Strange File Permissions

  • Thread starter Thread starter Brian McGrew
  • Start date Start date
B

Brian McGrew

Guest
Good morning,

Running in a Win2K3/R2 (64-Bit) I'm seeing some very weird things happening
with file permissions and ownership. I've got about 3TB of storage with
multiple shares and I'm seeing entire file systems become owned by a random
id like 0-24-036-303-630 and permissions being reset to read-only.

Any idea why?

My network is small enough that I can account for all users actions and I
know it's not a user that's resetting them. Also I can be certain that I do
not have a virus because this particular subnet is private and not on the
net.

Are there any utilities out there that I could use to forcibly reset
ownership and permissions just in case there is something going on with NTFS
that I can't see?

Oh!?!?! I'm also sharing these file systems via NFS.

-brian
 
Re: Strange File Permissions


"Brian McGrew" <brian@visionpro.com> wrote in message
news:C424BB99.1536F%brian@visionpro.com...
> Good morning,
>
> Running in a Win2K3/R2 (64-Bit) I'm seeing some very weird things
> happening
> with file permissions and ownership. I've got about 3TB of storage with
> multiple shares and I'm seeing entire file systems become owned by a
> random
> id like 0-24-036-303-630 and permissions being reset to read-only.
>
> Any idea why?

Almost certainly because someone (or something specific) is changing those.
This is not to be cute or anything but simply to make it clear that
permissions
are absolutely predictable. (In theory there could be a 64-bit2k3 only bug
but that is highly doubtful.)

Permissions do NOT "just change". Someone or something does that.

> My network is small enough that I can account for all users actions and I
> know it's not a user that's resetting them. Also I can be certain that I
> do
> not have a virus because this particular subnet is private and not on the
> net.

You should immediatley enable AUDITING of (File) Objects and set
auditing in the affected areas to watch for "who" is doing this.

> Are there any utilities out there that I could use to forcibly reset
> ownership and permissions just in case there is something going on with
> NTFS
> that I can't see?

Sure, but you have a User or a process (could be a virus but I doubt that)
which is DOING THIS.

> Oh!?!?! I'm also sharing these file systems via NFS.

If there is a bug, then the NFS software is far more likely to be the source
of that bug.

Obviously the NFS software has to PRETEND to be some users (the one
accessing the files or some starndard user) whenever the files are modified,
created, deleted, etc.
 
Back
Top