Hi, I am using samba-3.4.6 file server on centos-5.8 under winbind authentication with SMBLDAP domain server. Last day I found one of file was missing from a folder, after checking smbaudit log I came to know that file got deleted by a user (abc) that don't have read & write permission on that path. I checked with user (abc) login physically on his system but user (abc) are unable to modify/delete/create any file at that path. As per my past experience I got smbaudit log correct every time but not sure with this case. File was missed, smbaudit logged the event but that user (abc) don't have write permission on that folder. Could you please advise the possible reason for this event? Thanks and regards, Shekhar