directory that allows any authenticated user to do anything within it (minus changing permissions). MP3 files and folders appear there every so often and are removed soon thereafter. Is there some way for me to tell who has created these folders and MP3 files? Every time I check, no one is currently accessing the files - which would be an easy way for me to know...
RE: [ActiveDir] Who keeps creating this folder files?!
Won't the ownership show up under the Security tab? From: [EMAIL PROTECTED] on behalf of J B Sent: Thu 10/5/2006 9:57 AM To: ActiveDir@mail.activedir.org Subject: [ActiveDir] Who keeps creating this folder files?! Argh! On one of our file servers, there is a public directory that allows any authenticated user to do anything within it (minus changing permissions). MP3 files and folders appear there every so often and are removed soon thereafter. Is there some way for me to tell who has created these folders and MP3 files? Every time I check, no one is currently accessing the files - which would be an easy way for me to know... winmail.dat
RE: [ActiveDir] Who keeps creating this folder files?!
1. Check the owner of the files 2. You may want to look at FSRMin Win2K3 R2; it allows you to restrict creation of files based on type, among other things. http://www.microsoft.com/windowsserver2003/R2/storage/default.mspx Laura From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of J BSent: Thursday, October 05, 2006 12:57 PMTo: ActiveDir@mail.activedir.orgSubject: [ActiveDir] Who keeps creating this folder files?! Argh! On one of our file servers, there is a "public" directory that allows any authenticated user to do anything within it (minus changing permissions). MP3 files and folders appear there every so often and are removed soon thereafter. Is there some way for me to tell who has created these folders and MP3 files? Every time I check, no one is currently accessing the files - which would be an easy way for me to know...
Re: [ActiveDir] Who keeps creating this folder files?!
I forgot tomention that we run an "rsync" on this directory that overwrites the file owner's name with the user under which this process runs... - Original Message - From: J B To: ActiveDir@mail.activedir.org Sent: Thursday, October 05, 2006 9:57 AM Subject: [ActiveDir] Who keeps creating this folder files?! Argh! On one of our file servers, there is a "public" directory that allows any authenticated user to do anything within it (minus changing permissions). MP3 files and folders appear there every so often and are removed soon thereafter. Is there some way for me to tell who has created these folders and MP3 files? Every time I check, no one is currently accessing the files - which would be an easy way for me to know...
Re: [ActiveDir] Who keeps creating this folder files?
Turn on security auditing.On 10/5/06, J B [EMAIL PROTECTED] wrote: Argh! On one of our file servers, there is a public directory that allows any authenticated user to do anything within it (minus changing permissions). MP3 files and folders appear there every so often and are removed soon thereafter. Is there some way for me to tell who has created these folders and MP3 files? Every time I check, no one is currently accessing the files - which would be an easy way for me to know...
RE: [ActiveDir] Who keeps creating this folder files?!
Install R2 and filter MP3s. ;) Thanks, Anthony Scott From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kurt Falde Sent: Thursday, October 05, 2006 2:19 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] Who keeps creating this folder files?! Drop filemon on the box with a filter for mp3 and just let it stay running in a disconnected ts window would probably be one method. Kurt Falde From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of J B Sent: Thursday, October 05, 2006 12:57 PM To: ActiveDir@mail.activedir.org Subject: [ActiveDir] Who keeps creating this folder files?! Argh! On one of our file servers, there is a public directory that allows any authenticated user to do anything within it (minus changing permissions). MP3 files and folders appear there every so often and are removed soon thereafter. Is there some way for me to tell who has created these folders and MP3 files? Every time I check, no one is currently accessing the files - which would be an easy way for me to know...
Re: [ActiveDir] Who keeps creating this folder files?!
I was hoping that there was some way to see who created it rather than wait until it happened again, or wait until someone accessed it... I'll have to settle for the auditing though. Thanks! - Original Message - From: Brian Desmond To: ActiveDir@mail.activedir.org Sent: Thursday, October 05, 2006 11:14 AM Subject: RE: [ActiveDir] Who keeps creating this folder files?! Set some auditing on the folder that this is happening in and watch the security log for the relevant audits Thanks, Brian Desmond [EMAIL PROTECTED] c - 312.731.3132 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of J BSent: Thursday, October 05, 2006 12:57 PMTo: ActiveDir@mail.activedir.orgSubject: [ActiveDir] Who keeps creating this folder files?! Argh! On one of our file servers, there is a "public" directory that allows any authenticated user to do anything within it (minus changing permissions). MP3 files and folders appear there every so often and are removed soon thereafter. Is there some way for me to tell who has created these folders and MP3 files? Every time I check, no one is currently accessing the files - which would be an easy way for me to know...
RE: [ActiveDir] Who keeps creating this folder files?!
Try FileNotify freeware at http://www.xtware.com/ Mike Thommes From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kurt Falde Sent: Thursday, October 05, 2006 1:19 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] Who keeps creating this folder files?! Drop filemon on the box with a filter for mp3 and just let it stay running in a disconnected ts window would probably be one method. Kurt Falde From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of J B Sent: Thursday, October 05, 2006 12:57 PM To: ActiveDir@mail.activedir.org Subject: [ActiveDir] Who keeps creating this folder files?! Argh! On one of our file servers, there is a public directory that allows any authenticated user to do anything within it (minus changing permissions). MP3 files and folders appear there every so often and are removed soon thereafter. Is there some way for me to tell who has created these folders and MP3 files? Every time I check, no one is currently accessing the files - which would be an easy way for me to know...
RE: [ActiveDir] Who keeps creating this folder files?!
Okay, then I'd recommend item #2 in my last response- rather than spending a bunch of time trying to figure out who's doing it (which could be multiple people), why not just prevent it in the first place? :-) Laura From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of J BSent: Thursday, October 05, 2006 4:13 PMTo: ActiveDir@mail.activedir.orgSubject: Re: [ActiveDir] Who keeps creating this folder files?! I forgot tomention that we run an "rsync" on this directory that overwrites the file owner's name with the user under which this process runs... - Original Message - From: J B To: ActiveDir@mail.activedir.org Sent: Thursday, October 05, 2006 9:57 AM Subject: [ActiveDir] Who keeps creating this folder files?! Argh! On one of our file servers, there is a "public" directory that allows any authenticated user to do anything within it (minus changing permissions). MP3 files and folders appear there every so often and are removed soon thereafter. Is there some way for me to tell who has created these folders and MP3 files? Every time I check, no one is currently accessing the files - which would be an easy way for me to know...
RE: [ActiveDir] Who keeps creating this folder files?!
Okay, this is now my third time recommending FSRM in response to this query; are my replies not getting through to the list? *Seriously*, just address the issueby using FSRM and not allowing .mp3 files to be saved on the server in the first place. If anybody complains, you'll have your culprit, to boot. :-) If the link is needed again, please let me know. Laura From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of J BSent: Thursday, October 05, 2006 4:58 PMTo: ActiveDir@mail.activedir.orgSubject: Re: [ActiveDir] Who keeps creating this folder files?! I was hoping that there was some way to see who created it rather than wait until it happened again, or wait until someone accessed it... I'll have to settle for the auditing though. Thanks! - Original Message - From: Brian Desmond To: ActiveDir@mail.activedir.org Sent: Thursday, October 05, 2006 11:14 AM Subject: RE: [ActiveDir] Who keeps creating this folder files?! Set some auditing on the folder that this is happening in and watch the security log for the relevant audits Thanks, Brian Desmond [EMAIL PROTECTED] c - 312.731.3132 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of J BSent: Thursday, October 05, 2006 12:57 PMTo: ActiveDir@mail.activedir.orgSubject: [ActiveDir] Who keeps creating this folder files?! Argh! On one of our file servers, there is a "public" directory that allows any authenticated user to do anything within it (minus changing permissions). MP3 files and folders appear there every so often and are removed soon thereafter. Is there some way for me to tell who has created these folders and MP3 files? Every time I check, no one is currently accessing the files - which would be an easy way for me to know...
Re: [ActiveDir] Who keeps creating this folder files?
Magic 8 ball?Security event logs are great things, learning how to search them for the right data can be invaluable and increase the security at your company drastically. It will mean that instead of saying Who did this?, you will know who did it. Instead of going When did that happen?, you'll know when it happened. Unfortunately, you end up having to almost export your event logs to another location to make them searchable on active systems. The only bad part is that, once you get the data, you find yourself sitting there going Oh, that script did it... or worse - I did it?! or something similar. 95% of the time something where you're going Oh yeah, I'm gonna get them this time, you realize that there isn't anyone to get. After a little while you'll stop expecting to 'get them' this time and go OK, what do I need to fix this time and kinda dread the idea of it being someone doing something wrong and hope it's just something that you can fix in 10 minutes because it someone did something wrong, then you have to spend 2-4 hours in meetings discussing why they did it, how they did it, how to avoid it happening again, etc On 10/5/06, J B [EMAIL PROTECTED] wrote: I was hoping that there was some way to see who created it rather than wait until it happened again, or wait until someone accessed it... I'll have to settle for the auditing though. Thanks! - Original Message - From: Brian Desmond To: ActiveDir@mail.activedir.org Sent: Thursday, October 05, 2006 11:14 AM Subject: RE: [ActiveDir] Who keeps creating this folder files?! Set some auditing on the folder that this is happening in and watch the security log for the relevant audits… Thanks, Brian Desmond [EMAIL PROTECTED] c - 312.731.3132 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of J BSent: Thursday, October 05, 2006 12:57 PMTo: ActiveDir@mail.activedir.org Subject: [ActiveDir] Who keeps creating this folder files?! Argh! On one of our file servers, there is a public directory that allows any authenticated user to do anything within it (minus changing permissions). MP3 files and folders appear there every so often and are removed soon thereafter. Is there some way for me to tell who has created these folders and MP3 files? Every time I check, no one is currently accessing the files - which would be an easy way for me to know...
