very very weird....

LoLth

Perhaps I should post this on the paranormal board

OS: windows 2003 sbs
weird stuff on network: nothing. pretty standard.

User has a lot of files in protected folders going from A-Z. Only certain users have access to these folders and then, only certain sections of the list

eg: Bob can access sections a-e only , joe can access folder G only etc.

Only the administrator can access all of the folders.

Now, while on site and working happily on the server I happened to notice the server cpu usage jump. A quick ctrl-alt-del and task manager showed that a file move was taking place. Half the contents of G moved to folder S... two completely different sections of the file system. Apart from the fact that there were no users in the office and no remote logins at the time no-one apart from the admin has access to both the G and S folders.

anyone any idea why this would happen? I've been told that this is not the first time this has happened (and up to now I have been certain that it was user interference - accidental drag and drop) but having seen it, I can definitely say that they're right. The damn thing is haunted :eek:

ColmOT [MSFT]

script? scheduled tasks?

LoLth

brand new server installation (3 days old).

Only scripts set up or modified have been the user logon scripts.

Only scheduled tasks I can find are
1. mcafee AV update
2. MS SUS server

nothing else.

anyone know a decent monitoring tool so I can keep track of what services / scripts / tasks run at what time over say a week long period ?

Strange thing #2: the moved files do not show a current "modified" date.

ColmOT [MSFT]

You should enable auditing on the folders that move and their contents, leave it for a week or so, then check the logs.

LoLth

will do.

thanks.