Who created this folder?

Question

_{Tuesday, January 29, 2019 4:22 PM}

Hello, 

This is my first TechNet post, so please excuse me if this is in the wrong forum. I work in a school district. A student created a folder under one of the shares with...let's just say it has a very inappropriate name. I tried right-clicking and looking under the Security tab in Properties, but that does not tell me who created the folder.

Is there a way to determine who originally created a shared folder on a file server? The students have their own AD accounts.

All replies (3)

_{Tuesday, January 29, 2019 4:29 PM ✅Answered | 1 vote}

Hello!

You would need to enable audit logging to be able to reveal who created the shared folder on your file server.

With audit logging enabled, you can view for events like creating, deleting, accessing folders/shares.

Below is some more information about auditing file shares:

/en-us/windows/security/threat-protection/auditing/audit-file-share

Once audit logging is enabled, you can view these audit events in the Security log of your Domain Controller (DC).

The Event ID you want to look for in this case is event ID 5142 (a network share object was added).

Best regards,
Leon

Blog: https://thesystemcenterblog.com LinkedIn:

_{Tuesday, January 29, 2019 4:50 PM}

I forwarded this to our district's systems admin. I appreciate your quick reply and the level of detail.

_{Wednesday, January 30, 2019 2:08 AM}

Hi,

Thanks for your pst in our forum.

I am glad to know the issue has been resolved.

If you have any questions or requirements, please feel free to contact us.

Thanks again for your understanding and support.

Best Regards,

Otto 

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].