Some PDFs saved to a network folder disappear by the following day. The server audit log attributes the deletion to the same user account and laptop that created the files, even though the user was not accessing them at the recorded time. The event shows PID 4 (System), suggesting the deletion may have been performed by a system service rather than an interactive application.
Only PDFs are affected; Excel files in the same folder remain untouched, and not every PDF disappears. The client is a Windows 10 company laptop running Kaspersky and 天锐绿盾, a DLP/document-encryption product. The files are created in Excel through File → Export → Create PDF/XPS Document, with the standard publishing option and "Open file after publishing" enabled, while the destination is a network folder.
What could cause Windows or security software to delete a file under the user's network credentials when the user is not working with it? Could the DLP or antivirus software quarantine, replace, or remove PDFs created through Excel's Publish-to-PDF workflow? Has anyone encountered a similar pattern involving only Office-generated PDFs, one network folder, and delayed deletion?
3 Answers
Start by correlating the server event with client-side telemetry. Process Monitor or Sysmon can show which process opened, renamed, replaced, or deleted the file, while the security product’s own logs may show a quarantine or policy action. PID 4 in the server audit record may only identify the SMB/system handling layer, not the actual user-mode process that initiated the operation. Testing the same workflow on a machine without the DLP agent would also help isolate the cause.
Also investigate Windows Offline Files, synchronization, and any folder-management jobs on the laptop or server. A sync conflict or cleanup task could restore an older directory state or remove files while still appearing under the user’s credentials. Since the delay is roughly a day and only some files are affected, compare file timestamps, SMB audit events, scheduled tasks, synchronization status, and server-side retention or cleanup policies rather than assuming Excel itself is deleting them.
Antivirus or DLP software is a plausible explanation, especially since the problem is limited to PDFs and occurs in a particular location. Some products inspect newly created documents, temporarily replace them during scanning, or quarantine files after a delayed analysis. Check both Kaspersky and 天锐绿盾 logs, including quarantine and policy-event history, around the time the files disappear. If possible, create the same PDFs locally and copy them to the share, then compare that with publishing directly to the share.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures