nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

User name changed in 'modified by' column

punitrb

We have a situation where many files and folders in a branch (consisting of mostly HTML files) are showing the 'modified by' column with a single user name.
The user clearly says that he did not go in and modify any of those files/folders.
In fact the user doesn't use this branch but another one which has different content.

Few things
1. Files that have not been submitted to the Staging area are the only ones that shows this username in modified by column, other files that have been submitted to Staging show the real owners name in the column.
2. User has access to the the Y drive but denies going directly to the path or that workarea via Windows.
3. We checked TeamSite access logs, we don't see any event of user accessing the branch which has his name.
4. Checked the event viewer logs on the server, don't see any related events.

What else can we check to find out what could have triggered the change ?

Thanks

TS 6.7.1 SP1
Windows 2003
Clients:- Win XP Prof

Find more posts tagged with

Comments

Migrateduser

Sounds like they did a copy to and messed up. Or, a workflow or trigger has their username hard coded into it. If you can't find their username hard coded anywhere, then just give up and figure that they aren't telling you something.

Rick Poulin

You can check the iwevents.log, but it'll probably record that user's account as well. More than likely, you have a script or workflow task that was run as the user, and that script was the cause of all the modifications. If that's the case, your last_mod timestamps on the changes may be so close together that no human could have made the changes that fast (not a dead giveaway though, since the script could have operated on single files at different intervals).

punitrb

Thanks for the pointers. I did take a look at iwevents.log file, its not showing any event attached to that user for the affected branch.

The strange thing is that the modified dates of the files did not change(still showing dates when those file were initially created like some are 1-2 years old), that has not changed, its the modified by column and the owner of the file (in file properties) showing the user name.

Since these files have not been submitted to the Staging area they are all showing version 0+ after this change. If I try to undo the change it prompts that the file will be deleted as it has not been submitted yet.

This does appears to be a security change that propagated down to all the files that were not submitted to the Staging area. How that happened is still a question.

Thanks

nipper

There are a multitude of possibilities. And I have noticed the modified by is not always accurate.

I have seen processes (often owned by root) "touch" files with no rhyme or reason.

I have also seen workflows run an make an attribute modification of a certain file. User would not know about it but if the task ran as Andy, then it would show up being modified by Andy.

Migrateduser

I had one user who drug a folder to another folder (by accident), then moved them back. It put his name on all the files.

punitrb

I had one user who drug a folder to another folder (by accident), then moved them back. It put his name on all the files.

Hmm.. interesting. Were you able to see any associated events with this activity in the Windows event viewer ?

Thanks

Migrateduser

Hmm.. interesting. Were you able to see any associated events with this activity in the Windows event viewer ?

Thanks

I just tried it myself again and nothing is logged, probably because the moves took place on the filesystem.

Adam Stoller

Among the things I've seen on Windows like this it is usually one of the following:

In most cases, this would tend to leave the files owned as 'SYSTEM" - or possibly with the last owner preserved but the file marked as modified.Given the nature of the issue (0+ files modified) - it sounds more like issues 1-3 and not 4 (though you should verify that too)

ACheethayil

We had a similar issue and the modified Name was "SYSTEM" instead of a particular user. We found out the culprit and it was workflow(one of the tasks).

Thirumala

Anyone come across thru solution for this issue? Pls share..

We are also having same sisue as mentioned in the beginning of this post. i.e., shows particular user name who never touched those files.. ANY HELP/RESPONSE is greatly appreciated.

Rick Poulin

Something could have triggered a script running on behalf of that user and making changes through the Y: drive..? That's assuming that you've gone through the same diagnostics as the OP, but really this thread is super old so if you need additional help, I suggest creating a new thread with details specific to your situation.

Thirumala

Thanks for your valuable time and response. We hav eour TeamSite on Unix(Solaris10).
I manage that server and as per my knwoledge, we didn't executed any scripts except some grep/find commands to find list of files and find attributes to look for particular user who left the organization..