Why Are Excel-Exported PDFs Being Deleted from a Network Share?
Asked by
MellowPine42
Some PDFs saved to a network folder disappear by the following day. The server audit log attributes the deletion to the same user account and laptop that created the files, even though the user was not accessing them at the recorded time. The event shows PID 4 (System), suggesting the deletion may have been performed by a system service rather than an interactive application.
Only PDFs are affected; Excel files in the same folder remain untouched, and not every PDF disappears. The client is a Windows 10 company laptop running Kaspersky and ๅคฉ้็ปฟ็พ, a DLP/document-encryption product. The files are created in Excel through File โ Export โ Create PDF/XPS Document, with the standard publishing option and "Open file after publishing" enabled, while the destination is a network folder.
What could cause Windows or security software to delete a file under the user's network credentials when the user is not working with it? Could the DLP or antivirus software quarantine, replace, or remove PDFs created through Excel's Publish-to-PDF workflow? Has anyone encountered a similar pattern involving only Office-generated PDFs, one network folder, and delayed deletion?
Answers
Antivirus or DLP software is a plausible explanation, especially since the problem is limited to PDFs and occurs in a particular location. Some products inspect newly created documents, temporarily replace them during scanning, or quarantine files after a delayed analysis. Check both Kaspersky and ๅคฉ้็ปฟ็พ logs, including quarantine and policy-event history, around the time the files disappear. If possible, create the same PDFs locally and copy them to the share, then compare that with publishing directly to the share.
Reply to this answer
Also investigate Windows Offline Files, synchronization, and any folder-management jobs on the laptop or server. A sync conflict or cleanup task could restore an older directory state or remove files while still appearing under the userโs credentials. Since the delay is roughly a day and only some files are affected, compare file timestamps, SMB audit events, scheduled tasks, synchronization status, and server-side retention or cleanup policies rather than assuming Excel itself is deleting them.
Reply to this answer
Start by correlating the server event with client-side telemetry. Process Monitor or Sysmon can show which process opened, renamed, replaced, or deleted the file, while the security productโs own logs may show a quarantine or policy action. PID 4 in the server audit record may only identify the SMB/system handling layer, not the actual user-mode process that initiated the operation. Testing the same workflow on a machine without the DLP agent would also help isolate the cause.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions