Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

There seems to be a process that changes the file ownership on my corporate Windows 7 laptop.

I have the same account name on two different domains, say GLOBAL\hemal and CORP\hemal. I login to my desktop using CORP\hemal, the other account is disabled.

I noticed that several files on my machine are owned by GLOBAL\hemal. In general this does cause any issue, I realized this only because cygwin complained something about a directory not being safe for creating temp files.

So I changed the file owner to CORP\hemal. A little later I got the error again and saw that the owner had changed back to GLOBAL\hemal. So I changed the owner on two folders C:\cygwin and C:\eclipse, which were both owned by the GLOBAL to CORP and wrote a small script to log their ownership. I confirmed that the onwership keeps getting changed by to GLOBAL sooner or later.

So my questions are:

  1. Are there any security processes on Windows 7 that would revert the file ownership in this fashion? It seems all files/directories owned by CORP get changed to GLOBAL

  2. Is there a way to identify the process that is making these changed? It doesn't seem like the filesystem watcher can do this, but I am wondering if there is way to make the ownership immutable and thereby get some error message from the offending process.

share|improve this question
    
What is the full path? Are we talking the system drive, a user profile directory, remote network drive path? –  Ramhound Mar 7 '13 at 16:24
    
All local files and directories. I don't know what you mean by system drive but this happens in files under user directory c:\user\hemal as well as to c:\eclipse and c:\cygwin, it seems all files on my machine owned by CORP get their owner modified to GLOBAL –  Hemal Pandya Mar 7 '13 at 16:35
    
Do you have the ability to change the username on one of the domains as a test? A system drive is the drive where the operating system is installed on. –  Ramhound Mar 7 '13 at 18:33
    
No, I cannot change anything in these domains. `C:` is my system drive. –  Hemal Pandya Mar 7 '13 at 18:42
add comment

1 Answer

Using procmon from sysinternals I found that c:\Program Files\Quest\vmover changed the ownership.

Still trying to find out what vmover is and why it is changing ownership of files, but procmon is a great tool that answered my second question.

I will update this answer when I find out more about vmover.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.