F5F Stay Refreshed Hardware Desktop Unable to locate the method for identifying users who are generating numerous folders on a network drive.

Unable to locate the method for identifying users who are generating numerous folders on a network drive.

Unable to locate the method for identifying users who are generating numerous folders on a network drive.

D
70
08-21-2016, 03:56 PM
#1
I have a network drive that a bunch of users have access too, and there is a problem where hundreds of folders a week are being created with random alphanumerical names. I tried following the guide from a Microsoft doc for how to track it, but it didn't end up doing anything. I also tried a program called The Folder Spy on my local machine with different users, but it just said the user was always the user that was running the program. The network share is running on a Windows Server 2012 R2 & the clients are all running Windows 10. If anyone knows anything about how to track this that would be much appreciated. This has been going on for months & I do have access to the server as admin to run monitoring stuff.
D
darkshedow2000
08-21-2016, 03:56 PM #1

I have a network drive that a bunch of users have access too, and there is a problem where hundreds of folders a week are being created with random alphanumerical names. I tried following the guide from a Microsoft doc for how to track it, but it didn't end up doing anything. I also tried a program called The Folder Spy on my local machine with different users, but it just said the user was always the user that was running the program. The network share is running on a Windows Server 2012 R2 & the clients are all running Windows 10. If anyone knows anything about how to track this that would be much appreciated. This has been going on for months & I do have access to the server as admin to run monitoring stuff.

A
al77be
Junior Member
20
08-21-2016, 06:37 PM
#2
Are you connected to a specific domain? Are various computers employing distinct user accounts or utilizing a single account? If you can identify when this occurs, you can examine which computer has those files open on the network share.
A
al77be
08-21-2016, 06:37 PM #2

Are you connected to a specific domain? Are various computers employing distinct user accounts or utilizing a single account? If you can identify when this occurs, you can examine which computer has those files open on the network share.

N
NoHackJustRek
Member
65
08-23-2016, 01:34 AM
#3
It resides on a domain. Each user has their own distinct AD account. Although I can observe the current time, finding out which user is accessing it isn't straightforward. It's worth noting that the file server admin account always manages these files.
N
NoHackJustRek
08-23-2016, 01:34 AM #3

It resides on a domain. Each user has their own distinct AD account. Although I can observe the current time, finding out which user is accessing it isn't straightforward. It's worth noting that the file server admin account always manages these files.

G
GameBoosh
Senior Member
470
08-23-2016, 08:26 AM
#4
Turn off write permissions during the usual period, then observe who arrives and raises concerns first.
G
GameBoosh
08-23-2016, 08:26 AM #4

Turn off write permissions during the usual period, then observe who arrives and raises concerns first.

_
_ErikThePanda_
Posting Freak
807
08-23-2016, 09:22 AM
#5
Reach out to the team with admin privileges. They should form a small group for this task.
_
_ErikThePanda_
08-23-2016, 09:22 AM #5

Reach out to the team with admin privileges. They should form a small group for this task.

M
MCjeepers1009
Member
212
08-24-2016, 04:06 PM
#6
It could be software installed on the server itself instead of being sent from the network. Perhaps an index was created but settings were wrong, causing it to go into the shared folder.
M
MCjeepers1009
08-24-2016, 04:06 PM #6

It could be software installed on the server itself instead of being sent from the network. Perhaps an index was created but settings were wrong, causing it to go into the shared folder.

A
Amy467
Member
106
08-25-2016, 02:14 AM
#7
This is one of the main files servers people use, I would have at a minimum 50 people emailing the helpdesk, and I think it is a program creating these folders, like a install wizard, but good idea. I am in that team & am the one tasked with figuring out what is creating these folders
A
Amy467
08-25-2016, 02:14 AM #7

This is one of the main files servers people use, I would have at a minimum 50 people emailing the helpdesk, and I think it is a program creating these folders, like a install wizard, but good idea. I am in that team & am the one tasked with figuring out what is creating these folders

I
163
08-25-2016, 02:47 AM
#8
I considered it, but it doesn’t remove them. These servers are mostly empty except for the file share, Java, and SQL Server, with no Windows clutter. I also tried monitoring from another machine, but the user said it was done there, so it wasn’t that.
I
Irontaildragon
08-25-2016, 02:47 AM #8

I considered it, but it doesn’t remove them. These servers are mostly empty except for the file share, Java, and SQL Server, with no Windows clutter. I also tried monitoring from another machine, but the user said it was done there, so it wasn’t that.

J
Jakobkrax
Member
189
08-26-2016, 02:19 PM
#9
Yes, check the folder names for keywords or patterns that might indicate the software used to create them.
J
Jakobkrax
08-26-2016, 02:19 PM #9

Yes, check the folder names for keywords or patterns that might indicate the software used to create them.

R
Raze_FR
Member
200
09-09-2016, 02:55 AM
#10
I just searched for a few options, but didn't find any matches.
R
Raze_FR
09-09-2016, 02:55 AM #10

I just searched for a few options, but didn't find any matches.