|I have a folder, 'test', which includes folders 'test1', 'test2', 'test3' and 'test4'. Somehow the folders 'test3' and 'test4' were moved one level up. there is security log enabled and audit in windows level. the action took place within a period of 9 minutes but it did not last more than 1 or 2 minutes due to the size of the files included in them. |
i need to find the event and figure out who performed the move in order to prevent it next time.
Generally, if i move or delete folders i get events 560 and 560. these events are not there for the period of time when the incident occurred.