To any server/domain admins

[Atreus21]

How do you tell if you've been hacked?

I run a domain controller and a terminal server with Server 03. I have a share drive set up for my department, which was occupied with about 10 or so gigs of reports/whatnot for my office. Now it's gone. Just plain gone.

About 5 people have full access to the folder, and they swear they haven't even modified it lately, much less deleted its contents entirely.

Is there anyway to detect a hacker other than simple intuition? I'm not worried about the data loss, which is recoverable, so much as a security vulnerability.

 

[imported_snikt]

Look into Windows auditing. to see who's accessing what files and directories.

 

[stash]

Might also be a good time to reset the passwords on all administrative accounts (domain admins, enterprise admins, etc).

 

[TheKub]

As Snikt has said auditing would help determine this, but it will not help you now as it has to be setup before the files were deleted, but if its setup correctly it will shed light on future occurrences.