M
M
masyaka2022-02-07 18:05:53
Windows
masyaka, 2022-02-07 18:05:53

Not the logical owner of the file, why?

There is a batch file, the functionality of which is to install a new version of the program platform. The batch file works in the domain as a Startup script (but this information is not accurate, maybe as a logon script, which is unlikely).

The batch file says:
.........
echo %time% %date% >> \logs folder\%computername.txt%
setup /s
echo %time% %date% >> \logs folder \%computername.txt%
........

We look at the logs and see the PC1.txt file, the new version was installed on 12/01/21, everything seems to be fine.
Almost a month passes, we find out that there is a PC on the network with the name PC2. On PC2, the new version was installed exactly on 12/01/21, and there is no PC2.txt file in the logs.
Understood. After a new version of the program was installed on PC1, after some time this PC was physically transferred to another enterprise and renamed it PC2. There is event ID 6011 in the system log of this PC (The NetBIOS name and DNS host name of this computer were changed from PC1 to PC2). In the "batch file" there is a check whether a new version of the program is already installed, the check is performed by checking the presence of the corresponding folder in Program Files, and since a new version of the program is already installed on a physical PC, whose name is now PC2 (formerly PC1), the program is not installed and the PC2.txt file is not created (such logic is in the batch file), because the file is created if the new version of the program has not been installed and the installation of the new version of the program has been completed.
The question is why the owner of the PK1.txt file, which was created on 01.12.21 and after that did not change (in theory) the account Domain name\PK2$? There would be no question if the account Domain Name\PC1$ was the owner of this file.
At two different enterprises the domain is one.

Answer the question

In order to leave comments, you need to log in

1 answer(s)
S
Stalker_RED, 2022-02-07
@Stalker_RED

Logical, the owner has not changed the same.
The computer remained in the same domain, it is the same computer and the same file as it was before the physical transfer and renaming.
After renaming, domain magic shows you the new owner name (the owner is the same, only the name has changed). You see its new name, but the actual owner hasn't changed.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question