strange file ownership changes

Question

There seems to be a process that changes the file ownership on my corporate Windows 7 laptop.

I have the same account name on two different domains, say GLOBAL\hemal and CORP\hemal. I login to my desktop using CORP\hemal, the other account is disabled.

I noticed that several files on my machine are owned by GLOBAL\hemal. In general this does cause any issue, I realized this only because cygwin complained something about a directory not being safe for creating temp files.

So I changed the file owner to CORP\hemal. A little later I got the error again and saw that the owner had changed back to GLOBAL\hemal. So I changed the owner on two folders C:\cygwin and C:\eclipse, which were both owned by the GLOBAL to CORP and wrote a small script to log their ownership. I confirmed that the onwership keeps getting changed by to GLOBAL sooner or later.

So my questions are:

1. Are there any security processes on Windows 7 that would revert the file ownership in this fashion? It seems all files/directories owned by CORP get changed to GLOBAL

2. Is there a way to identify the process that is making these changed? It doesn't seem like the filesystem watcher can do this, but I am wondering if there is way to make the ownership immutable and thereby get some error message from the offending process.

Answer 1

Using procmon from sysinternals I found that c:\Program Files\Quest\vmover changed the ownership.

Still trying to find out what vmover is and why it is changing ownership of files, but procmon is a great tool that answered my second question.

I will update this answer when I find out more about vmover.