I have a client with a Windows Server 2019, all updates taken. Approximately 35 Windows 10 workstations, Office365. Last Wednesday my client reported to me that several Word docs were missing from a particular folder. Was told a user may have deleted them. We have redundant backup (onsite-Synology and cloud-CrashPlan) in addition to Volume Shadow Copy turned on. Not thinking anything was odd since TrendMicro Business Services had nothing detected in logs, I copied the missing files from Shadow Copy (Monday 12PM copy, missing from Tuesday 7AM copy). On Thursday, client then tells me that there are Word docs missing from other folders. These Word Docs are 4 different ones that are used for all of their customer data files found in this type of structure F:CasesCustomerName…
These missing docs were originally created with a template and they are copied and modified as needed to each F:CasesCustomerName folder.
Don’t want to confuse and hope I’m explaining the issue. To troubleshoot, I have run full virus scan on the server and all of the workstations with Trend Micro, and Norton Power Eraser on several workstations.
It looks like these files were moved or deleted between 07/[email protected] and 07/[email protected] and can’t figure out what or how has caused this. I have turned on Auditing and selected Deleted Files on the server so I can see if there are any deleted files going forward that have been deleted unintentionally.
Looking for suggestions and what else I can try so I can identify what has caused this (macro virus?) issue and minimize the likelihood of it continueing or repeating. Thank you.
Edited by JLondon999, Today, 06:36 PM.