On Sun, Jan 15, 2012 at 9:23 PM, Jay Kulsh <jayku...@csi.com> wrote: > In addition to > xcopy K:\Vid* D:\ /O /X /E /H /K /C /I /Q /Y > I had also executed: > xcopy K:\Vid* C:\ /O /X /E /H /K /C /I /Q /Y >
Okay, this is starting to make a little bit more sense. What, exactly, is in the source (K:\) that would cause those commands to overwrite critical permissions and/or files? >>Is using SECEdit to reset security permissions the right move? Thanks. Not until we understand what you'd be resetting them to, or why the commands you used caused a problem. Also, do you have an identical system to obtain the correct permissions from? Are you auditing the security on these boxes? * * *ASB* *http://XeeMe.com/AndrewBaker* *Harnessing the Advantages of Technology for the SMB market… * On Sun, Jan 15, 2012 at 9:23 PM, Jay Kulsh <jayku...@csi.com> wrote: > In addition to > xcopy K:\Vid* D:\ /O /X /E /H /K /C /I /Q /Y > I had also executed: > xcopy K:\Vid* C:\ /O /X /E /H /K /C /I /Q /Y > > I could not access C: drive remotely so assumed that would not be able to > see event logs. But in fact I can see event logs of this server. Thanks > Andrew for leading me that way, but logs don't tell me much. Here they are: > > In System Event logs: (After reboot) > > Source: Server Event ID: 2511 (Warning) > "The server service was unable to recreate the share Baker because the > directory D:\Baker no longer exists... " > > Source: Service Control Manager Event ID: 7023 (Error) > The Windows Search service terminated with the following error: > Access is denied. > ** This error repeats periodically, every few hours ** > > In Application Event log, these errors started right when C: and D: became > invisible. > > Source: ESENT Event ID: 491 (Error) > wuaueng.dll (956) SUS20ClientDataStore: An attempt to determine the > minimum I/O block size for the volume "C:\" containing > "C:\Windows\SoftwareDistribution\DataStore\DataStore.edb" failed with > system error 5 (0x00000005): "Access is denied. ". The operation will fail > with error -1032 (0xfffffbf8). > > ** This error is repeated about every hour ** > > Source: ESENT Event ID: 439 (Error) > wuaueng.dll (956) SUS20ClientDataStore: Unable to write a shadowed header > for file C:\Windows\SoftwareDistribution\DataStore\DataStore.edb. Error > -1032. > > Source: ESENT Event ID: 473 (Error) > wuaueng.dll (956) SUS20ClientDataStore: Database > C:\Windows\SoftwareDistribution\DataStore\DataStore.edb was partially > detached. Error -1032 encountered updating database headers. > > On searching on these ESENT errors, found articles about Exchange, but > this is just a file server. Thanks again to all of you. > > Jay > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
