NTFS permissions...

[Crusty]

I've got a folder on my exchange server that somehow Administrator lost ownership/permissions to....

Logged in directly to the server as MYDOMAIN/Administrator I can't touch this folder. Can't browse/delete/move/anything to it. The Security tab doesn't even show up if Iright click on it!

What can I do?!

edit: dir /Q on the parent directory shows NO owner of the directory.

If it helps any, this is a directory that is being used by IIS.

 

[stash]

You should be able to take ownership with a command line tool like subinacl. Admins can take ownership of anything.

 

[Crusty]

Originally posted by: STaSh
You should be able to take ownership with a command line tool like subinacl. Admins can take ownership of anything.

Well, I tried that... and I was getting access denied for every command on that folder...

So we decided to reboot the server... and now that folder is just gone! :Q

Not such a big deal, just pull out the backups.

I still want to know what could have caused this.

 

[dawks]

Maybe time for a chkdsk or hd diagnostics test?

 

[TGS]

Check the security logs to see who logged in. There should be an event ID for deleting a folder. IIRC. Though it sounds like someone deleted the folder while you were in it?

Or did you try to access it, for some other reason, and started to get access denied?

Edit: I could only find info on events generated after enabling auditing against directories.

 

[Crusty]

Originally posted by: TGS
Check the security logs to see who logged in. There should be an event ID for deleting a folder. IIRC. Though it sounds like someone deleted the folder while you were in it?

Or did you try to access it, for some other reason, and started to get access denied?

Edit: I could only find info on events generated after enabling auditing against directories.

I am the ONLY person that has access to the directory, other then the rest of the people in my group, but I am the only person working on the directory and nobody claims to have touched it. There is nothing in the security log that leads to file/folder deletion.

 

[TGS]

I would turn auditing on the folder or directory in question. If it happens again then you will have hopefully some insight into what/whom could have caused it get deleted.

If auditing doesn't show anything, it would be time to call in the Microsoft Ghost Busters division. Though I have yet to see data disappear without some human intervention, though some will stand by the fact they swear the data disappeared.