Someone created a file (web.config) in a location that basically caused IIS to not work. Is there any way I can determine who created this file?

The creator/owner says "Domain Administrators".

This is a Windows 2008 R2 server.


There's not a direct way to find out who exactly created the file on NTFS by hindsight. However, you might have a chance checking the event logs to determine who was logged in as an admin by that time. If you're lucky there was only one administrator present.

If you want to monitor such activities for certain directories from now on, there're various tools available. It can be done with process monitor for example, and if it's not a local account that is creating those files you can perform a lookup with netstat on the PID to get the IP of the user.

| improve this answer | |
  • If NTFS doesn't log the username, does auditing? – goodguys_activate Feb 14 '12 at 2:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.