Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Someone created a file (web.config) in a location that basically caused IIS to not work. Is there any way I can determine who created this file?

The creator/owner says "Domain Administrators".

This is a Windows 2008 R2 server.

share|improve this question
    
fyi: this feature exists for Windows XP and 2003 but not R2 –  makerofthings7 Oct 4 '11 at 1:47

1 Answer 1

There's not a direct way to find out who exactly created the file on NTFS by hindsight. However, you might have a chance checking the event logs to determine who was logged in as an admin by that time. If you're lucky there was only one administrator present.

If you want to monitor such activities for certain directories from now on, there're various tools available. It can be done with process monitor for example, and if it's not a local account that is creating those files you can perform a lookup with netstat on the PID to get the IP of the user.

share|improve this answer
    
If NTFS doesn't log the username, does auditing? –  makerofthings7 Feb 14 '12 at 2:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.