How to remove NTFS "archive" attribute ?

[newprouser]

I have some files from windows setup which i used to create Win 7 PE. After i finished creating it, i find

that the files have been set to "a" attribute , so i'm not able to delete them.

I have already tried :

Unlocker utility

changing attribute manually with file properties

tried with attrib.exe

taking ownership of files

using 3rd party attribute changing s/w

deleting file during windows boot.

all have failed miserably .

any clues how to remove it ?

OS: Win XP SP3

FS: NTFS

[jaclaz]

Which files? (can you name a few?)

Are you sure they are actually files (and not hard links or mount points or some other non-real-file entity)?

jaclaz

[gosh]

It would help if you posted the exact error message you get

[newprouser]

Which files? (can you name a few?)

Are you sure they are actually files (and not hard links or mount points or some other non-real-file entity)?

jaclaz

yes, i'm sure they were "real" files and not hard links or anything else. (twunk.dll, then all the win 7 wall papers, winhelp.exe etc....)

It would help if you posted the exact error message you get

in windows xp , i did not get any error message, except stating that the files cannot be deleted.

--

anyway i managed to delete the files from windows 7.

But i still don't understand how it worked out.

Initially i had to take ownership for each file separately , and so i could delete files one by one only.

and then also i had to set permission first to the default administrator account,(even though my account

was also an administrator account), and then assign permissions to my user account before i could delete the file.

to delete entire folders i had to browse to the top most folder and set permission for all categories (SYSTEM,CREATOR,ADMINISTRATOR,

my user account) and then set the permissions to be inherited to all sub-folders and files .

any of you can give more information on how these work , because until now, whenever i took ownership of a folder, I was

able to delete all the files in that folder, never faced this problem before.

thanks for your help jaclaz and gosh.

[fdv]

Oh, it's going to take me forever to find this, I just know it, but I had this issue a month ago.

There is a security setting (secpol.msc etc etc) that applies ownership of files to either all administrators or to specific users/administrators and will not allow deletion even by an admin if it's not the original admin. This is the default setting in XP and it CAN be changed.

I am hoping I jogged someone's memory because although I have the registry setting in an INF file somewhere it will take me a while to dig it up.

I'll try to find it.

[jaclaz]

Maybe it's this one:

http://www.beginningtoseethelight.org/ntsecurity/index.php

Listed are the groups: Administrators, Backup Operators, Guests, Power Users, Replicator & Users.

In the members tab users can be defined in the security database to belong to the respective group. When the security policy is applied the registry group membership is matched with the list in the database, hence if a new administrator is added to the machine, but not listed in the security policy, it will be removed on policy application. This setting is only defined in the security database.

The behaviour seems similar:

http://www.sevenforums.com/general-discuss...der-delete.html

Is it this one?

http://www.secnewsgroups.net/group/microso.../topic6412.aspx

jaclaz

[newprouser]

In my case, I had never used the default administrator account.

but what puzzles me, is to exactly which files, these settings are applied.

For example, I'm able to delete all files of a windows xp installation from windows 7, no questions asked, and

without taking ownership either.

But two system files created by adobe flash (FlashUtil10c.exe,10c.ocx) in system32 cannot be deleted easily.

Edited December 11, 2009 by newprouser