Windows Server 2003 phantom files

[jsparksa]

Windows SBS Server 2003 SP2 with Exchange and SQL Server. Using Roaming Profiles for user logons.

I am not sure how to categorize the problem, so I will call it “Phantom Files.”

The problem has been seen in a user's Favorites folder or a user's “Recent” folder for Office 2003, I.E. ...\Profiles\[user]\Application Data\Microsoft\Office\Recent\).

A single Internet Shorcut/ Shortcut/ url file becomes corrupted. This file cannot be deleted and it cannot be accessed. (Access Denied) When I right-click and select properties, there is no Security tab for this file. All other files within the same directory have normal properties including the Security tab.

I have not seen the problem with another type of file or with a file not in Favorites or “Recent” locations.

Since the file is locked within the user's profile, the affected user is denied access to their profile until the file is fixed. The roaming profile will not load for the user.

To this date, I am only able to fix this problem by rebooting the server. During the boot process the file disappears, hence, the categorization “Phantom File.”

This problem occurs infrequently, maybe 12 times in the past year or so, but it has happened twice in the past two weeks and it happens with different users each time. I am not sure when I first saw this problem, but I think it has only been in the past 12 months, possibly coinciding with the installation of Exchange on the server last September 2009.

I am guessing that the file was in the process of being deleted but the deletion was not completed, and when the server is rebooted, the file deletion is completed.

I used to administer a number of 2003 servers at a different location and I did not see this problem at that location.

I am looking for the “root cause” of the problem and a solution that does not involve rebooting the server.

Thanks, Jim

[Expertz]

Have you tried creating policy that disables storing these alternate data streams? I think that your problem probably results from the fact that URL icon's (favicon) are stored in alternate data streams. You can try something like Attachment manager from here: http://support.microsoft.com/kb/883260

[jsparksa]

ExpertZ,

I read the article from the MSFT link and I do not understand how it applies to my situation. Could you clarify "Alternate data streams?"



Thanks, Jim

I found this description of ADS: http://www.windowsecurity.com/articl...a_Streams.html . I am still trying to figure out how ADS applies to my situation.

This article specifically addresses my problem: http://support.microsoft.com/kb/303079 . It also discusses ADS, but I do not see a solution

<<< NOTE: You may run across directories or files that have no security tab, or find that you cannot re-assign permissions to the affected folders and files. You may <<< receive the following error message while you try to access them:

<<< D:\directory_name\ is not accessible
<<< Access is denied

[Expertz]

I think that might be a temp file that is being used in Internet explorer. You can try to delete it with some tools like unlocker. Download it from here. Even if the file is locked you can easily delete it with Unlocker software. Have a go and let us know.

[jsparksa]

Expertz,

I downloaded Unlocker and I will try it the next time I encounter the problem. It is unpredictable when the problem will occur again.

Thanks for the suggestion, and I will update the post when I am able to do so.


Thanks, Jim

[jsparksa]

Expertz,

I was able to use Unlocker today and it worked like a champ. The file disappeared immediately after it was unlocked, and the offending process was the Indexing Service. (It appears the the service interrupted the file deletion?!) I have disabled this service for now.

Thanks a million, Jim

I audited each PC at this location (21 PC's) looking for profile problems, and I found two users having problems but who did not report the problems.