Windows Server 2003: Can I do this stuff? Track who changed/deleted files, "snapshots" to a NAS

[BrunoPuntzJones]

Running a server wif Windows Server 2003. Nothing fancy, mostly a file server, and has a few SQL processes running.

I'd like to be able to track who made changes or deleted files. There a way to do this? I know users shouldn't be allowed to do everything, but they need to be able to move and delete files once they are moved to another program.

I get too many "Hey what happened to "x" files? And someone accidentally deleted them but didn't tell me (or didn't notice). Would be nice if I could go back and see just who deleted those files.

I currently have a NAS and have to copy files. Is there a way to do shadowing and say "Snapshot these directories, and store them on the NAS"? Our server is only 73GB (half used), and local shadowing will take up too much room no?

Another question is what is the most effective way to do off-site backup? I am tired of tapes, and our drive is crapping out (2 year old PowerVault). Would be nice if I could backup the changed files each night and send them to an external drive at my house. Maybe run a tape once a week rather than daily.

Probably some noobish questions, but more stuff seems to be "vanishing" these days and would like to pinpoint who is causing it...and want a faster way to restore it than using tapes, ug.

 

[stash]

I'd like to be able to track who made changes or deleted files. There a way to do this? I know users shouldn't be allowed to do everything, but they need to be able to move and delete files once they are moved to another program.

You can do this with object access logging. You can set auditing on a file or folder.

Is there a way to do shadowing and say "Snapshot these directories, and store them on the NAS"?

Volume shadow copies are per volume. So you turn it on for an entire volume, and it snapshots everything on that volume. You can't just tell it to snapshot one directory on that volume. Not sure if you can put the snapshots on the NAS. You can store snapshots on any NTFS partition, but I'm not sure if that will work with mapped drive. If the NAS is directly attached and shows up as just another NTFS partition, it should work fine.

 

[RebateMonger]

Not much I can add to STaSh's answer.

Volume Shadow Copy is certainly a good way to recover accidentally deleted files, if you don't wait TOO long and the deleted files are still available. Shadow copy is pretty efficient. It only records CHANGES in files, so the space goes a long way.

And, yeah, object access auditing will let you see who did what to the files. Be careful, though. Check your event logs and make sure that you don't make a mistake and audit things you don't intend to audit. You could end up with HUGE event logs.

I use sets of external USB hard drives for backups at some clients, particularly those with huge data needs and not much money. At larger clients, I alternate four USB drives on a weekly basis. Two drives are always kept offsite, and two kept onsite. If you also have a tape drive, that'd be great for making periodic archival backups (kept forever and stored offsite), or as a "backup" to the hard drive backups. The more backups you have, the better....especially if some are on tape and some are on hard drives.

 

[stash]

You could end up with HUGE event logs

Yep, which 1) makes the logs pretty much useless because of the sheer amount of data being generated and 2) will cause a significant performance hit.

 

[Smilin]

To add a bit more to a so far well answered post:

It is possible to put your snapshots from one volume on to a different volume. On a heavily loaded drive this is desireable. You can not do the same to a volume on a NAS. The volume you are storing snapshots on must appear to be local. You can do it with a SAN for instance or possibly NAS if it supports iSCSI.

Be aware that the snapshots are not just some duplicate of a folder structure. The snapshot data will be in more of a database format and not easily read if the original volume is lost.

 

[BrunoPuntzJones]

I was wanting to move it to a NAS because of space concerns. Had about 15GB left on a 55GB partition. I did some cleaning and got rid of a bunch of stuff that I archived to another drive and tape, and now have 30GB free. So no worries about VSS now. The snapshot runs at lunch and at the end of the day, and there aren't huge changes so they don't take long or take much overhead.

I tried doing the auditing but there is just too much it is giving me. When someone goes to open a Word doc, Word creates those temporary files in case it crashes. Well as soon as someone is done, it deletes that temporary file. Well it shows up as a deleted item in the audit trail. Not really a big deal, I can probably set up better traps, but I know who is most likely to accidentially make a mistake. Having VSS going will make it a lot easier than going through several tapes.

Now to just figure out how to keep a backup offsite that I can do over the Internet. Back up the changes to a drive at my house, rather than to a tape (but run a tape once a week or so).

Thanks a lot guys, very helpful

 

[Tsaico]

Agree with the auditing to find out who deleted or access what. Depending on size of organization though, this can generate a huge log, so in order to keep a decent history, you may want to increase the size of the event log.

In any case, you can store a shadow copy to any NTFS volume. The only thing you need to keep in mind, is the impact of generating these shadow copies. If you have a large number of users doing large amounts of data trasnfer and then hit the server to make a copy, the drives can be severely impacted. This can be compounded since the drive is generally the bottleneck, and if the copy is moving only as fast as a NIC, it is even slower. It can be helped if you schedule the shodow copy service to perform it's thing at off hours, but that is up to you. Locally is just usually the fastest, least performance impacting setup.


Aslo, a side note: keep in mind is shadow copies are not meant to be a back up or archival solution. It is a quick restore point, that is all. It provides a way to recover files in a folder, so it will not truly revert a disk to an earlier point in time.

As for offsite, that one is dependant on your network speed and internet connection. I would vote against it, since most likely your home connection, and if you are trying to back up even just a few gigs it can take forever. I would stick with tapes or on site in a different room NAS for back up and archiving. Not to mention, the down time waiting for the files to come back over the net can be a real pain too. You can use off site for archiving, and an old machine with lots of HD space for on the fly back up and restore.

 

[BrunoPuntzJones]

I'm aware of the limitations on VSS, and don't have it as a backup. Just a handy thing for when someone deletes something I'll be able to get back to it right then, rather than have to mount a tape, wait for it to find the right tape, copy the file back, etc. when I can just right click on a previous instance and restore it.

Just don't like having to deal with tapes. Gotta be something better for off-site storage. And don't wanna lug around a bunch of notebook hard drives.