Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My files are being changed to read-only. I am the only user on the computer, so it is actually a program that is doing this to me. I need a program or a way to watch a directory to see who is changing the file attributes.

share|improve this question

migrated from serverfault.com Mar 5 '10 at 19:21

This question came from our site for system and network administrators.

4 Answers 4

You might check out Process Monitor from Microsoft, which is the replacement for the old Filemon and Regmon Sysinternals tools. It should be able to tell you whenever the file is touched, opened, or otherwise molested.

share|improve this answer

Wrote this before I noticed you asked for Windows, but what the hell, if it was Ubuntu:

apt-get install auditd
sudo auditctl -w /home/kbrandt/scrap/whiteS.pl
tail -f /var/log/audit.log
#Type chmod 754/home/kbrandt/scrap/whiteS.pl
type=PATH msg=audit(1267801827.941:7): item=0 name="whiteS.pl" inode=143716 dev=07:00 mode=0100754 ouid=1923 ogid=1000 rdev=00:00
share|improve this answer

Turn on "Audit Object Access" in either the local security policy or a GPO that targets the servers you're interested in monitoring. Then, go to the objects that you want to monitor and turn on auditing for them. This article is concerning Windows XP but is pertinent for the Server OS as well: http://support.microsoft.com/kb/310399

share|improve this answer

What files are being changed? If they are system files, it's quite likely that Windows File Protection is pulling them back with the correct attributes from it's cache (I haven't confirmed this and I'm not about to go messing with my own system files as a test).

If it's a folder that's being reset to read-only, have a look at >this KB article< and >this Old New Thing<, bear in mind that the behaviour is by design, and decide if it's really that big a deal before implementing the suggested solution.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.