Può essere utile monitorare delle cartelle del server condivise per capire chi effettua delle modifiche e cosa fa. Copio ed incollo alcune info trovate sul web:
"Group policy enable auditing Computer Configuration - Windows Settings - Security Settings - Local Policy -Audit Policy - Audit Object Access - Enable and then you go to the folder you're interested in auditing and enable Auditing on certain events like Delete and Delete subfolders and files. If it hasn't been done previously you can't find any trace of who or when.
And I strongly advise you to use Volume Shadow Copy snapshots; personally I use the feature to make 2 snapshots/day and I never lost a file."
