Who moved my folder?

Windows Explorer is notorious for the “quick and easy” way that files and folders can be moved from one part of the disk drive to another (or even to a different drive – from the network to a user’s desktop, for example). Cut and paste, also known as “click and move” in this case, can create frantic calls to the helpdesk (“my spreadsheet folder disappeared!”), as well as frantic scrambling by the IT department (“I know the LOGIN directory was here when I left last night!”). Computer savvy IT personnel are less prone to doing this than others, but it still afflicts them from time to time.

When it happens, the first thing you need to do, of course, is get the files and folders returned to where they belong, restore any trustee rights that have “disappeared” and then find out who did the deed so they can be re-educated.

The first thing to do when someone reports a folder missing is to check to see if you can salvage the files from “deleted directories.” If the files aren’t there then it’s likely they weren’t deleted but simply moved. Next, search the volume the folder was on and then the other volumes for one of the files that have “gone missing.” Try for one with a unique file name so there’s less confusion. Before moving it back to its rightful place, though, you may be able to discover who the culprit was.

John Baird (creator of the aptly named John Baird Utilities – https://www.jrbsoftware.com/) has found that, at least in NetWare 6’s Novell Storage Services (NSS) volumes, there is a field called updator for folder entries.

Baird reports that, “Some tests reveal the updator field is updated when a change is made in a directory. So, if vol1:usersrandy was moved into vol1:userssandy (i.e. it becomes vol1:userssandyrandy), the updator field for vol1:userssandy would hold the culprit’s name.”

He follows this with a warning, though: “However, that information might be short-lived as any other change in vol1:userssandy would further update the updator field.”

Installing auditing (through the AUDITCON utility) is a better way to permanently capture this information but if you haven’t installed auditing Baird’s quick and dirty discovery method could work for you.

Of course it would be even better if the folder and its files could be prevented from moving. You can do this by making the folder Read Only (RO) but if it’s not possible to make it RO for every user (i.e., people need to update the files) then there’s no absolute way to prevent the occurrence of folder moves. You can make it harder, though.

Novell’s Shaun Pond explains that to keep users from accidentally moving folders, “The simplest way that I’ve found is to change the number of pixels that the mouse must move with the button clicked for Explorer to recognize it as a drag.”

There are two Windows Registry entries that control this: HKEY_CURRENT_USERControl PanelDesktopDragHeight and HKEY_CURRENT_USERControl PanelDesktopDragWidth.

According to Pond, “The default for both values is 2. If you increase these to, say 15, then the user has to hold down the mouse button and drag the item for quite a way before Explorer will move it. Not perfect, but it has stopped almost all accidental moves for us.”

Problem solved at no cost to your organization. Don’t you wish everything was that easy?