Audit failures from explorer.exe

From: Jan Bares (jan.bares_at_nospam.nospam)
Date: 03/06/05 

Date: Sun, 6 Mar 2005 11:10:56 +0100

Hi,

I audit failures on files from "Program Files" because I run as member of
"Users" group and I want to identify programs trying to write there, because
they are badly written. But my Event log is full of 560 Failure Events, that
are generated by explorer.exe as I browse through the folders.
Is there any way how can I remove explorer.exe from being audited? Otr any
other solution (besides using File Manager as mentioned in Q172509)

I know the reason why Explorer does this. When explorer checks for rights
for a folder, this results in a call to NtCreateFile. This call fails and
creates the audit log. There is a function that can return rights on folder,
but that function is slow, so Explorer uses this dirty way.

Thanks, Jan

Relevant Pages

  • Re: Hidden Directories, not empty, Virus created
    ... > explorer options but they still don't display. ... Downloaded Program Files is a special system folder, so Windows Explorer ...
    (microsoft.public.win2000.general)
  • Re: Errors during SBS 2003 SP1 Installation
    ... I think here's where you went wrong, the regedit of the 'Program Files' dir. ... reg hacking SBS is not to be taken lightly. ... ..Microsoft Office 97 Standard Edition ... is that I changed the program files folder to D: ...
    (microsoft.public.windows.server.sbs)
  • Re: Sharing Program Files folder
    ... I know what you are saying but I think Simple File Sharing only ... Windows folder. ... error when trying to access shared Program Files folder. ...
    (microsoft.public.windowsxp.network_web)
  • Re: home lan puzzler
    ... > to share out the user's home folder or the Program Files ... > Network Setup Wizard again on all the XP boxen. ...
    (microsoft.public.windowsxp.network_web)
  • Re: Program Files
    ... Log in as admin and rename the folder under documents and settings that ... Then log in again as that same username and a new profile will be created. ... Test the function of opening program files and opening applications. ... desktop folder in usernameold, to the desktop folder in the *new* profile. ...
    (microsoft.public.windowsxp.basics)