Click here to get back home

Everybody denied access to a folder

 HomeNewsGroups | Search | About
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Everybody denied access to a folder Joris Dobbelsteen 06-19-2006
Posted by Joris Dobbelsteen on June 19, 2006, 4:52 am
Please log in for more thread options
Dear,

I have a problem with a single folder/directory on my system: it cannot be
accessed any more in any way.
The issue resulted from making the folder part of the DFS, so replication
would work automatically.

Anyways the result is:
* Administrator cannot access it (nor enumerate anything of it)
* Local System cannot access it (nor enumerate anything of it).
* Restore using backup tool cannot access it (or overwrite it).
* Chkdsk indicates the disk is OK, no problems at all.

I cannot look into the folder.
I cannot take ownership
In fact, its just there and its impossible to do anything with it.

A note aside: I do no believe it inherits permissions from its parent, so
that is not a solution too.

Since its a production system I hope to find a good solution without taking
down the server (which is rather time-consuming, taking at least one hour
down-time). Of course, if its required than that will be the only way.

Anyone has a last resort?
Which settings must be configured?
Is the recovery console an options (with what settings)?

Thanks,

- Joris



Posted by Steven L Umbach on June 19, 2006, 1:55 pm
Please log in for more thread options

Posted by Joris Dobbelsteen on June 20, 2006, 8:19 am
Please log in for more thread options
Sorry to disappoint you, but unfortunally this hasn't worked out.

Viewing permissions yields "Access Denied"

Taking ownership simply doesn't work, again access is denied. Even though
the Administrator has "Take ownership" group policy set by the domain. I've
tried xcacls too, including some tool somewhere called chown (developed for
Windows by someone).

--- output on command line ---
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

U:\>e:

E:\>cd "My Documents"

E:\My Documents>dir
Volume in drive E is User
Volume Serial Number is 6854-AFA9

Directory of E:\My Documents

18-06-2006 18:46 <DIR> .
18-06-2006 18:46 <DIR> ..
[snip]
18-06-2006 20:17 <DIR> Joris
0 File(s) 0 bytes
4 Dir(s) 63,031,801,856 bytes free

E:\My Documents>xcacls joris
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

Starting XCACLS.VBS (Version: 5.2) Script at 20-6-2006 14:15:29

Startup directory:
"E:\My Documents"

Arguments Used:
Filename = "joris"


Error: File/Directory "E:\My Documents\Joris" not found.


Operation Complete
Elapsed Time: 0.2617188 seconds.

Ending Script at 20-6-2006 14:15:29



E:\My Documents>cacls joris
E:\My Documents\Joris
Access is denied.

E:\My Documents>
--------------------------

--- Taking ownership ---
E:\My Documents>xcacls joris /o Joris2k\Administrator
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

Starting XCACLS.VBS (Version: 5.2) Script at 20-6-2006 14:18:15

Startup directory:
"E:\My Documents"

Arguments Used:
Filename = "joris"
/O (Change Ownership)
Joris2k\Administrator


Error: File/Directory "E:\My Documents\Joris" not found.


Operation Complete
Elapsed Time: 0.8984375 seconds.

Ending Script at 20-6-2006 14:18:16
--------------------------

...

- Joris

> What happens when you try to take ownership as an administrator? Is the
> administrators group listed as being a potential owner? If you have not
> tried to yet see if you can view and set permissions with a command line
> utility. The built in cacls should list permissions [as in example
below]and
> allow you to change but be careful with the syntax if you are not used to
> using cacls. Xcalcs.vbs can show permissions and owner and assign
> nership. --- Steve
>
>
> D:\WINDOWS\system32>cacls "d:\documents and settings"
> d:\Documents and Settings BUILTIN\Administrators:(OI)(CI)F
> BUILTIN\Power Users:(OI)(CI)R
> NT AUTHORITY\SYSTEM:(OI)(CI)F
> BUILTIN\Users:(OI)(CI)R
>
>
> > Dear,
> >
> > I have a problem with a single folder/directory on my system: it cannot
be
> > accessed any more in any way.
> > The issue resulted from making the folder part of the DFS, so
replication
> > would work automatically.
> >
> > Anyways the result is:
> > * Administrator cannot access it (nor enumerate anything of it)
> > * Local System cannot access it (nor enumerate anything of it).
> > * Restore using backup tool cannot access it (or overwrite it).
> > * Chkdsk indicates the disk is OK, no problems at all.
> >
> > I cannot look into the folder.
> > I cannot take ownership
> > In fact, its just there and its impossible to do anything with it.
> >
> > A note aside: I do no believe it inherits permissions from its parent,
so
> > that is not a solution too.
> >
> > Since its a production system I hope to find a good solution without
> > taking
> > down the server (which is rather time-consuming, taking at least one
hour
> > down-time). Of course, if its required than that will be the only way.
> >
> > Anyone has a last resort?
> > Which settings must be configured?
> > Is the recovery console an options (with what settings)?
> >
> > Thanks,
> >
> > - Joris
> >
> >
>
>



Posted by Joris Dobbelsteen on June 20, 2006, 9:18 am
Please log in for more thread options
My thoughts are:

How likely is it that the Recovery Console can solve this problem?
From what I read I don't expect too much?

Might a other application (Distributed file system) have it locked?
Can I see this anywhere?

What settings are needed to enforce the Admin can always take ownership,
regardless of any other configuration? Where are such settings located (the
system is a domain controller, by the way).

- Joris

> Sorry to disappoint you, but unfortunally this hasn't worked out.
>
> Viewing permissions yields "Access Denied"
>
> Taking ownership simply doesn't work, again access is denied. Even though
> the Administrator has "Take ownership" group policy set by the domain.
I've
> tried xcacls too, including some tool somewhere called chown (developed
for
> Windows by someone).
>
> --- output on command line ---
> Microsoft Windows [Version 5.2.3790]
> (C) Copyright 1985-2003 Microsoft Corp.
>
> U:\>e:
>
> E:\>cd "My Documents"
>
> E:\My Documents>dir
> Volume in drive E is User
> Volume Serial Number is 6854-AFA9
>
> Directory of E:\My Documents
>
> 18-06-2006 18:46 <DIR> .
> 18-06-2006 18:46 <DIR> ..
> [snip]
> 18-06-2006 20:17 <DIR> Joris
> 0 File(s) 0 bytes
> 4 Dir(s) 63,031,801,856 bytes free
>
> E:\My Documents>xcacls joris
> Microsoft (R) Windows Script Host Version 5.6
> Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.
>
> Starting XCACLS.VBS (Version: 5.2) Script at 20-6-2006 14:15:29
>
> Startup directory:
> "E:\My Documents"
>
> Arguments Used:
> Filename = "joris"
>
>
> Error: File/Directory "E:\My Documents\Joris" not found.
>
>
> Operation Complete
> Elapsed Time: 0.2617188 seconds.
>
> Ending Script at 20-6-2006 14:15:29
>
>
>
> E:\My Documents>cacls joris
> E:\My Documents\Joris
> Access is denied.
>
> E:\My Documents>
> --------------------------
>
> --- Taking ownership ---
> E:\My Documents>xcacls joris /o Joris2k\Administrator
> Microsoft (R) Windows Script Host Version 5.6
> Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.
>
> Starting XCACLS.VBS (Version: 5.2) Script at 20-6-2006 14:18:15
>
> Startup directory:
> "E:\My Documents"
>
> Arguments Used:
> Filename = "joris"
> /O (Change Ownership)
> Joris2k\Administrator
>
>
> Error: File/Directory "E:\My Documents\Joris" not found.
>
>
> Operation Complete
> Elapsed Time: 0.8984375 seconds.
>
> Ending Script at 20-6-2006 14:18:16
> --------------------------
>
> ...
>
> - Joris
>
> > What happens when you try to take ownership as an administrator? Is the
> > administrators group listed as being a potential owner? If you have not
> > tried to yet see if you can view and set permissions with a command line
> > utility. The built in cacls should list permissions [as in example
> below]and
> > allow you to change but be careful with the syntax if you are not used
to
> > using cacls. Xcalcs.vbs can show permissions and owner and assign
> > nership. --- Steve
> >
> >
> > D:\WINDOWS\system32>cacls "d:\documents and settings"
> > d:\Documents and Settings BUILTIN\Administrators:(OI)(CI)F
> > BUILTIN\Power Users:(OI)(CI)R
> > NT AUTHORITY\SYSTEM:(OI)(CI)F
> > BUILTIN\Users:(OI)(CI)R
> >
> >
> > > Dear,
> > >
> > > I have a problem with a single folder/directory on my system: it
cannot
> be
> > > accessed any more in any way.
> > > The issue resulted from making the folder part of the DFS, so
> replication
> > > would work automatically.
> > >
> > > Anyways the result is:
> > > * Administrator cannot access it (nor enumerate anything of it)
> > > * Local System cannot access it (nor enumerate anything of it).
> > > * Restore using backup tool cannot access it (or overwrite it).
> > > * Chkdsk indicates the disk is OK, no problems at all.
> > >
> > > I cannot look into the folder.
> > > I cannot take ownership
> > > In fact, its just there and its impossible to do anything with it.
> > >
> > > A note aside: I do no believe it inherits permissions from its parent,
> so
> > > that is not a solution too.
> > >
> > > Since its a production system I hope to find a good solution without
> > > taking
> > > down the server (which is rather time-consuming, taking at least one
> hour
> > > down-time). Of course, if its required than that will be the only way.
> > >
> > > Anyone has a last resort?
> > > Which settings must be configured?
> > > Is the recovery console an options (with what settings)?
> > >
> > > Thanks,
> > >
> > > - Joris
> > >
> > >
> >
> >
>
>



Posted by Steven L Umbach on June 20, 2006, 9:58 am
Please log in for more thread options
Well that does not sound good. There is another tool that may be worth a
shot called fileacl and using the /force option which requires that the
administrator have backup and restore user right which is the case by
default. I would use whoami /priv while logged onto that computer just to
verify that you have the necessary privileges and also check the logs via
Event Viewer to see if anything is reported at the time of the access
failures. It may also be worth trying in Safe Mode. Subinacl may also be
worth a try to view permissions and take ownership. Sometimes it helps to
open a command window as system to use utilities that do not otherwise work.
You can use the AT command to do that. Use AT to open cmd.exe specifying a
short time in the future such as current time plus two minutes as in AT
22:02 /interactive cmd.exe. --- Steve

http://www.gbordier.com/gbtools/fileacl.htm --- fileacl
http://www.microsoft.com/downloads/details.aspx?FamilyID=e8ba3e56-d8fe-4a91-93cf-ed6985e3927b&displaylang=en
-- subinacl

> Sorry to disappoint you, but unfortunally this hasn't worked out.
>
> Viewing permissions yields "Access Denied"
>
> Taking ownership simply doesn't work, again access is denied. Even though
> the Administrator has "Take ownership" group policy set by the domain.
> I've
> tried xcacls too, including some tool somewhere called chown (developed
> for
> Windows by someone).
>
> --- output on command line ---
> Microsoft Windows [Version 5.2.3790]
> (C) Copyright 1985-2003 Microsoft Corp.
>
> U:\>e:
>
> E:\>cd "My Documents"
>
> E:\My Documents>dir
> Volume in drive E is User
> Volume Serial Number is 6854-AFA9
>
> Directory of E:\My Documents
>
> 18-06-2006 18:46 <DIR> .
> 18-06-2006 18:46 <DIR> ..
> [snip]
> 18-06-2006 20:17 <DIR> Joris
> 0 File(s) 0 bytes
> 4 Dir(s) 63,031,801,856 bytes free
>
> E:\My Documents>xcacls joris
> Microsoft (R) Windows Script Host Version 5.6
> Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.
>
> Starting XCACLS.VBS (Version: 5.2) Script at 20-6-2006 14:15:29
>
> Startup directory:
> "E:\My Documents"
>
> Arguments Used:
> Filename = "joris"
>
>
> Error: File/Directory "E:\My Documents\Joris" not found.
>
>
> Operation Complete
> Elapsed Time: 0.2617188 seconds.
>
> Ending Script at 20-6-2006 14:15:29
>
>
>
> E:\My Documents>cacls joris
> E:\My Documents\Joris
> Access is denied.
>
> E:\My Documents>
> --------------------------
>
> --- Taking ownership ---
> E:\My Documents>xcacls joris /o Joris2k\Administrator
> Microsoft (R) Windows Script Host Version 5.6
> Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.
>
> Starting XCACLS.VBS (Version: 5.2) Script at 20-6-2006 14:18:15
>
> Startup directory:
> "E:\My Documents"
>
> Arguments Used:
> Filename = "joris"
> /O (Change Ownership)
> Joris2k\Administrator
>
>
> Error: File/Directory "E:\My Documents\Joris" not found.
>
>
> Operation Complete
> Elapsed Time: 0.8984375 seconds.
>
> Ending Script at 20-6-2006 14:18:16
> --------------------------
>
> ...
>
> - Joris
>
>> What happens when you try to take ownership as an administrator? Is the
>> administrators group listed as being a potential owner? If you have not
>> tried to yet see if you can view and set permissions with a command line
>> utility. The built in cacls should list permissions [as in example
> below]and
>> allow you to change but be careful with the syntax if you are not used to
>> using cacls. Xcalcs.vbs can show permissions and owner and assign
>> nership. --- Steve
>>
>>
>> D:\WINDOWS\system32>cacls "d:\documents and settings"
>> d:\Documents and Settings BUILTIN\Administrators:(OI)(CI)F
>> BUILTIN\Power Users:(OI)(CI)R
>> NT AUTHORITY\SYSTEM:(OI)(CI)F
>> BUILTIN\Users:(OI)(CI)R
>>
>>
>> > Dear,
>> >
>> > I have a problem with a single folder/directory on my system: it cannot
> be
>> > accessed any more in any way.
>> > The issue resulted from making the folder part of the DFS, so
> replication
>> > would work automatically.
>> >
>> > Anyways the result is:
>> > * Administrator cannot access it (nor enumerate anything of it)
>> > * Local System cannot access it (nor enumerate anything of it).
>> > * Restore using backup tool cannot access it (or overwrite it).
>> > * Chkdsk indicates the disk is OK, no problems at all.
>> >
>> > I cannot look into the folder.
>> > I cannot take ownership
>> > In fact, its just there and its impossible to do anything with it.
>> >
>> > A note aside: I do no believe it inherits permissions from its parent,
> so
>> > that is not a solution too.
>> >
>> > Since its a production system I hope to find a good solution without
>> > taking
>> > down the server (which is rather time-consuming, taking at least one
> hour
>> > down-time). Of course, if its required than that will be the only way.
>> >
>> > Anyone has a last resort?
>> > Which settings must be configured?
>> > Is the recovery console an options (with what settings)?
>> >
>> > Thanks,
>> >
>> > - Joris
>> >
>> >
>>
>>
>
>



Similar ThreadsPosted
Re: Windows 2003: Folder Access Denied October 25, 2005, 10:13 pm
Windows 2003: Folder Access Denied October 24, 2005, 9:06 am
Getting Access is Denied March 2, 2006, 6:30 pm
DRA and access denied September 28, 2006, 10:13 am
Access XP Permission Denied July 12, 2006, 9:52 pm
CDROM Drive access denied October 31, 2005, 10:40 am
Certificate services Access Denied November 9, 2005, 9:02 pm
Access denied to event viewer? December 22, 2005, 4:07 pm
DCOM access denied after SP1 applied January 6, 2006, 3:46 pm
Event Viewer Access Denied January 27, 2006, 12:37 pm

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap