# How to monitor folder permission changes

I have found that my temp folder permissions sometimes get changed and this causes many programs to malfunction, as they can't write to the folder anymore. I then manually set the permissions back to their correct state, but they get changed again after some days, and this is very frustrating. I want to find out which program is changing them.

Is there a way to know which executable changed the permissions of a folder? Is there a way to monitor or log permission changes?

EDIT I also accept any comment or answer that helps me in preventing the programs to modify the permissions

• Your best bet is likely ProcMon (live.sysinternals.com), because the USN journal doesn't keep track of the ACLs, it seems and neither do the FS change notifications (check MSDN docs on ReadDirectoryChangesW). – 0xC0000022L Mar 4 '13 at 16:34
• Ok, I run ProcMon and filter the entries that have temp as path, but I have a little bit trouble in distinguishing the entries that are affecting the security settings – Pincopallino Mar 4 '13 at 17:31

You have two options, depending on your preference or specific needs:

## Procmon

Using Procmon, you want to set filters for the following:

1. Operation: filter for SetSecurityFile (use the "is" condition). This will show you any event in which an ACL is modified on a file or directory.
2. Path: Set this to the path to your temp folder. If your path is c:\path\to\temp, enter that. Again use the "is" condition, however you can use the "begins with" condition if you want to see ACL changes to sub folders.

If this needs to be long-running, you most likely want to enable the "Drop Filtered Events" option on the Tools menu.

The benefits of using Procmon are that it is simple to download and run with little preconfiguration at the expense of needing to keep it running at all times.

## File System Auditing

To use auditing, you'll need to do the following:

1. In the local policy (or applicable GPO) of the computer, enable Success audits via one of the following:
• Computer Configuration | Policies | Windows Settings | Security Settings | Local Policies | Audit Policy | Audit Object Access
• Computer Configuration | Policies | Windows Settings | Security Settings | Advanced Audit Policy Configuration | Audit Policies | Object Access | Audit File System
2. Enable auditing on your directory by right-clicking on the directory in Windows Explorer and selecting Properties | Security | Advanced | Auditing | Edit... | Add.... Next, enter Everyone as the security principal to audit. Last, check the "Successful" box for "Change permissions".
3. In the Security event log, look for event 4663 or 4670.
• I used your second method, which is very neat and has the advantage that it works also at startup. Thank you very much for your extensive answer! – Pincopallino Apr 10 '13 at 18:24