Hi Thanks for the reply. Just guessing at svchost. The log only shows 29 Jul 2013 11:56:15 PM, "Computer: servername", "Monitor Title: Watch C:\watch\", C: \ watch\", "Description: The following activities have occurred: Op: Deleted File: C:\watch\filename.doc C: \ watch \ filename.doc User: domainname\username domainname \ username Source: 254.128.0.0 [254.128.0.0] App: System or Network " User says she was tucked up in bed so I have forced a password reset and virus scan on all accounts/pc's. Thanks

Hi Thanks for the reply. Just guessing at svchost. The log only shows 29 Jul 2013 11:56:15 PM, "Computer: servername", "Monitor Title: Watch C:\watch\", "Description: The following activities have occurred: Op: Deleted File: C:\watch\filename.doc User: domainname\username Source: 254.128.0.0 [254.128.0.0] App: System or Network " User says she was tucked up in bed so I have forced a password reset and virus scan on all accounts/pc's. Thanks