Strange File Permissions

[Guest Brian McGrew]

Good morning,

 

Running in a Win2K3/R2 (64-Bit) I'm seeing some very weird things happening

with file permissions and ownership. I've got about 3TB of storage with

multiple shares and I'm seeing entire file systems become owned by a random

id like 0-24-036-303-630 and permissions being reset to read-only.

 

Any idea why?

 

My network is small enough that I can account for all users actions and I

know it's not a user that's resetting them. Also I can be certain that I do

not have a virus because this particular subnet is private and not on the

net.

 

Are there any utilities out there that I could use to forcibly reset

ownership and permissions just in case there is something going on with NTFS

that I can't see?

 

Oh!?!?! I'm also sharing these file systems via NFS.

 

-brian

[Guest Herb Martin]

Re: Strange File Permissions

 

 

"Brian McGrew" <brian@visionpro.com> wrote in message

news:C424BB99.1536F%brian@visionpro.com...

> Good morning,

>

> Running in a Win2K3/R2 (64-Bit) I'm seeing some very weird things

> happening

> with file permissions and ownership. I've got about 3TB of storage with

> multiple shares and I'm seeing entire file systems become owned by a

> random

> id like 0-24-036-303-630 and permissions being reset to read-only.

>

> Any idea why?

 

Almost certainly because someone (or something specific) is changing those.

This is not to be cute or anything but simply to make it clear that

permissions

are absolutely predictable. (In theory there could be a 64-bit2k3 only bug

but that is highly doubtful.)

 

Permissions do NOT "just change". Someone or something does that.

> My network is small enough that I can account for all users actions and I

> know it's not a user that's resetting them. Also I can be certain that I

> do

> not have a virus because this particular subnet is private and not on the

> net.

 

You should immediatley enable AUDITING of (File) Objects and set

auditing in the affected areas to watch for "who" is doing this.

> Are there any utilities out there that I could use to forcibly reset

> ownership and permissions just in case there is something going on with

> NTFS

> that I can't see?

 

Sure, but you have a User or a process (could be a virus but I doubt that)

which is DOING THIS.

> Oh!?!?! I'm also sharing these file systems via NFS.

 

If there is a bug, then the NFS software is far more likely to be the source

of that bug.

 

Obviously the NFS software has to PRETEND to be some users (the one

accessing the files or some starndard user) whenever the files are modified,

created, deleted, etc.