File "mysteriously" deleted everytime it is placed in a specific folder.

We have an Office 2010 PowerPoint file that one of our users asked us to restore because they saved several unwanted changes to it.  We have used our backup system to restore the file from the cloud.  The file seems to restore, with no problem, to any location other than the original location.  However, if we restore the file to the original location, the file disappears after a few minutes.  We tried this 4 or 5 times.  We also tried renaming the file once it was restored to the original location and it still disappeared.  A couple times, we copied the file from a different restore location to the original location, but still disappeared, regardless if we renamed it or not.  We did create a sub-folder in the original location and moved the file into the sub-folder where it has stayed without being deleted.  At one point, we turned on object access auditing and found that the System account is deleting the file and the process maybe SoftMon.exe, which is endpoint security software by LANDesk.  I have copied the event log entry below.  We scanned the file with McAfee VirusScan Enterprise and found no threats.  We also did not find any macros or VB code in the file.  The only COM we saw was for Webex Productivity Tools.  Does anyone have an idea of what could be happening?  

Event Type:         Success Audit
Event Source:     Security
Event Category: Object Access
Event ID:              560
Date:                    3/27/2015
Time:                    11:42:10 AM
User:                    NT AUTHORITY\SYSTEM
Computer:           computername
Object Open:
              Object Server:    Security
              Object Type:       File
              Object Name:     C:\filename.pptx
              Handle ID:           2360
              Operation ID:     {0,1526439557}
              Process ID:          1868
              Image File Name:             C:\Program Files\LANDesk\LDClient\SoftMon.exe
              Primary User Name:        username
              Primary Domain:               DOMAIN
              Primary Logon ID:            (0x0,0x3E7)
              Client User Name:            -
              Client Domain:   -
              Client Logon ID: -
              Accesses:             DELETE
               Privileges:            SeBackupPrivilege
              Restricted Sid Count:       0
              Access Mask:      0x10080
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Can you send the file to LANDesk and ask them what's triggering their software? Surely they have a file diagnostic or something.

You could take a look at the file in an XML editor and see if there's anything odd about it. Maybe there's something embedded in the file that SoftMon doesn't like. For example, it could be an image copied from the web and pasted into PPT. Sometimes those retain HTML code or links -- I suppose something like that could trigger security software.

The weird thing is that the file will stay put if it's in a subfolder. Maybe the scan hasn't gotten to it there yet. :-)
tmaususerAuthor Commented:
Those are very helpful suggestions.  I am creating a ticket now with LANDesk and will post what they find.  
Like you said, it is weird that it has not been deleted from the other locations yet.  
This has me a little nervous.
If you want to post the file (and you're sure it doesn't have a virus in it!) , I can look at the guts and see what I can find.
Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

tmaususerAuthor Commented:
I haven't heard back from LANDesk to confirm if end point security is deleting the item.
Maybe you should ping them and see what they've found out.
tmaususerAuthor Commented:
Sorry, I've gotten caught up in some additional fires.
I do appreciate your help though.  I should be able to get back to it tomorrow.
tmaususerAuthor Commented:
It turns out the SYSTEM and NETWORK SYSTEM accounts had been intentionally removed from the folder security.  I think our restore program uses these accounts to replace files.  After adding these 2 built-in system accounts, the strange behavior stopped.  I was able to restore the file to the original location without it disappearing.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
tmaususerAuthor Commented:
While talking to the backup company, they mentioned the user not have rights to the folder.  Though the user did have rights, something clicked in my head to check these system accounts.
Glad to hear it.
tmaususerAuthor Commented:
Echo_S gave a very valid suggestion immediately.  It is rare to get good advice right off the bat.  She was correct that action was being taken against the file by a something security related.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.