Everybody denied access to a folder

  • Thread starter Thread starter Joris Dobbelsteen
  • Start date Start date
J

Joris Dobbelsteen

Dear,

I have a problem with a single folder/directory on my system: it cannot be
accessed any more in any way.
The issue resulted from making the folder part of the DFS, so replication
would work automatically.

Anyways the result is:
* Administrator cannot access it (nor enumerate anything of it)
* Local System cannot access it (nor enumerate anything of it).
* Restore using backup tool cannot access it (or overwrite it).
* Chkdsk indicates the disk is OK, no problems at all.

I cannot look into the folder.
I cannot take ownership
In fact, its just there and its impossible to do anything with it.

A note aside: I do no believe it inherits permissions from its parent, so
that is not a solution too.

Since its a production system I hope to find a good solution without taking
down the server (which is rather time-consuming, taking at least one hour
down-time). Of course, if its required than that will be the only way.

Anyone has a last resort?
Which settings must be configured?
Is the recovery console an options (with what settings)?

Thanks,

- Joris
 
What happens when you try to take ownership as an administrator? Is the
administrators group listed as being a potential owner? If you have not
tried to yet see if you can view and set permissions with a command line
utility. The built in cacls should list permissions [as in example below]and
allow you to change but be careful with the syntax if you are not used to
using cacls. Xcalcs.vbs can show permissions and owner and assign
nership. --- Steve

http://support.microsoft.com/?id=825751 --- Xcals.vbs info

D:\WINDOWS\system32>cacls "d:\documents and settings"
d:\Documents and Settings BUILTIN\Administrators:(OI)(CI)F
BUILTIN\Power Users:(OI)(CI)R
NT AUTHORITY\SYSTEM:(OI)(CI)F
BUILTIN\Users:(OI)(CI)R
 
Sorry to disappoint you, but unfortunally this hasn't worked out.

Viewing permissions yields "Access Denied"

Taking ownership simply doesn't work, again access is denied. Even though
the Administrator has "Take ownership" group policy set by the domain. I've
tried xcacls too, including some tool somewhere called chown (developed for
Windows by someone).

--- output on command line ---
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

U:\>e:

E:\>cd "My Documents"

E:\My Documents>dir
Volume in drive E is User
Volume Serial Number is 6854-AFA9

Directory of E:\My Documents

18-06-2006 18:46 <DIR> .
18-06-2006 18:46 <DIR> ..
[snip]
18-06-2006 20:17 <DIR> Joris
0 File(s) 0 bytes
4 Dir(s) 63,031,801,856 bytes free

E:\My Documents>xcacls joris
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

Starting XCACLS.VBS (Version: 5.2) Script at 20-6-2006 14:15:29

Startup directory:
"E:\My Documents"

Arguments Used:
Filename = "joris"


Error: File/Directory "E:\My Documents\Joris" not found.


Operation Complete
Elapsed Time: 0.2617188 seconds.

Ending Script at 20-6-2006 14:15:29



E:\My Documents>cacls joris
E:\My Documents\Joris
Access is denied.

E:\My Documents>
--------------------------

--- Taking ownership ---
E:\My Documents>xcacls joris /o Joris2k\Administrator
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

Starting XCACLS.VBS (Version: 5.2) Script at 20-6-2006 14:18:15

Startup directory:
"E:\My Documents"

Arguments Used:
Filename = "joris"
/O (Change Ownership)
Joris2k\Administrator


Error: File/Directory "E:\My Documents\Joris" not found.


Operation Complete
Elapsed Time: 0.8984375 seconds.

Ending Script at 20-6-2006 14:18:16
--------------------------

....

- Joris

Steven L Umbach said:
What happens when you try to take ownership as an administrator? Is the
administrators group listed as being a potential owner? If you have not
tried to yet see if you can view and set permissions with a command line
utility. The built in cacls should list permissions [as in example below]and
allow you to change but be careful with the syntax if you are not used to
using cacls. Xcalcs.vbs can show permissions and owner and assign
nership. --- Steve

http://support.microsoft.com/?id=825751 --- Xcals.vbs info

D:\WINDOWS\system32>cacls "d:\documents and settings"
d:\Documents and Settings BUILTIN\Administrators:(OI)(CI)F
BUILTIN\Power Users:(OI)(CI)R
NT AUTHORITY\SYSTEM:(OI)(CI)F
BUILTIN\Users:(OI)(CI)R


Joris Dobbelsteen said:
Dear,

I have a problem with a single folder/directory on my system: it cannot be
accessed any more in any way.
The issue resulted from making the folder part of the DFS, so replication
would work automatically.

Anyways the result is:
* Administrator cannot access it (nor enumerate anything of it)
* Local System cannot access it (nor enumerate anything of it).
* Restore using backup tool cannot access it (or overwrite it).
* Chkdsk indicates the disk is OK, no problems at all.

I cannot look into the folder.
I cannot take ownership
In fact, its just there and its impossible to do anything with it.

A note aside: I do no believe it inherits permissions from its parent, so
that is not a solution too.

Since its a production system I hope to find a good solution without
taking
down the server (which is rather time-consuming, taking at least one hour
down-time). Of course, if its required than that will be the only way.

Anyone has a last resort?
Which settings must be configured?
Is the recovery console an options (with what settings)?

Thanks,

- Joris
Click to expand...
Click to expand...
 
My thoughts are:

How likely is it that the Recovery Console can solve this problem?
From what I read I don't expect too much?

Might a other application (Distributed file system) have it locked?
Can I see this anywhere?

What settings are needed to enforce the Admin can always take ownership,
regardless of any other configuration? Where are such settings located (the
system is a domain controller, by the way).

- Joris

Joris Dobbelsteen said:
Sorry to disappoint you, but unfortunally this hasn't worked out.

Viewing permissions yields "Access Denied"

Taking ownership simply doesn't work, again access is denied. Even though
the Administrator has "Take ownership" group policy set by the domain. I've
tried xcacls too, including some tool somewhere called chown (developed for
Windows by someone).

--- output on command line ---
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

U:\>e:

E:\>cd "My Documents"

E:\My Documents>dir
Volume in drive E is User
Volume Serial Number is 6854-AFA9

Directory of E:\My Documents

18-06-2006 18:46 <DIR> .
18-06-2006 18:46 <DIR> ..
[snip]
18-06-2006 20:17 <DIR> Joris
0 File(s) 0 bytes
4 Dir(s) 63,031,801,856 bytes free

E:\My Documents>xcacls joris
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

Starting XCACLS.VBS (Version: 5.2) Script at 20-6-2006 14:15:29

Startup directory:
"E:\My Documents"

Arguments Used:
Filename = "joris"


Error: File/Directory "E:\My Documents\Joris" not found.


Operation Complete
Elapsed Time: 0.2617188 seconds.

Ending Script at 20-6-2006 14:15:29



E:\My Documents>cacls joris
E:\My Documents\Joris
Access is denied.

E:\My Documents>
--------------------------

--- Taking ownership ---
E:\My Documents>xcacls joris /o Joris2k\Administrator
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

Starting XCACLS.VBS (Version: 5.2) Script at 20-6-2006 14:18:15

Startup directory:
"E:\My Documents"

Arguments Used:
Filename = "joris"
/O (Change Ownership)
Joris2k\Administrator


Error: File/Directory "E:\My Documents\Joris" not found.


Operation Complete
Elapsed Time: 0.8984375 seconds.

Ending Script at 20-6-2006 14:18:16
--------------------------

...

- Joris

Steven L Umbach said:
What happens when you try to take ownership as an administrator? Is the
administrators group listed as being a potential owner? If you have not
tried to yet see if you can view and set permissions with a command line
utility. The built in cacls should list permissions [as in example below]and
allow you to change but be careful with the syntax if you are not used to
using cacls. Xcalcs.vbs can show permissions and owner and assign
nership. --- Steve

http://support.microsoft.com/?id=825751 --- Xcals.vbs info

D:\WINDOWS\system32>cacls "d:\documents and settings"
d:\Documents and Settings BUILTIN\Administrators:(OI)(CI)F
BUILTIN\Power Users:(OI)(CI)R
NT AUTHORITY\SYSTEM:(OI)(CI)F
BUILTIN\Users:(OI)(CI)R


Joris Dobbelsteen said:
Dear,

I have a problem with a single folder/directory on my system: it
Click to expand...
Click to expand...
cannot
be
Click to expand...
Click to expand...
 
Well that does not sound good. There is another tool that may be worth a
shot called fileacl and using the /force option which requires that the
administrator have backup and restore user right which is the case by
default. I would use whoami /priv while logged onto that computer just to
verify that you have the necessary privileges and also check the logs via
Event Viewer to see if anything is reported at the time of the access
failures. It may also be worth trying in Safe Mode. Subinacl may also be
worth a try to view permissions and take ownership. Sometimes it helps to
open a command window as system to use utilities that do not otherwise work.
You can use the AT command to do that. Use AT to open cmd.exe specifying a
short time in the future such as current time plus two minutes as in AT
22:02 /interactive cmd.exe. --- Steve

http://www.gbordier.com/gbtools/fileacl.htm --- fileacl
http://www.microsoft.com/downloads/...56-d8fe-4a91-93cf-ed6985e3927b&displaylang=en
-- subinacl

Joris Dobbelsteen said:
Sorry to disappoint you, but unfortunally this hasn't worked out.

Viewing permissions yields "Access Denied"

Taking ownership simply doesn't work, again access is denied. Even though
the Administrator has "Take ownership" group policy set by the domain.
I've
tried xcacls too, including some tool somewhere called chown (developed
for
Windows by someone).

--- output on command line ---
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

U:\>e:

E:\>cd "My Documents"

E:\My Documents>dir
Volume in drive E is User
Volume Serial Number is 6854-AFA9

Directory of E:\My Documents

18-06-2006 18:46 <DIR> .
18-06-2006 18:46 <DIR> ..
[snip]
18-06-2006 20:17 <DIR> Joris
0 File(s) 0 bytes
4 Dir(s) 63,031,801,856 bytes free

E:\My Documents>xcacls joris
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

Starting XCACLS.VBS (Version: 5.2) Script at 20-6-2006 14:15:29

Startup directory:
"E:\My Documents"

Arguments Used:
Filename = "joris"


Error: File/Directory "E:\My Documents\Joris" not found.


Operation Complete
Elapsed Time: 0.2617188 seconds.

Ending Script at 20-6-2006 14:15:29



E:\My Documents>cacls joris
E:\My Documents\Joris
Access is denied.

E:\My Documents>
--------------------------

--- Taking ownership ---
E:\My Documents>xcacls joris /o Joris2k\Administrator
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

Starting XCACLS.VBS (Version: 5.2) Script at 20-6-2006 14:18:15

Startup directory:
"E:\My Documents"

Arguments Used:
Filename = "joris"
/O (Change Ownership)
Joris2k\Administrator


Error: File/Directory "E:\My Documents\Joris" not found.


Operation Complete
Elapsed Time: 0.8984375 seconds.

Ending Script at 20-6-2006 14:18:16
--------------------------

...

- Joris

Steven L Umbach said:
What happens when you try to take ownership as an administrator? Is the
administrators group listed as being a potential owner? If you have not
tried to yet see if you can view and set permissions with a command line
utility. The built in cacls should list permissions [as in example below]and
allow you to change but be careful with the syntax if you are not used to
using cacls. Xcalcs.vbs can show permissions and owner and assign
nership. --- Steve

http://support.microsoft.com/?id=825751 --- Xcals.vbs info

D:\WINDOWS\system32>cacls "d:\documents and settings"
d:\Documents and Settings BUILTIN\Administrators:(OI)(CI)F
BUILTIN\Power Users:(OI)(CI)R
NT AUTHORITY\SYSTEM:(OI)(CI)F
BUILTIN\Users:(OI)(CI)R


Joris Dobbelsteen said:
Dear,

I have a problem with a single folder/directory on my system: it cannot be
accessed any more in any way.
The issue resulted from making the folder part of the DFS, so replication
would work automatically.

Anyways the result is:
* Administrator cannot access it (nor enumerate anything of it)
* Local System cannot access it (nor enumerate anything of it).
* Restore using backup tool cannot access it (or overwrite it).
* Chkdsk indicates the disk is OK, no problems at all.

I cannot look into the folder.
I cannot take ownership
In fact, its just there and its impossible to do anything with it.

A note aside: I do no believe it inherits permissions from its parent, so
that is not a solution too.

Since its a production system I hope to find a good solution without
taking
down the server (which is rather time-consuming, taking at least one hour
down-time). Of course, if its required than that will be the only way.

Anyone has a last resort?
Which settings must be configured?
Is the recovery console an options (with what settings)?

Thanks,

- Joris
Click to expand...
Click to expand...
Click to expand...
 
The good I fixed it finally.

The solution:
to be honest, be just as stupid as with any other Windows problem:
Reboot the d**m thing, then see if its still a problem.

The folder is empty (I have automated backups of important data, learned it
several times before the hard way), but thats not a problem.

I'm still not sure if this is a good indication of the reliability of the
Windows system...

The good is that it works and I've seen some useful tools that I did not
know off (or had). I'm thus still looking for something to observe
associations within the system (such as open files).

Thanks for you suggestions on the issue.

- Joris

Steven L Umbach said:
Well that does not sound good. There is another tool that may be worth a
shot called fileacl and using the /force option which requires that the
administrator have backup and restore user right which is the case by
default. I would use whoami /priv while logged onto that computer just to
verify that you have the necessary privileges and also check the logs via
Event Viewer to see if anything is reported at the time of the access
failures. It may also be worth trying in Safe Mode. Subinacl may also be
worth a try to view permissions and take ownership. Sometimes it helps to
open a command window as system to use utilities that do not otherwise work.
You can use the AT command to do that. Use AT to open cmd.exe specifying a
short time in the future such as current time plus two minutes as in AT
22:02 /interactive cmd.exe. --- Steve

http://www.gbordier.com/gbtools/fileacl.htm --- fileacl
http://www.microsoft.com/downloads/...56-d8fe-4a91-93cf-ed6985e3927b&displaylang=en
-- subinacl

Joris Dobbelsteen said:
Sorry to disappoint you, but unfortunally this hasn't worked out.

Viewing permissions yields "Access Denied"

Taking ownership simply doesn't work, again access is denied. Even though
the Administrator has "Take ownership" group policy set by the domain.
I've
tried xcacls too, including some tool somewhere called chown (developed
for
Windows by someone).

--- output on command line ---
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

U:\>e:

E:\>cd "My Documents"

E:\My Documents>dir
Volume in drive E is User
Volume Serial Number is 6854-AFA9

Directory of E:\My Documents

18-06-2006 18:46 <DIR> .
18-06-2006 18:46 <DIR> ..
[snip]
18-06-2006 20:17 <DIR> Joris
0 File(s) 0 bytes
4 Dir(s) 63,031,801,856 bytes free

E:\My Documents>xcacls joris
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

Starting XCACLS.VBS (Version: 5.2) Script at 20-6-2006 14:15:29

Startup directory:
"E:\My Documents"

Arguments Used:
Filename = "joris"


Error: File/Directory "E:\My Documents\Joris" not found.


Operation Complete
Elapsed Time: 0.2617188 seconds.

Ending Script at 20-6-2006 14:15:29



E:\My Documents>cacls joris
E:\My Documents\Joris
Access is denied.

E:\My Documents>
--------------------------

--- Taking ownership ---
E:\My Documents>xcacls joris /o Joris2k\Administrator
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

Starting XCACLS.VBS (Version: 5.2) Script at 20-6-2006 14:18:15

Startup directory:
"E:\My Documents"

Arguments Used:
Filename = "joris"
/O (Change Ownership)
Joris2k\Administrator


Error: File/Directory "E:\My Documents\Joris" not found.


Operation Complete
Elapsed Time: 0.8984375 seconds.

Ending Script at 20-6-2006 14:18:16
--------------------------

...

- Joris

Steven L Umbach said:
What happens when you try to take ownership as an administrator? Is the
administrators group listed as being a potential owner? If you have not
tried to yet see if you can view and set permissions with a command line
utility. The built in cacls should list permissions [as in example below]and
allow you to change but be careful with the syntax if you are not used to
using cacls. Xcalcs.vbs can show permissions and owner and assign
nership. --- Steve

http://support.microsoft.com/?id=825751 --- Xcals.vbs info

D:\WINDOWS\system32>cacls "d:\documents and settings"
d:\Documents and Settings BUILTIN\Administrators:(OI)(CI)F
BUILTIN\Power Users:(OI)(CI)R
NT AUTHORITY\SYSTEM:(OI)(CI)F
BUILTIN\Users:(OI)(CI)R


Dear,

I have a problem with a single folder/directory on my system: it
Click to expand...
cannot
be
accessed any more in any way.
The issue resulted from making the folder part of the DFS, so replication
would work automatically.

Anyways the result is:
* Administrator cannot access it (nor enumerate anything of it)
* Local System cannot access it (nor enumerate anything of it).
* Restore using backup tool cannot access it (or overwrite it).
* Chkdsk indicates the disk is OK, no problems at all.

I cannot look into the folder.
I cannot take ownership
In fact, its just there and its impossible to do anything with it.

A note aside: I do no believe it inherits permissions from its
Click to expand...
parent,
so
that is not a solution too.

Since its a production system I hope to find a good solution without
taking
down the server (which is rather time-consuming, taking at least one hour
down-time). Of course, if its required than that will be the only way.

Anyone has a last resort?
Which settings must be configured?
Is the recovery console an options (with what settings)?

Thanks,

- Joris
Click to expand...
Click to expand...
Click to expand...
 
Glad you got it resolved and thanks for reporting back what worked and good
for you for having a good backup strategy. Who knows what really happened
but all operating systems have glitches to be sure and is one reason why
current backups are a must. Even though frustrating and time consuming
usually we learn something new in such experiences like you mention about
new tools that you probably will make use of in the future. --- Steve


Joris Dobbelsteen said:
The good I fixed it finally.

The solution:
to be honest, be just as stupid as with any other Windows problem:
Reboot the d**m thing, then see if its still a problem.

The folder is empty (I have automated backups of important data, learned
it
several times before the hard way), but thats not a problem.

I'm still not sure if this is a good indication of the reliability of the
Windows system...

The good is that it works and I've seen some useful tools that I did not
know off (or had). I'm thus still looking for something to observe
associations within the system (such as open files).

Thanks for you suggestions on the issue.

- Joris

Steven L Umbach said:
Well that does not sound good. There is another tool that may be worth a
shot called fileacl and using the /force option which requires that the
administrator have backup and restore user right which is the case by
default. I would use whoami /priv while logged onto that computer just to
verify that you have the necessary privileges and also check the logs via
Event Viewer to see if anything is reported at the time of the access
failures. It may also be worth trying in Safe Mode. Subinacl may also be
worth a try to view permissions and take ownership. Sometimes it helps to
open a command window as system to use utilities that do not otherwise work.
You can use the AT command to do that. Use AT to open cmd.exe specifying
a
short time in the future such as current time plus two minutes as in AT
22:02 /interactive cmd.exe. --- Steve

http://www.gbordier.com/gbtools/fileacl.htm --- fileacl
http://www.microsoft.com/downloads/...56-d8fe-4a91-93cf-ed6985e3927b&displaylang=en
-- subinacl

Joris Dobbelsteen said:
Sorry to disappoint you, but unfortunally this hasn't worked out.

Viewing permissions yields "Access Denied"

Taking ownership simply doesn't work, again access is denied. Even though
the Administrator has "Take ownership" group policy set by the domain.
I've
tried xcacls too, including some tool somewhere called chown (developed
for
Windows by someone).

--- output on command line ---
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

U:\>e:

E:\>cd "My Documents"

E:\My Documents>dir
Volume in drive E is User
Volume Serial Number is 6854-AFA9

Directory of E:\My Documents

18-06-2006 18:46 <DIR> .
18-06-2006 18:46 <DIR> ..
[snip]
18-06-2006 20:17 <DIR> Joris
0 File(s) 0 bytes
4 Dir(s) 63,031,801,856 bytes free

E:\My Documents>xcacls joris
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

Starting XCACLS.VBS (Version: 5.2) Script at 20-6-2006 14:15:29

Startup directory:
"E:\My Documents"

Arguments Used:
Filename = "joris"


Error: File/Directory "E:\My Documents\Joris" not found.


Operation Complete
Elapsed Time: 0.2617188 seconds.

Ending Script at 20-6-2006 14:15:29



E:\My Documents>cacls joris
E:\My Documents\Joris
Access is denied.

E:\My Documents>
--------------------------

--- Taking ownership ---
E:\My Documents>xcacls joris /o Joris2k\Administrator
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

Starting XCACLS.VBS (Version: 5.2) Script at 20-6-2006 14:18:15

Startup directory:
"E:\My Documents"

Arguments Used:
Filename = "joris"
/O (Change Ownership)
Joris2k\Administrator


Error: File/Directory "E:\My Documents\Joris" not found.


Operation Complete
Elapsed Time: 0.8984375 seconds.

Ending Script at 20-6-2006 14:18:16
--------------------------

...

- Joris

What happens when you try to take ownership as an administrator? Is
the
administrators group listed as being a potential owner? If you have
not
tried to yet see if you can view and set permissions with a command line
utility. The built in cacls should list permissions [as in example
below]and
allow you to change but be careful with the syntax if you are not used to
using cacls. Xcalcs.vbs can show permissions and owner and assign
nership. --- Steve

http://support.microsoft.com/?id=825751 --- Xcals.vbs info

D:\WINDOWS\system32>cacls "d:\documents and settings"
d:\Documents and Settings BUILTIN\Administrators:(OI)(CI)F
BUILTIN\Power Users:(OI)(CI)R
NT AUTHORITY\SYSTEM:(OI)(CI)F
BUILTIN\Users:(OI)(CI)R


Dear,

I have a problem with a single folder/directory on my system: it cannot
be
accessed any more in any way.
The issue resulted from making the folder part of the DFS, so
replication
would work automatically.

Anyways the result is:
* Administrator cannot access it (nor enumerate anything of it)
* Local System cannot access it (nor enumerate anything of it).
* Restore using backup tool cannot access it (or overwrite it).
* Chkdsk indicates the disk is OK, no problems at all.

I cannot look into the folder.
I cannot take ownership
In fact, its just there and its impossible to do anything with it.

A note aside: I do no believe it inherits permissions from its parent,
so
that is not a solution too.

Since its a production system I hope to find a good solution without
taking
down the server (which is rather time-consuming, taking at least one
hour
down-time). Of course, if its required than that will be the only way.

Anyone has a last resort?
Which settings must be configured?
Is the recovery console an options (with what settings)?

Thanks,

- Joris
Click to expand...
Click to expand...
Click to expand...
 
Back
Top