Is there a way to find out who or when a system file was compressed using Disk Cleanup in Windows Server 2003? My team needs to prove that we didn't use the Compress Old System Files option in Disk Cleanup but as far as I know, there's no way to check that but I could be wrong.

NO WAY, I am afraid.

AFAIK, there is no way to audit that. So, I don't think that you will be able to find who or when a system file was compressed using Disk Cleanup in Windows Server 2003. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration

When a user needs write permissions to a file or folder to compress a folder so that may help you track it down unless everyone has write permissions. You can audit a folder/file for access by first enabling auditing of object access on the server and then auditing a folder. The problem is there is audit permission for compression though it may be recorded as a write permission. So there is no way to do that .http://www.virmansec.com/blogs/skhairuddin