RE: Force Permission / Ownership Changes

Hi Kyle,

Thank you for your post here.

First I need to confirm the issue: You get access denied error when access
some folders. You tried to take ownership of the folders but the access was
still denied. If I am off base, please feel free to let me know.

Regarding this issue, first I'd like to introduce something about take
ownership feature:

The "Take ownership of files or other objects" user right/privilege
security setting determines which users can take ownership of any securable
object in the system, including Active Directory objects, files and
folders, printers, registry keys, processes, and threads. The "Take
Ownership of files or other objects" (SeTakeOwnershipPrivilege) user right
is assigned to the Administrators group by default on Windows XP and
Windows Server 2003.

The permission "Take Ownership" is authorization to perform an operation on
a specific object, such as a file. Permissions can be granted by owners and
by anyone with the permission to grant permissions, which normally includes
administrators on the system. By default, in Windows Server 2003, the owner
is the creator of the object. If the creator of an object is a member of
the Administrators group, the Administrators group is the owner. The
current owner can grant the Take ownership permission to others, allowing
those users to take ownership at any time. A user granted the "Take
ownership" permission can take ownership of the object or assign ownership
to any group that the user is a member of. A user who has the Restore files
and directories privilege can double-click Other users and groups and
choose any user or group to assign ownership to.

Based on my research, I suggest we try the following steps to see if we can
resolve this issue:

1. Ensure you logon the SBS with domain administrator.

2. Based on my research, this issue might be caused by some third-party
software installed on the server. At this point, I wonder if it's possible
for you to reboot the server. Please understand that this would be a
necessary step for us to troubleshoot the issue. To do a clean boot, please
follow the steps below:

To clean boot the problematic computer, please use the steps below:
a. Click Start, click Run, and then in the Open box, type "MSCONFIG"
(without the quotation marks). Click OK.

b. In the System Configuration Utility (MSConfig) window, click to select
the Selective Startup button.

c. Click to clear the check mark from the "Load startup items" below
Selective Startup.

d. Click the Services tab, click to check the "Hide All Microsoft Services"
box, and remove all the check marks from the remaining Non-Microsoft
Services. Please note that the Exchange services could be marked as
non-Microsoft. Please do not disable those services.

e. Click OK to close the MSConfig window. Click Yes when you are asked to
restart your computer in order to enable the changes.

f. After restarting, please check whether this issue will reoccur.

3. Also, please check if you have configured quote for local administrator.
If yes, please disable it and re-test the issue:

a. Open the Properties page of the volume.
b. In Quota tab, uncheck "Enable quota management".
c. Re-test the issue.

4. If you add another user as domain administrator, then logon the new
administrator, and try to take ownership. Will the problem persists?

If problem persists, please collect the following information for further
analysis:

1. Does the issue happen to all the folders you move from the old SBS?

2. How do you migrate the user from old SBS to new SBS?

3. Please capture screenshots of the error messages and send the pictures
to me at v-terliu@xxxxxxxxxxxxx

4. Collect filemon log:

a. Please visit the following link to download and save the Filemon
version:
http://download.sysinternals.com/Files/Filemon.zip

b. Start FileMon and reproduce the issue.
c. Stop Filemon and save the log.
d. Send the filemon log to us.

I hope these steps will give you some help.

Thanks and have a nice day!

Best regards,

Terence Liu (MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
From: claritycomputerservices@xxxxxxxxx
Newsgroups: microsoft.public.windows.server.sbs
Subject: Force Permission / Ownership Changes
Date: Wed, 6 Aug 2008 16:43:35 -0700 (PDT)
Organization: http://groups.google.com
Lines: 28
Message-ID:
<3ccd8082-197e-4b97-a1cd-85dac43f65da@xxxxxxxxxxxxxxxxxxxxxxxxxx>
NNTP-Posting-Host: 207.148.194.172
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Trace: posting.google.com 1218066215 4130 127.0.0.1 (6 Aug 2008 23:43:35
GMT)
X-Complaints-To: groups-abuse@xxxxxxxxxx
NNTP-Posting-Date: Wed, 6 Aug 2008 23:43:35 +0000 (UTC)
Complaints-To: groups-abuse@xxxxxxxxxx
Injection-Info: 8g2000hse.googlegroups.com; posting-host=207.148.194.172;
posting-account=7r7vVgoAAAAquGqSxHipQbveCx05nHTU
User-Agent: G2/1.0
X-HTTP-UserAgent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET
CLR
1.1.4322),gzip(gfe),gzip(gfe)
Bytes: 2307
Path:
TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTFEEDS01.phx.gbl!newsfeed0
0.sul.t-online.de!t-online.de!border2.nntp.dca.giganews.com!nntp.giganews.co
m!postnews.google.com!8g2000hse.googlegroups.com!not-for-mail
Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:118403
X-Tomcat-NG: microsoft.public.windows.server.sbs

I'm in the process of migrating users from an installation of 2003 SBS
to a fresh installation of SBS and I'm having a heck of a time with
some of the ownership and permissions on the files. Many of the
folders and files will not allow me to take ownership or modify the
permissions so that I can the user's data (documents, pictures etc.)
to the new user shared folder.
When attempting ot move the folders or files I get access denied and
when attempting to change the permission or ownership I either get
access denied or that there is not enough free disk space (of which
there is over 40GB free)

Here's a list of everything that I have tried so far:

Inheriting the permissions from other folders
"Replace permissions entries on child objects..."

"Replace owner on subcontainers and objects"
Using xcacls.vbs to change the permissions (i'm not very well versed
in scripting so if there is a way to use xcacls to force permissions
let me know)

Booting up the previous installation of SBS and attempting the change
the permissions is now out of the question as well because many of the
folders have half-way propogated permission settings

Thanks in Advance

Kyle


.