We help IT Professionals succeed at work.

Unable to modify/take ownership of a file

dkadlac
dkadlac asked
on
1,193 Views
Last Modified: 2012-05-09
We have a windows 2003 server that is on a domain. We have a file that was created by windows update, under c:\winnt\softwaredistribution\datastore\logs\edbtmp.log. We are getting errors in our event log because the file cannot be deleted, access is denied.

I am logged into the server under the domain administrator. When I view the security settings, both Add and Remove are greyed out. When I view advanced, Add and Remove are still greyed out and I can only click on View. When I click on the Owner tab, it says "You only have permission to view the current owner on edbtmp.log". The existing owner is servername\Administrators. I am unable to take ownership of the file when I am logged in as the domain administrator or as the local administrator. I even tried changed the owner of the parent folder and tried to set permissions on the child nodes, but that was denied.

I have tried using the takeown command, tried using subinacl, and tried icacls, but nothing is letting me change the permissions of this file or take ownership. We had this same problem with some other non system files, and had to eventually log in as a obscure domain account that supposedly ended up having permissions.

The strange thing is that servername\administrators has full rights, according to the security tab and when viewing icacls on that file. I have never seen this before and not sure what would be causing it.
Comment
Watch Question

that is your exchange temp transaction log.  You can not delete it because it is active.

 The most current transactions are stored in the Edb.log file; when the Edb.log file reaches 5 megabytes (MB) in size, a file called Edbtmp.log is created to accept incoming transactions and the Edb.log file is renamed to Edb00001.log. After the Edb.log file is renamed, the Edbtmp.log file is then renamed Edb.log. This process is repeated each time the Edb.log file reaches 5 MB in size. Therefore, the log files build up as more and more transactions are created.

Author

Commented:
This is not our exchange server. The file is 0kb and is not in use. Even if it were in use, I should still be able to take ownership of it. We had this same problem on a few other files on the server as well, not related to windows system files.


These system *.log files can be deleted only after your system settles in from after rebooting, or upon a visit to the Microsoft Update Website:

C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edbtmp.log

C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log

NOTE: If the edb.log is deleted from the C:\WINDOWS\SoftwareDistribution\DataStore\Logs folder, you will need to reboot your computer before your next visit to the Microsoft Update Website...otherwise, the Microsoft Update Website will not function. The same holds true for the edb.chk located in this folder. Further note: the edb.log can be deleted only after your system settles in from after rebooting, or after a time from a visit to the Microsoft Update Website
ITIL Problem Manager
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION

Commented:
DrUltima has a good point:
The file folder is probably use protected.

Another thing that can cause this is a GPO to prevent users from editing file permissions or taking ownership. I could see this as a potential problem.

Author

Commented:
The problem is that we are having this same problem on a few other files that get automatically generated on the system. We get a 0kb file that I am unable to take the ownership of the file or do anything to the file (delete, rename, etc). So it isn't just with the windows update file, it is with other non-system files.

I still think there is something flaky going on with my system.

As for a GPO, there aren't any GPOs applied to the server. Every other file I can view and make changes to the security settings.

Unfortunately this server is one of our production servers, so I can't really reboot it right now.
Justin OwensITIL Problem Manager

Commented:
Are you also noticing your hard drive filling up more than it should?  If there are a bunch of 0k files which are actually causing space issues, it could be a problem with VSS.  Is it enabled on this machine?  When was the last time your server rebooted?

Commented:
I have seen this before. I changed the name of the file to "filename".txt. Then, I could delete the file.

Author

Commented:
I wasn't able to rename the file.

I ended up rebooting the server. We haven't had problems since the reboot so something must have just been very screwy in windows.

You may close the question.
Justin OwensITIL Problem Manager

Commented:
You, as the Author, need to close the Question.  If one of the Expert comments solved your issue, click the Accept Answer button.  You can also split points if multiple answers helped.  Which ever gets the most points will be given the "Answer" and the others will get labeled as an "Assist".

Justin

Commented:
Guys, I disagree how this question is being closed.

Dr. Ultima was all over rebooting the server, because a service was stuck. There are a couple entries where Dr. Ultima suggested rebooting the server.

Author: Please reconsider assigning points to Dr.Ultima.
Justin OwensITIL Problem Manager

Commented:
Thanks, Chief....I tend to agree, but I also hate saying, "Accept my answer" to an Author.

Author

Commented:
I guess I am fine with assigning the points to DrUltima. While it wasn't a specific service that was stuck, as we were having problems with multiple files/services, a reboot appears to have fixed the problem. Please assign the points to him. Is that something I am able to fix? Sorry, I am new to posting questions.

Commented:
Yes, you can fix this by pressing the "except multiple answer buttons under the expert's posting.. If green/blue buttons are not available, then we can object to the auto closure of this thread and then you should be able to assign points.

But, all you should have to do is except his answers that suited your "fix".
Justin OwensITIL Problem Manager

Commented:
Object posted per Mod's request to facilitate proper assigning of points.

Mod request here:

https://www.experts-exchange.com/Community_Support/General/Q_26406045.html?cid=239#a33456037

Justin

Author

Commented:
Reboot fixed the problem. Thank you DrUltima
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.