Hackviking He killed Chuck Norris, he ruled dancing so he took up a new hobby…


Unable to display current owner

Run across a strange problem today. On a test server running Microsoft Windows Server 2008 one developer discovered that he couldn't delete a file even though he was admin on the system. I connect to the system and realize that I have the same problem, even though I'm domain admin. When I checked the permissions on the file it just displayed that I didn't have the permissions to see the ACL and redirected me to the ownership tab. All I could see there was "Unable to display owner". When I tried to take ownership I got "Access denied again". So back to the trusted CMD i thought! Same thing cacls.exe returned the same thing and gave me Access denied...

I then ran psexec from sysinternals:psexex -s cmd.exe
This starts the CMD as local system account. Now I have access to anything, or so i thought. NOT!
Same thing again, couldn't do anything with the file or view any options. Back to the drawingboard and then I came up with a reboot. Tried it and failed, it was a desperate measure and it was pretty clear that it wouldn't fix anything.

Then I found the solution, I needed to access the file without windows pounding the NTFS rights in my head. I really didn't want to rip out the hard drive and put it in to an other server to do it. So this is what I did....

Download MoveFile from sysinternals.
Run cmd.exe as administrator.
Run movefile c:\{path}\{fucked-up-file} ""

That will trigger the operating system to delete the file during system boot.