Some-thing or Some-one is changing file permissions occasionally on files on my Windows Server 2003 Domain Controller.

I'd like to track these changes. Initially I thought one could do this with Auditing via the Default Domain Controllers Policy, but while there is File Access auditing, I can't seem to find any sort of tracking for permissions changes.

I'd like to know if permissions changes happen on a certain set of files and directories whether a human or an application/service or even a disk error makes the change. I'd like to see what has changed, when it has changed and, possibly, what did it.

Is this possible?

  • What files are being modified and where are they. Besides dns and ad what other processes are running on the dc, hint there shouldn't be anything! – tony roth Jul 16 '10 at 18:41
  • Sorry, this computer also is a server for Quickbooks files. So, there is at least that running. There's also Exchange and backup software. I am trying to monitor a series of files pertaining to Quickbooks. – tcv Jul 16 '10 at 22:13

The built-in auditing for permission changes is handled through "Audit object access". If you look at the types of auditing that you can configure on a filesystem object you'll see that "Change Permissions" is one of the auditable items.

You're going to find that the log data generated by "Audit object access" is painfully verbose and difficult to parse, though. The actual permissions change (a "WRITE_DAC" event-- DAC meaning "Discretionary Access Control") will only reference a handle ID, so you'll have to parse backwards from the WRITE_DAC to find the handle open event. That event will tell you the name of the object being modified by the WRITE_DAC. Rather tiresome...

I had one Customer who explored using the CPTRAX File System Audit Trails for Windows utility for a similiar situation. I don't believe they ever actually implemented it, but as part of their exploration I reviewed the documentation and found that it appeared to be "sane", at least. I can't give any kind of personal recommendation for it, but it looked like it would do what the manufacturer claimed.


I had a few minutes tonight, so I wrote a crazy, painful CMD script to track permission changes. Parsing the event log is painful (and really requires a state machine to get it right), so this is a second-best attempt.

The script expects to be passed the filename of a file to track the permissions on, and a path and "base" filename of a file to store the permissions observed in. Let's assume a fake set of arguments: perm-track.cmd "C:\Program Files\Some Application\File To Track.exe" "C:\Permission Tracker\File to Track.exe"

The first time the script runs (at, say, 12:51:30 on July 18, 2010) the permissions set on "C:\Program Files\Some Application\File To Track.exe" will be stored in the file "C:\Permission Tracker\File to Track.exe.20100718_125130.permissions.txt".

The next time the script is run, with the same arguments, the permissions stored in the most recently-created "C:\Permission Tracker\File to Track.exe.*.permissions.txt" file will be compared against the current permissions on "C:\Program Files\Some Application\File To Track.exe". If there's a change, the new permissions will be stored in an appropriately named "File to Track.exe.ISODATE.permissions.txt" file in "C:\Permission Tracker".

Wiring this up to send emails would be pretty easy. Running it as a scheduled task, or in a loop would be pretty easy, too.

This is definitely quick-and-dirty, and it probably has bugs, but this script might do what you need.

@echo off

if "%~1"=="" goto syntax
if not exist "%1" goto syntax

if "%~2"=="" goto syntax

rem Get an ISO date (working around shell silliness re: hours earlier than 10:00)


rem Save current permissions into a temporary file
cacls %1 >%TEMPFILE%

rem Get filename of last set of permissions reported
for /f "usebackq delims=" %%f in (`dir /od /b /s "%~2*.permissions.txt"`) do SET LASTFILE=%%f

rem Was there no last file? If so, put current temp file in place
if "%LASTFILE%"=="" (
  move %TEMPFILE% "%~2.%ISODATE%.permissions.txt"
) else (
  rem Compare current permission to last permission-- if it's different, annotate current permission
  if errorlevel 1 move %TEMPFILE% "%~2.%ISODATE%.permissions.txt"

goto end

echo Really, really poor man's permission change tracker.
echo Call with path of file to monitor on command-line as first argument,
echo path and base filename to store "report" files of permission changes
echo as the second argument.
echo example:
echo   perm-track.cmd "C:\Program Files\Some Application\File To Track.exe" "C:\Permission Tracker\File to Track"

| improve this answer | |
  • Ok. I see what you mean. But maybe I have this configured wrong? I turned on Auditing via Group Policy and I added the "Everyone" group to the Auditing area of the particular directory I want to monitor. I seem to be getting other entries in the Event Viewer however, like changes on permissions and what not. Any idea? – tcv Jul 16 '10 at 21:58
  • Yes, it seems that when I turn Object Access at the Group Policy level I get events for registry key access among other things. I really only want to see changes to a particular set of folders and files. Is that possible? – tcv Jul 16 '10 at 22:05
  • 1
    Unfortunately, object access auditing logs a lot of extraneous data. It's not a good solution, really, unless you're going to put in the time to parse the data. A third-party utility is going to be more pleasant to use, but the tradeoff there is, obviously, money. – Evan Anderson Jul 16 '10 at 22:49
  • Have any tips on parsing? ;-) – tcv Jul 17 '10 at 16:05
  • Ok, now you're just making me blush... – tcv Jul 20 '10 at 15:58

Use a host based IDS, which is sometimes referred to as a filesystem IDS. I've used AIDE successfully against Windows before. It can be compiled with cygwin.

An alternative to AIDE is OSSEC, which appears to have a Windows port.

| improve this answer | |
  • Will AIDE actually return which user or process made a change? I haven't got any experience with the tool but, while it appears it can assess the integrity of files (and, presumably, permissions), it doesn't look like it has any mechanism to shim into the OS to receive notifications of the details of the invocation of a change (like an "Object access" audit event would). This might help the poster figure out when the permissiosn are changed, but I don't think it'll help him find out how / why they're being changed (at least, in a direct sense... it could help correlation effors). – Evan Anderson Jul 16 '10 at 20:29
  • I don't know of HIDS that does process. All I've used report on permissions and ownership, if desired. It would not be a realtime notification but a differential notification upon runtime. – Warner Jul 16 '10 at 20:51

Varonis DatAdvantage for Windows is a great way to solve this issue. It monitors all file system events (create, open, delete, move, modify, permission change) and builds a searchable audit trail. You can setup recurring reports or real-time alerts based on trigger criteria, such as a permission change on your DC or when someone is elevated to Domain Admin.

Perhaps the best part is that DatAdvantage doesn't require native auditing (which can be slow and taxing) and never writes to disk on the servers that you monitor, so it's super low overhead.

(Disclosure: I work for Varonis, but wouldn't post this if I didn't think it were a fit.)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.