Who is changing my file to read only it is killing me!

Question

I need a program or a way to watch a directory to see who is changing my files to read only. Any ideas on how I can do this?

Answer 1

You might check out Process Monitor from Microsoft, which is the replacement for the old Filemon and Regmon Sysinternals tools. It should be able to tell you whenever the file is touched, opened, or otherwise molested.

Answer 2

Wrote this before I noticed you asked for Windows, but what the hell, if it was Ubuntu:

apt-get install auditd
sudo auditctl -w /home/kbrandt/scrap/whiteS.pl
tail -f /var/log/audit.log
#Type chmod 754/home/kbrandt/scrap/whiteS.pl
type=PATH msg=audit(1267801827.941:7): item=0 name="whiteS.pl" inode=143716 dev=07:00 mode=0100754 ouid=1923 ogid=1000 rdev=00:00

Answer 3

Turn on "Audit Object Access" in either the local security policy or a GPO that targets the servers you're interested in monitoring. Then, go to the objects that you want to monitor and turn on auditing for them. This article is concerning Windows XP but is pertinent for the Server OS as well: http://support.microsoft.com/kb/310399

Answer 4

What files are being changed? If they are system files, it's quite likely that Windows File Protection is pulling them back with the correct attributes from it's cache (I haven't confirmed this and I'm not about to go messing with my own system files as a test).

If it's a folder that's being reset to read-only, have a look at >this KB article< and >this Old New Thing<, bear in mind that the behaviour is by design, and decide if it's really that big a deal before implementing the suggested solution.