Keeping track of who deleted and created files

I received a call on Monday at home from someone at work in a panic because an entire folder on our network drive was missing. I had to recover it from our backups of the previous evening. I thought we had already set it up so we could find out who deletes files and folders, but we didn’t. I finished setting it up yesterday and had to go to four different pages to really get all the info I needed.

From all the reading I did online for how to track this information there are a couple of ways to do it. You can do it in group policy or you can use the auditpol tool if running server 2008. Starting with Server 2008 they added audit categories which allow you to fine tune what you want to see in the event log. With Server 2003 you can only enable an entire class, which could cause a huge amount of useless information to be included. That would defeat the purpose of me wanting to set file auditing to begin with because I wouldn’t want to search through a massive amount of logs for a couple of events.

First, if you are running a server 2003 domain still (I cry a little inside about this being true for us) you’ll need to go into group policy and enable force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings. You can find that setting under computer configuration > policies > windows settings > security settings > local policies > security options.

I made the following changes on the file server directly since that’s the only one we care about. To audit when files and folders are deleted or created you want to enable success audits for the file system subcategory under the object access class. Here’s a list of all the classes and subcategories that I found helpful.  If you want to view all of the subcategories and their settings you can type auditpol /get /category:* into a command prompt. To enable this category use this in the command prompt auditpol /set /subcategory:”File System” /success:enable /failure:enable.

The last step is just like setting permissions on folders. Go to the folders you want to monitor, right-click on them and go to properties. Go to the security tab and then click the advanced button. Instead of using the permissions tab we’re using the auditing tab.  Click edit under this tab and add whatever group of users you want to monitor, in my case it was just the domain’s built-in users group since I want to what everybody does on our network share when they create and delete things. Then you can check the boxes for what actions you want to keep track of. In my case it was just the boxes for creating files, creating folders, delete subfolders and files, and delete.

Then you’re done. When you want to go back and check the event log on the file server you’ll see events under the file system category for the boxes you checked.

Next time someone deletes something they aren’t supposed to I can chase them down.


  1. Technet forum – Where is my : Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings
  2. Technet forum – auditing file share on windows 2008 R2
  3. Technet – Fine Tune Your Security Audit Policies
  4. Technet forum – how can track who deleted file/folder from Windows Server 2008
  5. Technet – Advanced Audit Policy Configuration descriptions

Leave a comment

GFI MailEssentials mail stuck in quarantine

I’ve had this problem more than a couple times now. I go into MailEssentials to take a look at the quarantined email, but when I try to approve something it just sits there and won’t go through. It’s been an easy fix every time. The first time it happened I had to contact support since I couldn’t find this problem in the knowledge base. I don’t like how they have it set up, I rarely seem to find the article I need. Then they’ll send me the link after I contact support and I feel like an idiot for not finding it myself.

Anyway, the first step is to go into services.msc and stop all of the GFI services. Once you’ve done that you want to find the config.mdb file in the antispam folder. In my setup there are two config.mdb files, one under Program Files\GFI\MailEssentials\Antispam and the other in Program Files\GFI\MailEssentials. I looked at the one with the most recent timestamp to figure out what I needed. Open it in Access, go to the database tools tab, then compact and repair database. I don’t know what keeps breaking my database but this has fixed it every time. It shrunk the size this time by about 200k and the web interface is a bit snappier as well.


Leave a comment

Ford sync playlists

It seems like almost every time I update my playlists I screw something up and they don’t work in my car. I use a 16GB flash drive and leave it plugged into my car all the time, unless I’m updating it of course. Apparently Ford’s sync system is pretty picky when it comes to the type of playlists it can read. I use MediaMonkey to manage my music and sync with my flash drive. I have a 2010 Ford Escape. I think it accepts a few different playlist types, but I use m3u. I put the playlist in the root of the device, not inside a folder. I leave every box unchecked except for relative paths. I just plugged it in to test it and it works. I was reading some forums and one of them did say that the version of MediaMonkey they were using broke the playlists. So in case that matters the version I’m on right now is



Leave a comment

Combining Outlook distribution lists

This really should be as easy and clicking a couple buttons, selecting the groups to merge and hitting OK. I can’t believe there isn’t a nice way within Outlook to do this. I have 7 distribution lists that I’m going to merge into probably 2 lists. We use this to send attachments so it’s nice to break it up and not clog up the server all at the same time, but we don’t need this broken up that much.

  1. What you want to do is open each group that you’re wanting to merge together and go to the file menu, then save as.
  2. On the save as type line make sure to select text only (*.txt) and remember where you save it. The text files will look something like this:textfile
  3. Delete the lines at the top so all you have in your text file are the names and email address. Do this for all the text files.
  4. This next part I find easier to do with excel. In Excel (2010) go to the Data tab and select from text. Select delimited and hit next. I only need to select tab because I’m wanting to remove the email address outside of the parentheses. If you select tab and space it will split them into 3 columns, which isn’t necessary. This way we can delete the entire column at once. Actually, after completing this I had some lists that were formatted differently so I had to play around a bit. As long as you get the duplicated email address in it’s own column that will work.
  5. Highlight column B where the duplication of the address is and delete it.
  6. Now this is where I’m sure there are multiple ways to do this, but I’m not an Excel expert so this is what I figured out. What we need to do next is add a semi-colon to the end of each line to separate the people. What you should have now is something like this:
  7. I used a formula to do this. In column B1 type =A1&”;” to get this:
  8. Now click and drag the corner of cell B1 down the column to add the semi-colon the the rest of the fields. There’s probably a macro that can do this, but I have no experience with them so this isn’t too bad. My lists aren’t that large.
  9. What I did next was copy the column with the added semi-colon and paste it into a new notepad file. I did this with all 7 of my groups. You can either just keep appending the one file or put them into multiple, user preference.
  10. Now go into Outlook and create a new contact group.
  11. Click on add members and choose either from outlook contacts or from address book, it gets you to the same place.
  12. Now instead of selecting people from the address book go to your notepad file, copy and paste all of those people separated by the semi-colon into the members box and hit OK.

If you’re only merging a couple groups you can probably just paste directly from Excel into the members box. I had 7 to do so it was easier for me to go through notepad first.

I found this info on another site so I’m definitely not taking credit for it. Just adding it to my little notebook since I know I’ll be needing it again at some point.




Leave a comment

Sansa e280 and m3u playlists

This has been bugging the hell out of me for awhile. I use MediaMonkey to organize my music and I love it. The only problem I had was that my mp3 player would not read m3u playlists as they were created from it. At some point I had obviously gotten it to work but it’s been so long since I’ve used my mp3 player that I forgot how to get my Sansa to see this type of list. So when I added my new music and tried to sync the playlist the player could not see it at all. I’ve read forum after forum reporting the same issue. Tonight I decided to take another look and within minutes found the solution that has managed to elude me recently. I’m posting it here because I’m sure at some point I’ll go another 6 months without using it and just forget again.

Pretty much all you do is let create your playlist in MediaMonkey, or whatever program you use, let it sync like you want. Then close the program, copy the playlist to your desktop, open it in notepad and add this line to the top of the list #EXTM3U. Then save and move it back over to your player. I had to put mine in the music folder, not on the root of the device. The odd thing is that I have no memory at all of doing this before. Maybe there’s another solution, but at least I made note of it this time.



Leave a comment

Facebook likes still showing in my newsfeed

This isn’t really a post like I normally put up. I’m just really annoyed with whatever changes Facebook has made that impact what shows up in your newsfeed. You know how you can click on that little box thing for each individual post and click unsubscribe from the person’s likes or comments? I still want to see people’s posts on my newsfeed, I just don’t care about most of the stuff they “like” or comment on.

For some reason I’ve noticed that in the last 2 or 3 weeks even though I’m not subscribed to people’s “likes” I’m now seeing things in my newsfeed about pages they like. Here’s what I’m talking about:

Now instead of showing up as a like it’s categorizing these as photos. This post happens to be from a family member, so I don’t want to have to unsubscribe from their photos. That doesn’t work anyway, even someone I completely unsubscribed from and put them on the list to never show up in my newsfeed still has posts like these that show up in my newsfeed.

I’m not one to whine every time something on Facebook changes, sure it’s annoying but I’ll get used to it. Nobody is forcing me to use Facebook so really I shouldn’t complain very much. But I would like it if things would work the way they’re supposed to. Maybe I’ll go back to using FacebookFixer, known as ffixer, to see if it will solve this problem. Although it hasn’t been updated since December, so I’m not sure if it will.



Excel – save worksheets as separate files

I have an excel file that has about 100 worksheets in it. It was actually an export of a bunch of information. I didn’t realize it would put it all into one huge excel file. I needed to save all the worksheets as their own files and definitely was not about to do this by hand. I found a forum where someone posted some visual basic code that would save the worksheets as their own files, with the worksheet names as their filenames, and save them in the same directory the original file is in – perfect.

Sub CreateNewWBS()
Dim wbThis As Workbook
Dim wbNew As Workbook
Dim ws As Worksheet
Dim strFilename As String

    Set wbThis = ThisWorkbook
    For Each ws In wbThis.Worksheets
        strFilename = wbThis.Path & "/" & ws.Name
        Set wbNew = ActiveWorkbook
        wbNew.SaveAs strFilename
    Next ws
End Sub

If you don’t know how to run the VBA code in excel here are the step by step instructions.

You need to have the developer tab enabled first. To do that go to file -> options -> customize ribbon -> in the right column under main tabs check the box for developer.

  1. Go to the developer tab and click on the visual basic button on the left side.
  2. Once the window opens go to the insert menu and select module.
  3. Paste the code you want to run and to run it immediately you can press F5. Boom, it worked perfectly for me, now I have 100 individual files.