Old Files Modified Dates Changing

[markikona]

Hi,

 

My client has a share on their SBS2008 server that they use to track work and to do this they sort by Modified date. Recently they have noticed a speight of random old files appearing at the top of the list with new modified dates. I cannot work out why. I know this is a vague description of whats going on but at this stage I'm still looking for clues as to why this is hapenning.

 

can anyone offer any clues or point me in the right direction?

 

Thanks

 

Mark

[ICTCity]

Do you have a backup system running? If this backup system works with A attribute (archive), so the file look modified.

[markikona]

Hi,

thanks for the reply, there is back up running which has been in place since day one. I had a suspicion that VSS was causing the problem so i turned that off but it has made no difference.

 

I can't see any scheduled tasks or events in the logs that are indicating why this is happening

[ICTCity]

VSS does not change date. But Backup can. What program are you using to backup? What type of backup are you using? Can you say that this happens only on backed-up folderds but not on "unsaved" folders?

[markikona]

We're using Tandberg RDX for backup. A file has apparently been modified at 14:40 today, backup was not running at this time. Do you know of a way that I can track who it was modified by. Its a PDF file.

 

The backup backs up the whole server, it's only being noticed in one share because of the way we work it is always sorted by modified date.

[ICTCity]

You can use this:

http://www.mp3vcr.com/sharemonitor/

 

But I'm not sure it will work on Server 2k8.

 

You can always enable auditing:

1. Go to Control Panel > Administrative Tools > Local Security Policy.

2. Security Settings > Local Policies > Audit Policy.

3. Audit object access and check the Success checkbox.

4. Select your folder, go to Security tab, click Advanced button, go to Auditing tab and click Add button. Enter EVERYONE as object name and click OK

 

Now select what you want.

 

Then, to discover WHO is modifying things, go to event viewer > security.

 

Pls, let me know who is the guilty :P