Boot.ini on Windows Server 2003 R2

view story

http://serverfault.com – I have a Windows Server 2003 R2 with 48 GB of RAM; server has been running strong for quite some time. Recently our boot.ini was modified causing issues, most likely by our remote administrators. Now the server is only showing 14 GB of RAM. This has caused major performance issues for our end users. Our remote administrators have stated "we don't change the boot.ini settings(switches)". However, I know for a fact that all of the local administrators have not modified the switches (due to lack of permissions). The real question.. Is it possible to "audit" who has modified the boot.ini? If th (HowTos)