URGENT: Win Server 03 AD user ?

Hello,

Many thanks in advance.

I am running Windows Server 2003 SE.

I went in and created a new user account. Everything works fine with that. User is able to logon, access files, and so forth. I made sure the new user had the same active directory settings as the original user.

The problem is the first user on the workstation was not able to logon. We solved that issue, but now some of their files are gone. I did not delete or alter anything on the orginial account.

How can I access these "lost" files. What did I do wrong? Let me know, if you need more information.

Remember this is my first time messing with the server side of things.

edit**

I also downloaded ADrestore.net. Nothing showed of a tombstone for that user.

Are you using roaming profiles, and/or mapping a network share? Any folder redirection?

As stated by westin the My Documents folder may replicate up to the server.

I would check on the server in the Users Shared Folders directory...username..My Documents.

MLF

No roaming profiles nor folder redirection. We have network shares. However, the files they are missing supposedly were saved on the workstation hd.

Would adding or removing groups possibly affect their ability to see the files?

Quote:

---

Originally Posted by kurt_der_koenig

Would adding or removing groups possibly affect their ability to see the files?

---

Maybe the ability to open them, but not see them. They would more likely get an 'Access Denied' message if it was a permissions issue. I don't mean to insult, but sometimes the simplest answer is the right one. Have you checked the Recycle Bin? Maybe the user threw the document out? Also run a search for the document on the system. If it was just created/modified recently, you can search by that as well, just in case the file was renamed/moved. It isn't often that files just up and disappear without some sort of user interaction! :)

Best of luck in your search.

Yeah....adding and removing groups where.

if it is on the harddrive it would be in the Users profile locally
C:\documents and settings

What OS is the workstation...
What kind of files are these..

Log onto the WS as Local administrator

MLF

Well, you do say "some of their files"...............? If it were an account, profile, ID or whatever problem then I would expect it to affect pretty much all of their work files?

Ideally they might know the name of one of the missing items and you can search for it..........chances are the rest will be there.

Drag and drop can be a real problem...........files accidentally moved into the wrong folder?

I think that MLF is on the money with using local admin account to search. Hopefully these files will be .doc, spreadsheets, databases and suchlike? If you just list all files of the appropriate extension the user might see where they have gone?

I agree with westin,

Quote:

---

It isn't often that files just up and disappear without some sort of user interaction! :)

---

To be honest with you, I don't like the idea of users storing anything important on a local drive when you have a network................they never back stuff up................:eek:

If these files really have been deleted you might try this:

http://www.piriform.com/recuva

Not sure what the rules for commercial use are but you should at least be able to get a fully functional trial? ;)

Thank you for everyone's help.

The user that had the issue was fired, so the issue is not as urgent as it was before.

I, however, would like to resolve the issue and know what to and what not do in the future.

I have checked the recycle bin, nothing was what the user said. I will check this again Monday. You do not have to worry about offending me. Sometimes I look overthings and I am new to this side of computers.

As far as the "user" swears, they are missing something. Nothing I bring up is what they "had" and they don't know what the filenames where. Only the probable extentsions. Maybe a possible hd corruption???

For all I know this user is inept. Its only been two weeks since I was slowly nudged into this. So I do not know what users had or did not have. I am still discovering what I have in front of me. Watch.... this user never "had" the missing files and this was "all" for waste. It was right in front of them!!! However, my boss expects me to "do something," even though he doesn't even know what is missing. Ugh... this company is a mess....

**End rant**

I will be experimenting with creating roaming profiles and redirection of their documents. Once I get a hang of it, I will migrate every workstation to this....

Thanks again...

One thing to remember is that users are liars....and they blame their incompetence on the computers...

I was duped many times when I first started many moons ago

Now I am just a cynical bitch and rarely believe anything they say.

By default many applications save to the My Documents folder...so it is best to have that replicate up to the server...and roaming profiles are good as long as they dont get too big.

MLF

Roaming profiles are ok, but are often more trouble than they are worth. I am in the process of doing away with them where I work. It seems we are always having permissions issues, etc. And yes, they can get huge. Also if you plan on migrating from XP to 7 any time soon, it is not a smooth transition because of the whole 'documents and settings' vs 'users', for placement of documents. Folder redirection is a better idea in my opinion, or just map their share to a network drive when they log in. You just have to train the user to save to the network drive, and not to the local hdd.

Hmmm,

Quote:

---

As far as the "user" swears, they are missing something. Nothing I bring up is what they "had" and they don't know what the filenames were. Only the probable extensions. Maybe a possible hd corruption???

---

So what are these files supposed to be? If they don't know what the filenames are, how in hell can they say that they are "missing"...........they wouldn't know what to look for would they?

If they are documents or spreadsheets there might be something in the header or content. If they can't tell you any of that then they are most likely bullshitting. Also try date last changed/created.

Have a look on your server............they might have saved it there by accident?

Try running Recuva............... if the files have really been deleted then you won't see them if they are not in the recycle bin.

I don't think it is HDD corruption. If the thing hasn't actually died you can generally see the filenames, even if you can't actually open them with normal applications.

You could try roadkil's "Unstoppable Copier". It will read the drive at a very low level and try to rebuild whatever files it can find, even if they are damaged, corrupted or the HDD is damaged (it's open source so no problems with a licence or full version ;)).

RECAP:

1. There is no way that anything you have done can make files disappear.
2. When a user takes it upon himself to save company information to his local HDD rather than to the corporate servers that are maintained and backed up for this purpose; they accept full responsibility and liability for its safekeeping.

I would be inclined to go with roadkil but warn the users that if you don't find anything it means the data "must have been deliberately and maliciously overwritten"..............and that is a felony offence :lildevil::xbones:

Unlike MLF, I don't think that users are inveterate liars............they are neither intelligent enough to get away with it nor stupid enough to try..........they just seem to be "very economical with the truth" :eek::D

I agree with westin...roaming profiles can be more trouble then its worth....all depends on your environment.

And nihil ...I am jaded...and may be suffering from IT burnout.

MLF

I feel for you on this one, been here a million times. Most of the time I find that when this happens it's a mapping somewhere and the user thinks that the file is stored locally. For example; They open MS Word and the path to open a file automatically goes to a default, working directory they are accustomed to working out of. One thing you can do is check another users account in Active Directory to see if there is a mapping set at Login to a personal share and try to track the files/directory down like that.....also check sub-folders in sub-folders and typical user error type things like that. Lastly, see if there is a directory under Documents and Settings with a "username.000" folder on the Workstation....this could be his original folder renamed. Good luck....

I am getting the "hang of it" with the end users and IT. Kinda like a cop. Everyone likes you when you do something for them, but willing to blame you when they are in the wrong. Etc. I can't tell you how many times I wanted to turn the keyboard into a baseball bat and have fun... Some people are pathetic. I take stuff too personal sometimes.

Listening to you guy's advice and doing some research, I did nothing to effect anything of that sort. This was all end users. Some one was just playing the blame game and I'm easy pluckings now. I've come to the conclusion that "these files" were deleted before I even touched the computer, etc.

After doing and experimenting with Roaming Profiles, I am staying away from such ideas. I am thinking of just redirecting their Documents and/ or having the files backed up through a start up batch file.

I have been backing everything I can think of that our users have control over. I am not going through even the idea that I might have done something wrong and "can't do anything about it again."

Thanks again for everyone's help and direction

Quote:

---

Unlike MLF, I don't think that users are inveterate liars............they are neither intelligent enough to get away with it nor stupid enough to try..........they just seem to be "very economical with the truth"

---

It appears that nihils UK users are much more savvy then my Canadian ones.

Lets see...for example today I had a boss type who is notorious for leaving applications open 24/7 and does not like to have to "re boot" the machine. Every so often...about once a month he calls me and complains that "things are acting funny" and dont work. My standard response is " have you restarted your machine lately?" and his response is "of course".

I then usually venture over to his office and see if I can help.

I open task manager and see the the machine has been running for about 531 hours...which in my estimation is approx 22.125 days. and I tell him that a restart should fix his issues...because the machine has been running 24/7 with several applications open for approx oh 3 weeks...and and some applications will continue to use up all the resources until they are restarted....sometimes the machine will require a restart also

and he tells me

"the computer is lying"

I didnt even know how to respond to that. I nodded my head and suggested he restart his machine to see if it would resolve the issue.

A day in the life of morganlefay

:(

MLF

Quote:

---

"the computer is lying"

---

:rofl:MAO

Errr..............it probably knows the difference between "hibernate" and "restart"..............????????????????

Oh! yeah, I forgot............if the screen goes black it has shut down right?:D

I have the cure for him............his new computer..............

Intel PII/266, 128Mb 72-pin EDO-RAM and it boots (or tries to) Windows Millennium............:lildevil:

It would wean him off his "re-boot phobia" because it would be an hourly event..................muhahahahahahahaha :brickwall

Quote:

---

A day in the life of morganlefay

---

My dear young lady, as the saying goes:

"It is hard to soar like an eagle when you have to work with turkeys"

:)

Quote:

---

Originally Posted by morganlefay

Lets see...for example today I had a boss type who is notorious for leaving applications open 24/7 and does not like to have to "re boot" the machine. Every so often...about once a month he calls me and complains that "things are acting funny" and dont work. My standard response is " have you restarted your machine lately?" and his response is "of course".

I then usually venture over to his office and see if I can help.

I open task manager and see the the machine has been running for about 531 hours...which in my estimation is approx 22.125 days. and I tell him that a restart should fix his issues...because the machine has been running 24/7 with several applications open for approx oh 3 weeks...and and some applications will continue to use up all the resources until they are restarted....sometimes the machine will require a restart also

and he tells me

"the computer is lying"

I didnt even know how to respond to that. I nodded my head and suggested he restart his machine to see if it would resolve the issue.

A day in the life of morganlefay

:(

MLF

---

Ah My Dear, Lovely B**ChSysAdmin

You seem to have lost focus. When this happens to a BastardSysAdmin or a B**ThSysAdmin I always suggest returning to basics:

Grab the shutdown.exe program out of the w2k (or above) resource kit. Copy it into the %systemroot%/system32 folder. In the same folder create a batch file named reboot.bat with the following

shutdown /L /R /Y /C

Now set an AT command to run the thing every day at midnight.

Now create a shortcut on your desktop pointing to \\stupidusercomputer\...\reboot.bat.

Name the shortcut Dumbass.

Next time the user calls, Don't just say it, double click it!

As always, and with Love...

Dino The Original Bastard!

I thought about something like that Dino.....

cept...he would whine about that too...all his apps would be closed...god forbid. I put up with a lot of crap from him

Its the whining that gets to me more then anything :(


MLF

MLF,


I bet you daren't ask him what his position on global warming and carbon footprints is?

:lildevil::lildevil::lildevil:

This might help, although it is certainly NOT the way to go IMO.Maybe just seeing the little icon with the diminishing resources will stir him up?

http://www.jfitz.com/RAMpage/

And this:

http://www.ccleaner.com/

At least you can tell him that's about the best that can be done, and that when they don't work anymore he will need to do a cold boot...............or perhaps he would like to boot Linux? :xbones:

Kurt, just to clarify ... in your original post you said the old user (the one now fired) was not able to log on ... but that you solved that..

How exactly did you solve that?

if my suspicion is correct I'll say what it is after your reply..

Quote:

---

Originally Posted by morganlefay

One thing to remember is that users are liars....and they blame their incompetence on the computers...

MLF

---

You are Dr House and I claim my 5 free years supply of Vicodin

Regards,

Steve