We redirect the user desktop folder to a share,
\\fileserv1\users$\%username%\desktop
(sorry if that syntax isn't correct, just know that folder redirection is working normally and each of the redirected folders appears in that location).
I have an issue where a user ("User1") is getting frequent drive disconnections. These are caused by errors during file synchronization (which folder redirection utilizes) - whenever errors occurring during synchronization all network drives with offline files disconnect. The specific error is that the user does not have rights to a temporary file, "someDocument.docx~MK29befd.TMP" in their desktop folder. Note that "someDocument.docx" no longer exists - it has been moved, so it is not simply that file being open.
I tried to look at the ACL on the file, but even as an administrator I was denied. I then tried to take ownership of the folder, but was denied - this made me believe it was a sharing violation. I jumped on the server and ran handle.exe:
handle.exe D:\Users\User1\Desktop\someDocument.docx~MK29befd.TMP
System pid: 4 type: File 22A4: D:\Users\User1\Desktop\someDocument.docx~MK29befd.TMP
System pid: 4 type: File 81E4: D:\Users\User1\Desktop\someDocument.docx~MK29befd.TMP
So obviously the SYSTEM process has a handle to this. If I check in Process Explorer, I get the same information (SYSTEM, pid 4). It's also the SYSTEM process, not one of its children.
At this point I decide to try take a look at the ACL with the SYSTEM process:
psexec -i -s cmd.exe
I then run cacls against the file using the NT System authority:
cacls D:\Users\User1\Desktop\someDocument.docx~MK29befd.TMP
Access is denied.
So the SYSTEM process has a handle against it, but even the system doesn't have rights to it? I have no idea how to troubleshoot from here. I can't reboot the server for a single user issue, and I'm CERTAINLY not going to forcibly close the handle (http://technet.microsoft.com/en-us/magazine/2009.04.windowsconfidential.aspx).
My question then is where to go to next? I need to identify which part of the SYSTEM process actually has a handle open to the file so that I can gracefully close it, then I can take ownership of the file, give myself delete rights, and remove it.
Any help very appreciated! Thanks.