I'm trying to figure out a few pieces of information about the status of my computer after a 2 week period of accidental read / write file sharing. Here's the list:
1. I want to figure out if there's a log function to show when Password Protected Sharing was enabled or disabled.
2. I need to know who on my network has accessed, modified, or viewed files on my pc (I wasn't running any log programs nor did I have auditing enabled on any folders).
3. I want to know if any files were created on my computer by other network users.
I might think of more later, if I do I'll edit the list.
Backstory: A few months ago my old PC died and I bought a brand new one. I salvaged one of the hard drives from the old PC and put it into the new one, for the purpose of backing up the info and having a second hard drive. Some of the original folders were from a My Documents folder on a Win XP install, so transferring onto a Windows 7 Professional install was kind of a pain. After some messing around with the sharing settings and "admin access" type of settings in the permissions tab, I was able to back up my files.
Here's the actual problem: I guess during the above described process, I somehow ended up setting a few REALLY sensitive folders as "network shared", despite never using a network to transfer any of this. I guess I clicked something wrong under the permissions tab, or sharing tab or something. Anyway, this isn't a complete list, but I know these folders were shared:
C:\Windows (and all subfolders)
C:\Users (my documents, desktop, etc)
So. Back to my list of stuff I'm trying to figure out. Firstly, the Password Protection. It's possible that I disabled this in a misguided attempt at forcing the computer to stop prompting me for a login every time I moved a folder...but I don't remember turning it off. Is there a way to see if and when I had it off? Because, correct me if I'm wrong, but literally all of my paranoia and this entire problem would be a moot point if Password Protection HAD been enabled; Anyone would need a password to edit, create, or open files regardless of whether or not I had my files set to full read/write access, correct?
I'd really appreciate some help here.
Edited by Larry55, 19 May 2012 - 05:06 PM.