Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Someone created a file (web.config) in a location that basically caused IIS to not work. Is there any way I can determine who created this file?

The creator/owner says "Domain Administrators".

This is a Windows 2008 R2 server.

share|improve this question
fyi: this feature exists for Windows XP and 2003 but not R2 – LamonteCristo Oct 4 '11 at 1:47

There's not a direct way to find out who exactly created the file on NTFS by hindsight. However, you might have a chance checking the event logs to determine who was logged in as an admin by that time. If you're lucky there was only one administrator present.

If you want to monitor such activities for certain directories from now on, there're various tools available. It can be done with process monitor for example, and if it's not a local account that is creating those files you can perform a lookup with netstat on the PID to get the IP of the user.

share|improve this answer
If NTFS doesn't log the username, does auditing? – LamonteCristo Feb 14 '12 at 2:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.