Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a number of servers in the corporate domain that seem to randomly lose ACL permissions to the TEMP folders (c:\temp, c:\windows\temp and any temp folder defined in the environment variables).

Instead of the normal permissions (administrators full control, users read/write, network service read etc.) - the folder is reset to Everyone - read.

Is there a tool that will allow me to monitor the folders in question to see who/what/when makes the change?

I'm currently trying to use the windows auditing system, but it's not perfect - on windows 2003 it doesn't have a specific event for folder permissions change. And anyway, the security event log is getting filled up EXTREMELY fast by regular logins and our hardening software's routine scans.

Any idea where I can look?

share|improve this question

You should be able to filter this a bit anyway, but if the log is being completely filled too often you can temporarily disable most of the other security auditing and simply audit "Change permissions" (particularly the "successful" ones).

share|improve this answer
Keep in mind also that you can monitor particular folders for this event. – Chris N Nov 10 '11 at 17:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.