Hello, You can track changes to files and folders through auditing object access and privledge events. Object access will tell you which user account accessed an object such as a file or folder and privledge events will give you information on changes made to permissions and which user made them. Auditing should be turned on in GP and then can be set at a more granular level (network shares, folders or individual files) by displaying the properties sheet for an object and then select the security tab => advanced => auditing tab. Audit events will be written to the Windows event log. Tip, just audit the objects that you really want to track. If you set auditing at too high a level such as on an entire drive your goning to have a lot of events to filter through to find the information your looking for. Note: Auditing must be enabled for you to track activity so unless you had it enabled previously, your not going to be able to track down the user who made the changes which already exist. Good luck!

Hello, You can track changes to files and folders through auditing object access and privledge events. Object access will tell you which user account accessed an object such as a file or folder and privledge events will give you information on changes made to permissions and which user made them. Auditing should be turned on in GP and then can be set at a more granular level (network shares, folders or individual files) by displaying the properties sheet for an object and then select the security tab => advanced => auditing tab. Audit events will be written to the Windows event log. Tip, just audit the objects that you really want to track. If you set auditing at too high a level such as on an entire drive your goning to have a lot of events to filter through to find the information your looking for. Note: Auditing must be enabled for you to track activity so unless you had it enabled previously, your not going to be able to track down the user who made the changes which already exist. Good luck!