Take the 2-minute tour ×  Hi I suspect a former employee of the
company I work for still have access to the servers, in fact I’m
sure he does. When he left the company in December he neglected
to remove his personal files from one of our servers. I
contacted him and made him aware of it. When I checked the
folders I saw that the files where no longer there.  Doing a
search on the hard-drives for files modified over that period
revealed that the folders have been modified by a user (it’s
just a string of numbers - not the domain\username as what it
normally looks like). I've send the number to our IT department,
and they just shrugged and said the user account that does not
exist. According to the date the folder was accessed by this
user account, it was some time in the evening, when I know
nobody else would’ve have been connected to that server.  This
all happened in the past 2 days. My question: where do I go to
get more info on this user account? Is there a log kept that
shows the user and what action was