Share via

Server 2016 deletes user files without input

smarternoss 1 Reputation point
2020-11-30T09:58:01.987+00:00

Hello everyone,

I'm facing an issue on a share server in our company which is running server 2016, the users noticed some files are getting removed from shares, after setting up auditing I see that the system account itself removes those files as shown in the screenshot :

Hidden info :

Account name : HOSTNAME$

DOMAIN : Irrelevant

Object Name : A path to a random file in a shared folder.

43596-image.png

Windows for business Windows Server User experience Other
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Thameur-BOURBITA 36,261 Reputation points Moderator
    2020-12-01T00:39:37.747+00:00

    Hi,

    It seems that the process wmiprvse.exe is responsible of this deletion. You can disable this service but it can impact another services and application installed on this server. Try to test and check if you still have the same behavior when you disable this service :

    43882-image.png

    Please don't forget to mark this reply as answer if it help you to fix your issue

  2. Vicky Wang 2,736 Reputation points
    2020-12-07T07:10:14.347+00:00

    Hi,

    Just checking in to see if the information provided was helpful.

    Please let us know if you would like further assistance.

    Best Regards,

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.