1

A single file, at /MyFolder/images/file1.png, has become, suddenly, a god entity as I've never seen one before. I'm the only account on the PC, full admin rights. UAC turned off always, ever since the beginning. What has failed:

  • Windows Explorer -> Properties -> Security:
    • "You do not have permissions to view or edit this object's permission settings"
    • Advanced -> Owner: Current owner: Unable to display current owner
  • takeown /f file1.png /r /d y: ERROR: Access is denied.
  • icacls file1.png /grant administrators:F /T: file1.png: Access is denied. Succesfully processed 0 files; Failed processing 1 files.
  • net user administrator /active:yes in an elevated command prompt, switching to Administrator user, trying to take ownership through Windows Explorer & repeated above steps.

Whatever I do, I cannot retake control of this file. What have I missed, what can I do?

migrated from serverfault.com Nov 1 '16 at 21:53

This question came from our site for system and network administrators.

  • 2
    Did you turn it off and turn it back on again? – JBaldridge Nov 1 '16 at 21:50
  • I had not, for two reasons: I want to know how and why, and I was rendering. – Mave Nov 4 '16 at 8:58
  • This behaviour can be caused by a rootkit that intercepts requests to the file. But this is highly improbable in this case as it's extremily unlikely that it would choose "/MyFolder/images/file1.png" as a file to protect. – ivan_pozdeev Nov 4 '16 at 10:51
2

This could be caused by a corruption of the NTFS ACLs; try running chkdsk on the volume.

Or it could be that the system security policy doesn't grant Administrators the right to take ownership of files (either because it was changed or because it became corrupted); run gpedit.msc, go to Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment and make sure the Administrators group has the Take ownership of files or other objects privilege.

  • chkdsk is running, but not expecting any weird stuff to pop up. Administrator group has access to the Take ownership privilege. – Mave Nov 1 '16 at 21:04
1

1a. First navigate to the directory in Windows Explorer. Hold down CTRL + Right click – Open Command Window here. You may have to close that CMD prompt and open CMD as administrator.

  1. Type:

rmdir (foldername) /s # gives error del . # gives error takeown /f (foldername) /r /d y # gives error

  1. Since those don’t work, lets try doing it running as NTAUTHORITY\SYSTEM: type psexec -sid cmd.exe whoami #should return system Try step 2 again, still no go #NOTE: This assumes you have PSTools installed and added to your PATH variable.

NOTE: You used to be able to run “at (time) /interactive cmd.exe” #Where (time) is the current time (HH:MM 24 hour) plus 1 minute. The /interactive switch has been depreciated though.

  1. Right click each file with the Unlocker windows explorer extension – Delete on next reboot. This works!

  2. If you have a “path too long” error, just type:

robocopy c:\empty C:\deleteme /purge

NOTE: This will delete that folder (c:\deleteme) and all subfolders for you!

0

Boot a live *nix distro.
Depending on what you want to do with the file:

chown user .../file1.png && chmod 7777 .../file1.png

reboot in windows and you should be able to have your way with it.

or just delete it.

If you can be bothered trying to get your head around windows syntax, icalcs might work. Not being a windows user, I couldn't tell you how.

0

Hit start, type cmd, open as administrator. Type: net user administrator /active:yes Log off your account, log in as administrator You should now be able to delete the file. Log off, then log in your user account. At the cmd prompt, type: net user administrator /active:no

Scan for malware

  • Welcome to Super User! Please read the question again carefully. Your answer does not answer the original question. User already has full admin rights with UAC disabled and he's already tried what you suggest (it says in the question). – DavidPostill Nov 4 '16 at 11:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.