How to monitor file attribute changes

This article describes the process for identifying which process is changing file attributes. This can be helpful in identifying what process is changing the Archive and Read-Only attributes on LNVR Storage directories.

1. Download and install Process Monitor from Microsoft System Internals. (http://technet.microsoft.com)

   
   

2. Start the Process Monitor application.

   
   

3. Select Filter from the menu bar.

   
   

4. Select Filter from the menu, and the Process Monitor Filter dialog will be displayed.

   
   

5. Create a filter by performing the following steps:
   1. Select Operation from the first drop-down.
   2. Select is from the second drop-down.
   3. Type  SetBasicInformationFile into the text field.
   4. Select Include from the third drop-down.
   5. Click Add.

6. 
   

7. Create a second filter by performing the following steps:
   1. Select Path from the first drop-down.
   2. Select begins with from the second drop-down.
   3. Enter the path of the files you wish to monitor in the text field (For example, F:\LNVR Storage).
   4. Select Include from the third drop-down.
   5. Click Add.

8. 
   

9. Click OK in the lower right hand corner of the Process Monitor Filter dialog.

   
   

10. Process Monitor will now display any events within the system that attempt to change the attributes of the files within the directory specified.  The event information contains the process name and process ID to help identify the application.