Re: Find out what is doing this
sysinternals tools from the microsoft site ... process monitor On Thu, Mar 31, 2011 at 9:21 AM, itli...@imcu.com itli...@imcu.com wrote: Have a third party that creates a file before it runs. For about 3 weeks now it has failed to run automagically but when we run it manually it runs. I have process monitor running but I can not tell what is trying to create the process so I can figure out what permissions to look at? What freeware would help with this? From my operators: We’re also using a piece of software called Process Monitor and we were able to pin it down last night to a ‘Sharing Violation’ . ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
RE: Find out what is doing this
When you say automagically do you mean via something like task scheduler? I have seen this several times with Task Scheduler. It is usually the credentials setup in the task. Sometimes it happens because of a PW change, sometimes it is a simple check of the tazks and make sure it is set to run whether the user is logged in or not. Either way it works manually since you are logged in probably with a Userid that has privledges to run that task and use the files. From: itli...@imcu.com [itli...@imcu.com] Sent: Thursday, March 31, 2011 8:21 AM To: NT System Admin Issues Subject: Find out what is doing this Have a third party that creates a file before it runs. For about 3 weeks now it has failed to run automagically but when we run it manually it runs. I have process monitor running but I can not tell what is trying to create the process so I can figure out what permissions to look at? What freeware would help with this? From my operators: We’re also using a piece of software called Process Monitor and we were able to pin it down last night to a ‘Sharing Violation’ . ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.commailto:listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin CONFIDENTIALITY NOTICE: This e-mail and any attachments are confidential. If you are not the intended recipient, you do not have permission to disclose, copy, distribute, or open any attachments. If you have received this e-mail in error, please notify us immediately by returning it to the sender and delete this copy from your system. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
RE: Find out what is doing this
I have it running. Where to I see who/what is holding it so it can't delete and recreate when it needs to? From: Erik Goldoff [mailto:egold...@gmail.com] Posted At: Thursday, March 31, 2011 9:25 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: Re: Find out what is doing this sysinternals tools from the microsoft site ... process monitor On Thu, Mar 31, 2011 at 9:21 AM, itli...@imcu.com itli...@imcu.com wrote: Have a third party that creates a file before it runs. For about 3 weeks now it has failed to run automagically but when we run it manually it runs. I have process monitor running but I can not tell what is trying to create the process so I can figure out what permissions to look at? What freeware would help with this? From my operators: We're also using a piece of software called Process Monitor and we were able to pin it down last night to a 'Sharing Violation' . ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
Re: Find out what is doing this
On Thu, Mar 31, 2011 at 9:21 AM, itli...@imcu.com itli...@imcu.com wrote: Have a third party that creates a file before it runs. You need to explain that using a lot more words. :) We’re also using a piece of software called Process Monitor and we were able to pin it down last night to a ‘Sharing Violation’ . Sharing Violation nominally means a file was already open or locked when the program tried to access it. Of course, that's also one of the error codes that Microsoft sometimes uses for completely unrelated things, so there's a (relatively small) chance it's something else. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
RE: Find out what is doing this
It is a scheduled task and the operators are just giving the task a run when they get the error message. So the same perms should be used but it is failing?? From: Terry Dickson [mailto:te...@treasurer.state.ks.us] Posted At: Thursday, March 31, 2011 9:27 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: RE: Find out what is doing this When you say automagically do you mean via something like task scheduler? I have seen this several times with Task Scheduler. It is usually the credentials setup in the task. Sometimes it happens because of a PW change, sometimes it is a simple check of the tazks and make sure it is set to run whether the user is logged in or not. Either way it works manually since you are logged in probably with a Userid that has privledges to run that task and use the files. From: itli...@imcu.com [itli...@imcu.com] Sent: Thursday, March 31, 2011 8:21 AM To: NT System Admin Issues Subject: Find out what is doing this Have a third party that creates a file before it runs. For about 3 weeks now it has failed to run automagically but when we run it manually it runs. I have process monitor running but I can not tell what is trying to create the process so I can figure out what permissions to look at? What freeware would help with this? From my operators: We're also using a piece of software called Process Monitor and we were able to pin it down last night to a 'Sharing Violation' . ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin CONFIDENTIALITY NOTICE: This e-mail and any attachments are confidential. If you are not the intended recipient, you do not have permission to disclose, copy, distribute, or open any attachments. If you have received this e-mail in error, please notify us immediately by returning it to the sender and delete this copy from your system. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
RE: Find out what is doing this
Here is the process .bat creates setenv.bat in dir x About every 60 seconds all day long. At around 11:00pm each night this process fails with a sharing violation of setenv.bat. Rerun the automated task and it runs. The problem is this file is being Created all day long no issues just around 11:00pm. With process monitor we see the sharing violation but can't tell what was trying to share it or what was sharing it at the time?? Need more guidance with process monitor I guess? Can I turn on auditing for dir x ? Will Windows give me more of a feel for what failed? -Original Message- From: Ben Scott [mailto:mailvor...@gmail.com] Posted At: Thursday, March 31, 2011 9:34 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: Re: Find out what is doing this On Thu, Mar 31, 2011 at 9:21 AM, itli...@imcu.com itli...@imcu.com wrote: Have a third party that creates a file before it runs. You need to explain that using a lot more words. :) We're also using a piece of software called Process Monitor and we were able to pin it down last night to a 'Sharing Violation' . Sharing Violation nominally means a file was already open or locked when the program tried to access it. Of course, that's also one of the error codes that Microsoft sometimes uses for completely unrelated things, so there's a (relatively small) chance it's something else. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
RE: Find out what is doing this
Is there a backup going on at that time? *** Charlie Kaiser charl...@golden-eagle.org Kingman, AZ *** -Original Message- From: itli...@imcu.com [mailto:itli...@imcu.com] Sent: Thursday, March 31, 2011 6:55 AM To: NT System Admin Issues Subject: RE: Find out what is doing this Here is the process .bat creates setenv.bat in dir x About every 60 seconds all day long. At around 11:00pm each night this process fails with a sharing violation of setenv.bat. Rerun the automated task and it runs. The problem is this file is being Created all day long no issues just around 11:00pm. With process monitor we see the sharing violation but can't tell what was trying to share it or what was sharing it at the time?? Need more guidance with process monitor I guess? Can I turn on auditing for dir x ? Will Windows give me more of a feel for what failed? -Original Message- From: Ben Scott [mailto:mailvor...@gmail.com] Posted At: Thursday, March 31, 2011 9:34 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: Re: Find out what is doing this On Thu, Mar 31, 2011 at 9:21 AM, itli...@imcu.com itli...@imcu.com wrote: Have a third party that creates a file before it runs. You need to explain that using a lot more words. :) We're also using a piece of software called Process Monitor and we were able to pin it down last night to a 'Sharing Violation' . Sharing Violation nominally means a file was already open or locked when the program tried to access it. Of course, that's also one of the error codes that Microsoft sometimes uses for completely unrelated things, so there's a (relatively small) chance it's something else. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
RE: Find out what is doing this
No backups at the time of error. -Original Message- From: Charlie Kaiser [mailto:charl...@golden-eagle.org] Posted At: Thursday, March 31, 2011 9:58 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: RE: Find out what is doing this Is there a backup going on at that time? *** Charlie Kaiser charl...@golden-eagle.org Kingman, AZ *** -Original Message- From: itli...@imcu.com [mailto:itli...@imcu.com] Sent: Thursday, March 31, 2011 6:55 AM To: NT System Admin Issues Subject: RE: Find out what is doing this Here is the process .bat creates setenv.bat in dir x About every 60 seconds all day long. At around 11:00pm each night this process fails with a sharing violation of setenv.bat. Rerun the automated task and it runs. The problem is this file is being Created all day long no issues just around 11:00pm. With process monitor we see the sharing violation but can't tell what was trying to share it or what was sharing it at the time?? Need more guidance with process monitor I guess? Can I turn on auditing for dir x ? Will Windows give me more of a feel for what failed? -Original Message- From: Ben Scott [mailto:mailvor...@gmail.com] Posted At: Thursday, March 31, 2011 9:34 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: Re: Find out what is doing this On Thu, Mar 31, 2011 at 9:21 AM, itli...@imcu.com itli...@imcu.com wrote: Have a third party that creates a file before it runs. You need to explain that using a lot more words. :) We're also using a piece of software called Process Monitor and we were able to pin it down last night to a 'Sharing Violation' . Sharing Violation nominally means a file was already open or locked when the program tried to access it. Of course, that's also one of the error codes that Microsoft sometimes uses for completely unrelated things, so there's a (relatively small) chance it's something else. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
RE: Find out what is doing this
Crank up auditing on the file and see who's accessing it. Also, with process monitor, see what other processes are involved... *** Charlie Kaiser charl...@golden-eagle.org Kingman, AZ *** -Original Message- From: itli...@imcu.com [mailto:itli...@imcu.com] Sent: Thursday, March 31, 2011 7:02 AM To: NT System Admin Issues Subject: RE: Find out what is doing this No backups at the time of error. -Original Message- From: Charlie Kaiser [mailto:charl...@golden-eagle.org] Posted At: Thursday, March 31, 2011 9:58 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: RE: Find out what is doing this Is there a backup going on at that time? *** Charlie Kaiser charl...@golden-eagle.org Kingman, AZ *** -Original Message- From: itli...@imcu.com [mailto:itli...@imcu.com] Sent: Thursday, March 31, 2011 6:55 AM To: NT System Admin Issues Subject: RE: Find out what is doing this Here is the process .bat creates setenv.bat in dir x About every 60 seconds all day long. At around 11:00pm each night this process fails with a sharing violation of setenv.bat. Rerun the automated task and it runs. The problem is this file is being Created all day long no issues just around 11:00pm. With process monitor we see the sharing violation but can't tell what was trying to share it or what was sharing it at the time?? Need more guidance with process monitor I guess? Can I turn on auditing for dir x ? Will Windows give me more of a feel for what failed? -Original Message- From: Ben Scott [mailto:mailvor...@gmail.com] Posted At: Thursday, March 31, 2011 9:34 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: Re: Find out what is doing this On Thu, Mar 31, 2011 at 9:21 AM, itli...@imcu.com itli...@imcu.com wrote: Have a third party that creates a file before it runs. You need to explain that using a lot more words. :) We're also using a piece of software called Process Monitor and we were able to pin it down last night to a 'Sharing Violation' . Sharing Violation nominally means a file was already open or locked when the program tried to access it. Of course, that's also one of the error codes that Microsoft sometimes uses for completely unrelated things, so there's a (relatively small) chance it's something else. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
Re: Find out what is doing this
Is there another task that runs setenv.bat at 11pm? If so, that'll cause your sharing violation, because they both fire at the same time, and the file can't be saved. On Thu, Mar 31, 2011 at 10:05 AM, Charlie Kaiser charl...@golden-eagle.orgwrote: Crank up auditing on the file and see who's accessing it. Also, with process monitor, see what other processes are involved... *** Charlie Kaiser charl...@golden-eagle.org Kingman, AZ *** -Original Message- From: itli...@imcu.com [mailto:itli...@imcu.com] Sent: Thursday, March 31, 2011 7:02 AM To: NT System Admin Issues Subject: RE: Find out what is doing this No backups at the time of error. -Original Message- From: Charlie Kaiser [mailto:charl...@golden-eagle.org] Posted At: Thursday, March 31, 2011 9:58 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: RE: Find out what is doing this Is there a backup going on at that time? *** Charlie Kaiser charl...@golden-eagle.org Kingman, AZ *** -Original Message- From: itli...@imcu.com [mailto:itli...@imcu.com] Sent: Thursday, March 31, 2011 6:55 AM To: NT System Admin Issues Subject: RE: Find out what is doing this Here is the process .bat creates setenv.bat in dir x About every 60 seconds all day long. At around 11:00pm each night this process fails with a sharing violation of setenv.bat. Rerun the automated task and it runs. The problem is this file is being Created all day long no issues just around 11:00pm. With process monitor we see the sharing violation but can't tell what was trying to share it or what was sharing it at the time?? Need more guidance with process monitor I guess? Can I turn on auditing for dir x ? Will Windows give me more of a feel for what failed? -Original Message- From: Ben Scott [mailto:mailvor...@gmail.com] Posted At: Thursday, March 31, 2011 9:34 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: Re: Find out what is doing this On Thu, Mar 31, 2011 at 9:21 AM, itli...@imcu.com itli...@imcu.com wrote: Have a third party that creates a file before it runs. You need to explain that using a lot more words. :) We're also using a piece of software called Process Monitor and we were able to pin it down last night to a 'Sharing Violation' . Sharing Violation nominally means a file was already open or locked when the program tried to access it. Of course, that's also one of the error codes that Microsoft sometimes uses for completely unrelated things, so there's a (relatively small) chance it's something else. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
RE: Find out what is doing this
We are putting process monitor on all servers to see who might be using it but we haven't found any so far. Could a local security policy or gpo cause this kind of issue? From: Jonathan Link [mailto:jonathan.l...@gmail.com] Posted At: Thursday, March 31, 2011 10:09 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: Re: Find out what is doing this Is there another task that runs setenv.bat at 11pm? If so, that'll cause your sharing violation, because they both fire at the same time, and the file can't be saved. On Thu, Mar 31, 2011 at 10:05 AM, Charlie Kaiser charl...@golden-eagle.org wrote: Crank up auditing on the file and see who's accessing it. Also, with process monitor, see what other processes are involved... *** Charlie Kaiser charl...@golden-eagle.org Kingman, AZ *** -Original Message- From: itli...@imcu.com [mailto:itli...@imcu.com] Sent: Thursday, March 31, 2011 7:02 AM To: NT System Admin Issues Subject: RE: Find out what is doing this No backups at the time of error. -Original Message- From: Charlie Kaiser [mailto:charl...@golden-eagle.org] Posted At: Thursday, March 31, 2011 9:58 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: RE: Find out what is doing this Is there a backup going on at that time? *** Charlie Kaiser charl...@golden-eagle.org Kingman, AZ *** -Original Message- From: itli...@imcu.com [mailto:itli...@imcu.com] Sent: Thursday, March 31, 2011 6:55 AM To: NT System Admin Issues Subject: RE: Find out what is doing this Here is the process .bat creates setenv.bat in dir x About every 60 seconds all day long. At around 11:00pm each night this process fails with a sharing violation of setenv.bat. Rerun the automated task and it runs. The problem is this file is being Created all day long no issues just around 11:00pm. With process monitor we see the sharing violation but can't tell what was trying to share it or what was sharing it at the time?? Need more guidance with process monitor I guess? Can I turn on auditing for dir x ? Will Windows give me more of a feel for what failed? -Original Message- From: Ben Scott [mailto:mailvor...@gmail.com] Posted At: Thursday, March 31, 2011 9:34 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: Re: Find out what is doing this On Thu, Mar 31, 2011 at 9:21 AM, itli...@imcu.com itli...@imcu.com wrote: Have a third party that creates a file before it runs. You need to explain that using a lot more words. :) We're also using a piece of software called Process Monitor and we were able to pin it down last night to a 'Sharing Violation' . Sharing Violation nominally means a file was already open or locked when the program tried to access it. Of course, that's also one of the error codes that Microsoft sometimes uses for completely unrelated things, so there's a (relatively small) chance it's something else. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http
Re: Find out what is doing this
You're creating a batch file every 60 seconds, for some reason. At some point, one would expect it to run... I guess I am unclear on the process taking place. Is it creating the file and then running the file every 60 seconds? Or is it just creating the file every 60 seconds, and only running it once per day at 11pm? Could? I am not sure. Have you changed anything recently. On Thu, Mar 31, 2011 at 10:15 AM, itli...@imcu.com itli...@imcu.com wrote: We are putting process monitor on all servers to see who might be using it but we haven’t found any so far. Could a local security policy or gpo cause this kind of issue? *From:* Jonathan Link [mailto:jonathan.l...@gmail.com] *Posted At:* Thursday, March 31, 2011 10:09 AM *Posted To:* itli...@imcu.com *Conversation:* Find out what is doing this *Subject:* Re: Find out what is doing this Is there another task that runs setenv.bat at 11pm? If so, that'll cause your sharing violation, because they both fire at the same time, and the file can't be saved. On Thu, Mar 31, 2011 at 10:05 AM, Charlie Kaiser charl...@golden-eagle.org wrote: Crank up auditing on the file and see who's accessing it. Also, with process monitor, see what other processes are involved... *** Charlie Kaiser charl...@golden-eagle.org Kingman, AZ *** -Original Message- From: itli...@imcu.com [mailto:itli...@imcu.com] Sent: Thursday, March 31, 2011 7:02 AM To: NT System Admin Issues Subject: RE: Find out what is doing this No backups at the time of error. -Original Message- From: Charlie Kaiser [mailto:charl...@golden-eagle.org] Posted At: Thursday, March 31, 2011 9:58 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: RE: Find out what is doing this Is there a backup going on at that time? *** Charlie Kaiser charl...@golden-eagle.org Kingman, AZ *** -Original Message- From: itli...@imcu.com [mailto:itli...@imcu.com] Sent: Thursday, March 31, 2011 6:55 AM To: NT System Admin Issues Subject: RE: Find out what is doing this Here is the process .bat creates setenv.bat in dir x About every 60 seconds all day long. At around 11:00pm each night this process fails with a sharing violation of setenv.bat. Rerun the automated task and it runs. The problem is this file is being Created all day long no issues just around 11:00pm. With process monitor we see the sharing violation but can't tell what was trying to share it or what was sharing it at the time?? Need more guidance with process monitor I guess? Can I turn on auditing for dir x ? Will Windows give me more of a feel for what failed? -Original Message- From: Ben Scott [mailto:mailvor...@gmail.com] Posted At: Thursday, March 31, 2011 9:34 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: Re: Find out what is doing this On Thu, Mar 31, 2011 at 9:21 AM, itli...@imcu.com itli...@imcu.com wrote: Have a third party that creates a file before it runs. You need to explain that using a lot more words. :) We're also using a piece of software called Process Monitor and we were able to pin it down last night to a 'Sharing Violation' . Sharing Violation nominally means a file was already open or locked when the program tried to access it. Of course, that's also one of the error codes that Microsoft sometimes uses for completely unrelated things, so there's a (relatively small) chance it's something else. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums
RE: Find out what is doing this
Creating every 60 seconds or so. It is an environment variable batch creation. Creates time, date, etc... We had to stop a bunch of WSUS GPO's because of network lag. We have them all back on and we have rebooted all servers since but I am really thinking the coincidence lies with the disabling and enabling of the gpo's. From: Jonathan Link [mailto:jonathan.l...@gmail.com] Posted At: Thursday, March 31, 2011 10:23 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: Re: Find out what is doing this You're creating a batch file every 60 seconds, for some reason. At some point, one would expect it to run... I guess I am unclear on the process taking place. Is it creating the file and then running the file every 60 seconds? Or is it just creating the file every 60 seconds, and only running it once per day at 11pm? Could? I am not sure. Have you changed anything recently. On Thu, Mar 31, 2011 at 10:15 AM, itli...@imcu.com itli...@imcu.com wrote: We are putting process monitor on all servers to see who might be using it but we haven't found any so far. Could a local security policy or gpo cause this kind of issue? From: Jonathan Link [mailto:jonathan.l...@gmail.com] Posted At: Thursday, March 31, 2011 10:09 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: Re: Find out what is doing this Is there another task that runs setenv.bat at 11pm? If so, that'll cause your sharing violation, because they both fire at the same time, and the file can't be saved. On Thu, Mar 31, 2011 at 10:05 AM, Charlie Kaiser charl...@golden-eagle.org wrote: Crank up auditing on the file and see who's accessing it. Also, with process monitor, see what other processes are involved... *** Charlie Kaiser charl...@golden-eagle.org Kingman, AZ *** -Original Message- From: itli...@imcu.com [mailto:itli...@imcu.com] Sent: Thursday, March 31, 2011 7:02 AM To: NT System Admin Issues Subject: RE: Find out what is doing this No backups at the time of error. -Original Message- From: Charlie Kaiser [mailto:charl...@golden-eagle.org] Posted At: Thursday, March 31, 2011 9:58 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: RE: Find out what is doing this Is there a backup going on at that time? *** Charlie Kaiser charl...@golden-eagle.org Kingman, AZ *** -Original Message- From: itli...@imcu.com [mailto:itli...@imcu.com] Sent: Thursday, March 31, 2011 6:55 AM To: NT System Admin Issues Subject: RE: Find out what is doing this Here is the process .bat creates setenv.bat in dir x About every 60 seconds all day long. At around 11:00pm each night this process fails with a sharing violation of setenv.bat. Rerun the automated task and it runs. The problem is this file is being Created all day long no issues just around 11:00pm. With process monitor we see the sharing violation but can't tell what was trying to share it or what was sharing it at the time?? Need more guidance with process monitor I guess? Can I turn on auditing for dir x ? Will Windows give me more of a feel for what failed? -Original Message- From: Ben Scott [mailto:mailvor...@gmail.com] Posted At: Thursday, March 31, 2011 9:34 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: Re: Find out what is doing this On Thu, Mar 31, 2011 at 9:21 AM, itli...@imcu.com itli...@imcu.com wrote: Have a third party that creates a file before it runs. You need to explain that using a lot more words. :) We're also using a piece of software called Process Monitor and we were able to pin it down last night to a 'Sharing Violation' . Sharing Violation nominally means a file was already open or locked when the program tried to access it. Of course, that's also one of the error codes that Microsoft sometimes uses for completely unrelated things, so there's a (relatively small) chance it's something else. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise
Re: Find out what is doing this
What? I don't understand what the batch file is doing. AND. Creation of the batch file is not running of the batch file. You haven't answered that specific question. When does the batch file run? I'm clear on when it gets created. On Thu, Mar 31, 2011 at 10:27 AM, itli...@imcu.com itli...@imcu.com wrote: Creating every 60 seconds or so. It is an environment variable batch creation. Creates time, date, etc… We had to stop a bunch of WSUS GPO’s because of network lag. We have them all back on and we have rebooted all servers since but I am really thinking the coincidence lies with the disabling and enabling of the gpo’s. *From:* Jonathan Link [mailto:jonathan.l...@gmail.com] *Posted At:* Thursday, March 31, 2011 10:23 AM *Posted To:* itli...@imcu.com *Conversation:* Find out what is doing this *Subject:* Re: Find out what is doing this You're creating a batch file every 60 seconds, for some reason. At some point, one would expect it to run... I guess I am unclear on the process taking place. Is it creating the file and then running the file every 60 seconds? Or is it just creating the file every 60 seconds, and only running it once per day at 11pm? Could? I am not sure. Have you changed anything recently. On Thu, Mar 31, 2011 at 10:15 AM, itli...@imcu.com itli...@imcu.com wrote: We are putting process monitor on all servers to see who might be using it but we haven’t found any so far. Could a local security policy or gpo cause this kind of issue? *From:* Jonathan Link [mailto:jonathan.l...@gmail.com] *Posted At:* Thursday, March 31, 2011 10:09 AM *Posted To:* itli...@imcu.com *Conversation:* Find out what is doing this *Subject:* Re: Find out what is doing this Is there another task that runs setenv.bat at 11pm? If so, that'll cause your sharing violation, because they both fire at the same time, and the file can't be saved. On Thu, Mar 31, 2011 at 10:05 AM, Charlie Kaiser charl...@golden-eagle.org wrote: Crank up auditing on the file and see who's accessing it. Also, with process monitor, see what other processes are involved... *** Charlie Kaiser charl...@golden-eagle.org Kingman, AZ *** -Original Message- From: itli...@imcu.com [mailto:itli...@imcu.com] Sent: Thursday, March 31, 2011 7:02 AM To: NT System Admin Issues Subject: RE: Find out what is doing this No backups at the time of error. -Original Message- From: Charlie Kaiser [mailto:charl...@golden-eagle.org] Posted At: Thursday, March 31, 2011 9:58 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: RE: Find out what is doing this Is there a backup going on at that time? *** Charlie Kaiser charl...@golden-eagle.org Kingman, AZ *** -Original Message- From: itli...@imcu.com [mailto:itli...@imcu.com] Sent: Thursday, March 31, 2011 6:55 AM To: NT System Admin Issues Subject: RE: Find out what is doing this Here is the process .bat creates setenv.bat in dir x About every 60 seconds all day long. At around 11:00pm each night this process fails with a sharing violation of setenv.bat. Rerun the automated task and it runs. The problem is this file is being Created all day long no issues just around 11:00pm. With process monitor we see the sharing violation but can't tell what was trying to share it or what was sharing it at the time?? Need more guidance with process monitor I guess? Can I turn on auditing for dir x ? Will Windows give me more of a feel for what failed? -Original Message- From: Ben Scott [mailto:mailvor...@gmail.com] Posted At: Thursday, March 31, 2011 9:34 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: Re: Find out what is doing this On Thu, Mar 31, 2011 at 9:21 AM, itli...@imcu.com itli...@imcu.com wrote: Have a third party that creates a file before it runs. You need to explain that using a lot more words. :) We're also using a piece of software called Process Monitor and we were able to pin it down last night to a 'Sharing Violation' . Sharing Violation nominally means a file was already open or locked when the program tried to access it. Of course, that's also one of the error codes that Microsoft sometimes uses for completely unrelated things, so there's a (relatively small) chance it's something else. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful
RE: Find out what is doing this
What time does your backup run? Shauna Hensala Subject: RE: Find out what is doing this Date: Thu, 31 Mar 2011 09:54:37 -0400 From: itli...@imcu.com To: ntsysadmin@lyris.sunbelt-software.com Here is the process .bat creates setenv.bat in dir x About every 60 seconds all day long. At around 11:00pm each night this process fails with a sharing violation of setenv.bat. Rerun the automated task and it runs. The problem is this file is being Created all day long no issues just around 11:00pm. With process monitor we see the sharing violation but can't tell what was trying to share it or what was sharing it at the time?? Need more guidance with process monitor I guess? Can I turn on auditing for dir x ? Will Windows give me more of a feel for what failed? -Original Message- From: Ben Scott [mailto:mailvor...@gmail.com] Posted At: Thursday, March 31, 2011 9:34 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: Re: Find out what is doing this On Thu, Mar 31, 2011 at 9:21 AM, itli...@imcu.com itli...@imcu.com wrote: Have a third party that creates a file before it runs. You need to explain that using a lot more words. :) We're also using a piece of software called Process Monitor and we were able to pin it down last night to a 'Sharing Violation' . Sharing Violation nominally means a file was already open or locked when the program tried to access it. Of course, that's also one of the error codes that Microsoft sometimes uses for completely unrelated things, so there's a (relatively small) chance it's something else. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
RE: Find out what is doing this
I would also use handle.exe which should show you what process has what open at the time, I have a sneaking suspicion that your backup software has a lock on the file during the time. Can you have the backup software exclude the directory in which you run the batch file, and see if the lock alleviates. Z Edward E. Ziots CISSP, Network +, Security + Network Engineer Lifespan Organization Email:ezi...@lifespan.org Cell:401-639-3505 -Original Message- From: Charlie Kaiser [mailto:charl...@golden-eagle.org] Sent: Thursday, March 31, 2011 10:06 AM To: NT System Admin Issues Subject: RE: Find out what is doing this Crank up auditing on the file and see who's accessing it. Also, with process monitor, see what other processes are involved... *** Charlie Kaiser charl...@golden-eagle.org Kingman, AZ *** -Original Message- From: itli...@imcu.com [mailto:itli...@imcu.com] Sent: Thursday, March 31, 2011 7:02 AM To: NT System Admin Issues Subject: RE: Find out what is doing this No backups at the time of error. -Original Message- From: Charlie Kaiser [mailto:charl...@golden-eagle.org] Posted At: Thursday, March 31, 2011 9:58 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: RE: Find out what is doing this Is there a backup going on at that time? *** Charlie Kaiser charl...@golden-eagle.org Kingman, AZ *** -Original Message- From: itli...@imcu.com [mailto:itli...@imcu.com] Sent: Thursday, March 31, 2011 6:55 AM To: NT System Admin Issues Subject: RE: Find out what is doing this Here is the process .bat creates setenv.bat in dir x About every 60 seconds all day long. At around 11:00pm each night this process fails with a sharing violation of setenv.bat. Rerun the automated task and it runs. The problem is this file is being Created all day long no issues just around 11:00pm. With process monitor we see the sharing violation but can't tell what was trying to share it or what was sharing it at the time?? Need more guidance with process monitor I guess? Can I turn on auditing for dir x ? Will Windows give me more of a feel for what failed? -Original Message- From: Ben Scott [mailto:mailvor...@gmail.com] Posted At: Thursday, March 31, 2011 9:34 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: Re: Find out what is doing this On Thu, Mar 31, 2011 at 9:21 AM, itli...@imcu.com itli...@imcu.com wrote: Have a third party that creates a file before it runs. You need to explain that using a lot more words. :) We're also using a piece of software called Process Monitor and we were able to pin it down last night to a 'Sharing Violation' . Sharing Violation nominally means a file was already open or locked when the program tried to access it. Of course, that's also one of the error codes that Microsoft sometimes uses for completely unrelated things, so there's a (relatively small) chance it's something else. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http
Re: Find out what is doing this
It might help if you post a sanitized copy of the script, rather than trying to describe it like in the current fashion. The easiest guess, with a sharing violation, is that the file is locked for reading or writing by a process other than the one which the scheduled job is running under. That, or that scheduled job credentials are inadequate. *ASB *(Professional Bio http://about.me/Andrew.S.Baker/bio) *Technology Services that Maximize Business Results... * On Thu, Mar 31, 2011 at 10:27 AM, itli...@imcu.com itli...@imcu.com wrote: Creating every 60 seconds or so. It is an environment variable batch creation. Creates time, date, etc… We had to stop a bunch of WSUS GPO’s because of network lag. We have them all back on and we have rebooted all servers since but I am really thinking the coincidence lies with the disabling and enabling of the gpo’s. *From:* Jonathan Link [mailto:jonathan.l...@gmail.com] *Posted At:* Thursday, March 31, 2011 10:23 AM *Posted To:* itli...@imcu.com *Conversation:* Find out what is doing this *Subject:* Re: Find out what is doing this You're creating a batch file every 60 seconds, for some reason. At some point, one would expect it to run... I guess I am unclear on the process taking place. Is it creating the file and then running the file every 60 seconds? Or is it just creating the file every 60 seconds, and only running it once per day at 11pm? Could? I am not sure. Have you changed anything recently. On Thu, Mar 31, 2011 at 10:15 AM, itli...@imcu.com itli...@imcu.com wrote: We are putting process monitor on all servers to see who might be using it but we haven’t found any so far. Could a local security policy or gpo cause this kind of issue? *From:* Jonathan Link [mailto:jonathan.l...@gmail.com] *Posted At:* Thursday, March 31, 2011 10:09 AM *Posted To:* itli...@imcu.com *Conversation:* Find out what is doing this *Subject:* Re: Find out what is doing this Is there another task that runs setenv.bat at 11pm? If so, that'll cause your sharing violation, because they both fire at the same time, and the file can't be saved. On Thu, Mar 31, 2011 at 10:05 AM, Charlie Kaiser charl...@golden-eagle.org wrote: Crank up auditing on the file and see who's accessing it. Also, with process monitor, see what other processes are involved... *** Charlie Kaiser charl...@golden-eagle.org Kingman, AZ *** -Original Message- From: itli...@imcu.com [mailto:itli...@imcu.com] Sent: Thursday, March 31, 2011 7:02 AM To: NT System Admin Issues Subject: RE: Find out what is doing this No backups at the time of error. -Original Message- From: Charlie Kaiser [mailto:charl...@golden-eagle.org] Posted At: Thursday, March 31, 2011 9:58 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: RE: Find out what is doing this Is there a backup going on at that time? *** Charlie Kaiser charl...@golden-eagle.org Kingman, AZ *** -Original Message- From: itli...@imcu.com [mailto:itli...@imcu.com] Sent: Thursday, March 31, 2011 6:55 AM To: NT System Admin Issues Subject: RE: Find out what is doing this Here is the process .bat creates setenv.bat in dir x About every 60 seconds all day long. At around 11:00pm each night this process fails with a sharing violation of setenv.bat. Rerun the automated task and it runs. The problem is this file is being Created all day long no issues just around 11:00pm. With process monitor we see the sharing violation but can't tell what was trying to share it or what was sharing it at the time?? Need more guidance with process monitor I guess? Can I turn on auditing for dir x ? Will Windows give me more of a feel for what failed? -Original Message- From: Ben Scott [mailto:mailvor...@gmail.com] Posted At: Thursday, March 31, 2011 9:34 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: Re: Find out what is doing this On Thu, Mar 31, 2011 at 9:21 AM, itli...@imcu.com itli...@imcu.com wrote: Have a third party that creates a file before it runs. You need to explain that using a lot more words. :) We're also using a piece of software called Process Monitor and we were able to pin it down last night to a 'Sharing Violation' . Sharing Violation nominally means a file was already open or locked when the program tried to access it. Of course, that's also one of the error codes that Microsoft sometimes uses for completely unrelated things, so there's a (relatively small) chance it's something else. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise
Re: Find out what is doing this
What a co-incidence, we had this happen recently and wrote a powershell script to run handle every minute around the time of the issue to find the cause. We found it was McAfee and that the database admin moved a database path and it was no longer excluded. In this example I picked word.exe at random -- start file # #Name: detectFileLocks.ps1 # Author: Steven Peck #Date: 3/17/2011 # Description: Script to check and log file locks on a specific file # Source: #Requires: Handle.exe from sysinternal in same directory as the source_directory # scheduled task # # Set date/time format $date = get-date -format M-d--HHmmss # set source directory $source_directory = c:\scripts\handle # set file to monitor $monitoredfile = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\word.exe # cmd and output $source_directory\handle.exe $monitoredfile | out-file $source_directory\$date.txt --- end file On Thu, Mar 31, 2011 at 8:29 AM, Ziots, Edward ezi...@lifespan.org wrote: I would also use handle.exe which should show you what process has what open at the time, I have a sneaking suspicion that your backup software has a lock on the file during the time. Can you have the backup software exclude the directory in which you run the batch file, and see if the lock alleviates. Z Edward E. Ziots CISSP, Network +, Security + Network Engineer Lifespan Organization Email:ezi...@lifespan.org Cell:401-639-3505 -Original Message- From: Charlie Kaiser [mailto:charl...@golden-eagle.org] Sent: Thursday, March 31, 2011 10:06 AM To: NT System Admin Issues Subject: RE: Find out what is doing this Crank up auditing on the file and see who's accessing it. Also, with process monitor, see what other processes are involved... *** Charlie Kaiser charl...@golden-eagle.org Kingman, AZ *** -Original Message- From: itli...@imcu.com [mailto:itli...@imcu.com] Sent: Thursday, March 31, 2011 7:02 AM To: NT System Admin Issues Subject: RE: Find out what is doing this No backups at the time of error. -Original Message- From: Charlie Kaiser [mailto:charl...@golden-eagle.org] Posted At: Thursday, March 31, 2011 9:58 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: RE: Find out what is doing this Is there a backup going on at that time? *** Charlie Kaiser charl...@golden-eagle.org Kingman, AZ *** -Original Message- From: itli...@imcu.com [mailto:itli...@imcu.com] Sent: Thursday, March 31, 2011 6:55 AM To: NT System Admin Issues Subject: RE: Find out what is doing this Here is the process .bat creates setenv.bat in dir x About every 60 seconds all day long. At around 11:00pm each night this process fails with a sharing violation of setenv.bat. Rerun the automated task and it runs. The problem is this file is being Created all day long no issues just around 11:00pm. With process monitor we see the sharing violation but can't tell what was trying to share it or what was sharing it at the time?? Need more guidance with process monitor I guess? Can I turn on auditing for dir x ? Will Windows give me more of a feel for what failed? -Original Message- From: Ben Scott [mailto:mailvor...@gmail.com] Posted At: Thursday, March 31, 2011 9:34 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: Re: Find out what is doing this On Thu, Mar 31, 2011 at 9:21 AM, itli...@imcu.com itli...@imcu.com wrote: Have a third party that creates a file before it runs. You need to explain that using a lot more words. :) We're also using a piece of software called Process Monitor and we were able to pin it down last night to a 'Sharing Violation' . Sharing Violation nominally means a file was already open or locked when the program tried to access it. Of course, that's also one of the error codes that Microsoft sometimes uses for completely unrelated things, so there's a (relatively small) chance it's something else. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise
RE: Find out what is doing this
It is the tard101.exe that is trying to create a new setenv.bat to be used later in this process. Once we get the error on our phones we remote in and give the job a run and it runs no problem. ÉÍÍÍ»inst: in01 º Task Mode ºcomptype: 1_central º ºtimeout: 20 ÈÍÍͼmachine: ce01 ECHO is on. ECHO is on. 03/30/11 23:22:45ECHO is off. ECHO is off. Checking for a task to perform... \2900\exeopnt\fm\tapd101 Version 4.3.1 (Build 103 ANSI Release) Copyright (c) 1986-1992 Prologic Corporation. Copyright (c) 1993-1996 Prologic Computer Corporation. All rights reserved. Copyright (c) 1996-1997 Prologic Corporation. All rights reserved. Performing task... Running purgsahi: Opens purgesahi window and start purge process. \2900\exeopnt\rep\tard101 Version 4.3.1 (Build 103 ANSI Release) Copyright (c) 1986-1992 Prologic Corporation. Copyright (c) 1993-1996 Prologic Computer Corporation. All rights reserved. Copyright (c) 1996-1997 Prologic Corporation. All rights reserved. ERR_LFORM_COULDNT_OPEN(171): lform openoutfile couldn't open outfile 'setenv.bat '. The diag created by that error: Logged ERROR event ID c0ab category 6 'ERR_LFORM_COULDNT_OPEN(171): lform openoutfile couldn't open outfile 'setenv.bat'.' Context of error follows: PRM: Last PRM function called was:. PRM:PRMFind(cal,EQ,0xa2bee8,calixcode,0,0x0) [Success] PRM:Within the PRM function, the last ODBC function called was: SQL:SQLFetch(...) [SQL_SUCCESS] Most recent DOS Error before Exception: Permission denied (13) From: Andrew S. Baker [mailto:asbz...@gmail.com] Posted At: Thursday, March 31, 2011 11:43 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: Re: Find out what is doing this It might help if you post a sanitized copy of the script, rather than trying to describe it like in the current fashion. The easiest guess, with a sharing violation, is that the file is locked for reading or writing by a process other than the one which the scheduled job is running under. That, or that scheduled job credentials are inadequate. ASB (Professional Bio http://about.me/Andrew.S.Baker/bio ) Technology Services that Maximize Business Results... On Thu, Mar 31, 2011 at 10:27 AM, itli...@imcu.com itli...@imcu.com wrote: Creating every 60 seconds or so. It is an environment variable batch creation. Creates time, date, etc... We had to stop a bunch of WSUS GPO's because of network lag. We have them all back on and we have rebooted all servers since but I am really thinking the coincidence lies with the disabling and enabling of the gpo's. From: Jonathan Link [mailto:jonathan.l...@gmail.com] Posted At: Thursday, March 31, 2011 10:23 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: Re: Find out what is doing this You're creating a batch file every 60 seconds, for some reason. At some point, one would expect it to run... I guess I am unclear on the process taking place. Is it creating the file and then running the file every 60 seconds? Or is it just creating the file every 60 seconds, and only running it once per day at 11pm? Could? I am not sure. Have you changed anything recently. On Thu, Mar 31, 2011 at 10:15 AM, itli...@imcu.com itli...@imcu.com wrote: We are putting process monitor on all servers to see who might be using it but we haven't found any so far. Could a local security policy or gpo cause this kind of issue? From: Jonathan Link [mailto:jonathan.l...@gmail.com] Posted At: Thursday, March 31, 2011 10:09 AM Posted To: itli...@imcu.com Conversation: Find out what is doing this Subject: Re: Find out what is doing this Is there another task that runs setenv.bat at 11pm? If so, that'll cause your sharing violation, because they both fire at the same time, and the file can't be saved. On Thu, Mar 31, 2011 at 10:05 AM, Charlie Kaiser charl...@golden-eagle.org wrote: Crank up auditing on the file and see who's accessing it. Also, with process monitor
Re: Find out what is doing this
I see couldn't write and permission denied What is the account being used for the scheduled job, and what is the account that you're testing it with manually? If they are not the same, then you need to test with the former one and rectify the issues with permissions. *ASB *(Professional Bio http://about.me/Andrew.S.Baker/bio) *Technology Services that Maximize Business Results... * On Thu, Mar 31, 2011 at 11:47 AM, itli...@imcu.com itli...@imcu.com wrote: It is the tard101.exe that is trying to create a new setenv.bat to be used later in this process. Once we get the error on our phones we remote in and give the job a run and it runs no problem. ÉÍÍÍ»inst: in01 º Task Mode ºcomptype: 1_central º ºtimeout: 20 ÈÍÍͼmachine: ce01 ECHO is on. ECHO is on. 03/30/11 23:22:45ECHO is off. ECHO is off. Checking for a task to perform... \2900\exeopnt\fm\tapd101 Version 4.3.1 (Build 103 ANSI Release) Copyright (c) 1986-1992 Prologic Corporation. Copyright (c) 1993-1996 Prologic Computer Corporation. All rights reserved. Copyright (c) 1996-1997 Prologic Corporation. All rights reserved. Performing task... Running purgsahi: Opens purgesahi window and start purge process. \2900\exeopnt\rep\tard101 Version 4.3.1 (Build 103 ANSI Release) Copyright (c) 1986-1992 Prologic Corporation. Copyright (c) 1993-1996 Prologic Computer Corporation. All rights reserved. Copyright (c) 1996-1997 Prologic Corporation. All rights reserved. ERR_LFORM_COULDNT_OPEN(171): lform openoutfile couldn't open outfile 'setenv.bat '. The diag created by that error: Logged ERROR event ID c0ab category 6 'ERR_LFORM_COULDNT_OPEN(171): lform openoutfile couldn't open outfile 'setenv.bat'.' Context of error follows: PRM: Last PRM function called was:. PRM:PRMFind(cal,EQ,0xa2bee8,calixcode,0,0x0) [Success] PRM:Within the PRM function, the last ODBC function called was: SQL:SQLFetch(...) [SQL_SUCCESS] Most recent DOS Error before Exception: Permission denied (13) *From:* Andrew S. Baker [mailto:asbz...@gmail.com] *Posted At:* Thursday, March 31, 2011 11:43 AM *Posted To:* itli...@imcu.com *Conversation:* Find out what is doing this *Subject:* Re: Find out what is doing this It might help if you post a sanitized copy of the script, rather than trying to describe it like in the current fashion. The easiest guess, with a sharing violation, is that the file is locked for reading or writing by a process other than the one which the scheduled job is running under. That, or that scheduled job credentials are inadequate. *ASB *(Professional Bio http://about.me/Andrew.S.Baker/bio) *Technology Services that Maximize Business Results...** * * * On Thu, Mar 31, 2011 at 10:27 AM, itli...@imcu.com itli...@imcu.com wrote: Creating every 60 seconds or so. It is an environment variable batch creation. Creates time, date, etc… We had to stop a bunch of WSUS GPO’s because of network lag. We have them all back on and we have rebooted all servers since but I am really thinking the coincidence lies with the disabling and enabling of the gpo’s. *From:* Jonathan Link [mailto:jonathan.l...@gmail.com] *Posted At:* Thursday, March 31, 2011 10:23 AM *Posted To:* itli...@imcu.com *Conversation:* Find out what is doing this *Subject:* Re: Find out what is doing this You're creating a batch file every 60 seconds, for some reason. At some point, one would expect it to run... I guess I am unclear on the process taking place. Is it creating the file and then running the file every 60 seconds? Or is it just creating the file every 60 seconds, and only running it once per day at 11pm? Could? I am not sure. Have you changed anything recently. On Thu, Mar 31, 2011 at 10:15 AM, itli...@imcu.com itli...@imcu.com wrote: We are putting process monitor on all servers to see who might be using it but we haven’t found any so far. Could a local security policy or gpo cause this kind of issue? *From:* Jonathan Link [mailto:jonathan.l...@gmail.com] *Posted At:* Thursday, March 31, 2011 10:09 AM *Posted To:* itli...@imcu.com *Conversation:* Find out what is doing this *Subject:* Re: Find out what is doing this Is there another task that runs setenv.bat at 11pm? If so, that'll cause your sharing violation, because they both fire at the same time, and the file can't be saved. On Thu, Mar 31, 2011 at 10:05 AM, Charlie Kaiser charl...@golden-eagle.org wrote: Crank up auditing on the file and see who's accessing it. Also, with process monitor, see what other processes are involved... *** Charlie Kaiser charl...@golden-eagle.org Kingman, AZ *** -Original Message- From: itli...@imcu.com
