There seems to be a process that changes the file ownership on my corporate Windows 7 laptop.

I have the same account name on two different domains, say GLOBAL\hemal and CORP\hemal. I login to my desktop using CORP\hemal, the other account is disabled.

I noticed that several files on my machine are owned by GLOBAL\hemal. In general this does cause any issue, I realized this only because cygwin complained something about a directory not being safe for creating temp files.

So I changed the file owner to CORP\hemal. A little later I got the error again and saw that the owner had changed back to GLOBAL\hemal. So I changed the owner on two folders C:\cygwin and C:\eclipse, which were both owned by the GLOBAL to CORP and wrote a small script to log their ownership. I confirmed that the onwership keeps getting changed by to GLOBAL sooner or later.

So my questions are:

  1. Are there any security processes on Windows 7 that would revert the file ownership in this fashion? It seems all files/directories owned by CORP get changed to GLOBAL

  2. Is there a way to identify the process that is making these changed? It doesn't seem like the filesystem watcher can do this, but I am wondering if there is way to make the ownership immutable and thereby get some error message from the offending process.

  • What is the full path? Are we talking the system drive, a user profile directory, remote network drive path?
    – Ramhound
    Mar 7, 2013 at 16:24
  • All local files and directories. I don't know what you mean by system drive but this happens in files under user directory c:\user\hemal as well as to c:\eclipse and c:\cygwin, it seems all files on my machine owned by CORP get their owner modified to GLOBAL Mar 7, 2013 at 16:35
  • Do you have the ability to change the username on one of the domains as a test? A system drive is the drive where the operating system is installed on.
    – Ramhound
    Mar 7, 2013 at 18:33
  • No, I cannot change anything in these domains. `C:` is my system drive. Mar 7, 2013 at 18:42

1 Answer 1


Using procmon from sysinternals I found that c:\Program Files\Quest\vmover changed the ownership.

Still trying to find out what vmover is and why it is changing ownership of files, but procmon is a great tool that answered my second question.

I will update this answer when I find out more about vmover.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.