content: Yeah this is great. This is good outside the box thinking that tells me you are an employed, reliable IT Person. I have a small tweak; "Do_Not_Edit.doc" "_Backup_keys.doc" And in that file, have some legit keys/unames for a honeypot server and have the ip address of that honeypot in there as well. Any time someone sees that file you know they are going to hit that honeypot, and you get a secondary alert from a system they might already have compromised. If they got into your server, before they start changing files they probably would already have disabled or neutered your administrative tools and jobs that would have triggered an alarm. Maybe not though, and even if they did, this provides you a great EWS if you have other checks in place. Your example would pair really well with a disaster recovery plan as well. When you do your monthly backup-restore test [people should do that!] you can have a script that automatically checks those keys out.