We help IT Professionals succeed at work.

Windows seems to have lost all permissions and attributes to a file

I ahve a problem with seems like favorites in the profile of 2 users. a file in their profile keeps loosing all permissions or attributes. I have even went into the SYSTEM account to try to delete this file so to get their profiles working but I cannot even delete it from there.

When I right click on it and go to properties the security and owner tabs don't even show up.

Any  ideas?
Comment
Watch Question

Commented:
If your logged into the server taking ownership of the folder and then adding yourself to the security tab with full permissions should let you delete the folder.
security and owner tabs don't show up if the file system is not NTFS (but i don't think it's your case). Maybe you have "Use simple file sharing" enabled.
Just to be sure, can you see those tabs for other files?
Florin PetrutiuCIO / CISO

Author

Commented:
yes I can see the tabs on other folders.
Florin PetrutiuCIO / CISO

Author

Commented:
I cannot take ownership because the security tabs are missing
try from a command prompt cacls and xcacls
Top Expert 2005

Commented:
Try whacking it from a CMD prompt before you try resetting the permissions using those tools.  Sometimes it will go away from DOS.If nothing above works then boot with the recovery console or WinPE and delete it from there.
Florin PetrutiuCIO / CISO

Author

Commented:
Nope, still says Access Denied
Adam LeinssSystems Administrator

Commented:
What's the filename?  Maybe it has illegal characters and you need to delete/rename it.
If "cacls * /g Everyone:F' comes back Access Denied, maybe the file is open?
Florin PetrutiuCIO / CISO

Author

Commented:
This is what I get. still access denied. File is not in use.
screenshot.jpg
Top Expert 2005

Commented:
Where is the location of this file?

If it's in Default Users>Desktop then use the local Admin account to fix it.

Florin PetrutiuCIO / CISO

Author

Commented:
cannot delete it, cannot rename it, access denied. I am logged in as admin. but it even gives access denied if under the system account.
Top Expert 2005

Commented:
Boot to the recovery console and nuke it from there.

This is on the workstation - correct?
Florin PetrutiuCIO / CISO

Author

Commented:
it is located on the file server d:\profiles\krobers2\Aplication Data\Microsoft\Office\Recent
file server is Windows 2003 and part of Active Directory.
Florin PetrutiuCIO / CISO

Author

Commented:
no it is on the server. The workstation just uses the profile from the server.
Top Expert 2005

Commented:
You'll have to do this off-hours then.  Use the server CD to boot to recovery console or a command prompt then delete it.

You could always create a new profile folder and redirect to that one temporarily - this should get you going perhaps.

Florin PetrutiuCIO / CISO

Author

Commented:
Netman66: would this work even if I cannot touch the file in the system account? Thoght the system account is the moher of all permissions.
Top Expert 2005

Commented:
In recovery or cmd prompt I'm pretty sure it doesn't look at security it just does what you tell it to.
Adam LeinssSystems Administrator

Commented:
When you said SYSTEM account, do you mean something like psexec -s cmd?
Florin PetrutiuCIO / CISO

Author

Commented:
I gain access with a scheduled task like:  at 8:41 /interactive “cmd.exe”

then close explorer.exe and reopen it from he new command prompt that pops up. this gives you access to the system account. I should be the most powerful account in windows.

Have a look: http://alieneyes.wordpress.com/2006/10/23/how-to-gain-access-to-system-account-the-most-powerful-account-in-windows/
CIO / CISO
Commented:
OK figured it out!!!!! The file was being locked by cidaemon.exe which happens to be the Microsoft Indexing service.

the way to find out was downloading the handle.exe from microsoft and seeing which software has a handle on the file. Once I have figured it out, I have stopped the service and terminated cidaemon.exe from the task manager. Once I did that the file can be accessed and for my relief deleted.

Hope this helps someone some day.