W7/WS2008/WH2011 Security

[Umfriend]

OK, so I *really* need to be able to do whatever the hell I want with a System Volume Information folder and all objects within. What steps do I need to take to be able to do that.

I am soooooo pissed off at my OS not letting me do what needs doing. Help!

[Jammrock]

You really, really, really, really should not play with the System Volume Information folder. Dead serious. You screw that up and your system is toast.

In my 16 years of IT I have had exactly one case that required me to enter and modify the SVI dir. Once. And I spent two days in QA building a perfect process that wouldn't screw up my servers before I touched production.

So can it be done? Yes. Should you do it? Probably not.

What specific need do you have to access SVI?

[UtwigMU]

Boot from linux live CD, mount NTFS partition, do whatever you want.

Don't fool with that folder unless you need to and have a specific reason to do it.

Correct me if I'm wrong but:
That folder contains files allocation table, on NTFS files smaller than cluster size get stored directly in files allocation table. Generally system reserves some room for that so this is why system volume information can grow, and makes you want to peek inside.

[Umfriend]

Well, OK, I don't actually need to delete the folder or contents but I do need to shrink a partition way past halfway and it won't let me do that as some files are unmovable and stored halfway the partition, these have to do with Shadow Copies, which can be deleted without risk.

Other that that there is nothing there and I *have* deleted SIV a few times before without issue. AFAIK, only info wrt backup/restore/versioning is stored there, nothing critical. Never seen anything critical in there.

[Jammrock]

There are some databases in there that can mess up Windows if they are deleted or altered. If shadows copy are eating up space there are some ways to shrink it without directly accessing it.

Open System properties (Win+Pause/Break > Advanced System Settings, or Control Panel > System). Go to the System Protection tab. Configure button. From there you can delete restore points, change the amount of space used, etc.

You can also use the vssadmin command to delete shadows.

http://technet.microsoft.com/en-us/library/cc788026.aspx

[Umfriend]

But shadow copies are not used on that drive. They are remainders of the WHS 2011 Server Backup. In any case, I can really take care of me. Heck, if I wanted to wreck the system there's shitloads of easy ways to do it without messing with SVI.

So again, how do I get control of that through windows?

[Jammrock]

WHS uses shadow copies, via the Volume Shadow Copy service (VSS), to backup a computer. Thus clearing the vss shadows would likely clear the WHS stuff out of SVI.

But, if you really must know I'll drop the steps below. Usual disclaimer: These steps are potentially dangerous to system health. Not responsible for any damages. Use at your own risk.

- Open Services and stop the Volume Shadow Copy server.


- Open Windows Explorer and go to the root of the drive where the SVI folder you want to modify resides.


- Right-click on the “System Volume Information” folder and select Properties.


- If you do not see the “System Volume Information” folder, Alt > Tools (from the hidden menu in 2008+) > Options.
- View tab
- Uncheck “Hide protected operating system files (Recommended)” and click Yes when prompted.
- OK


- Security tab


- Edit


- Add the local Administrators group and give them Full Control permissions.


- OK out of all the dialog boxes.


- Open an elevated PowerShell (run as administrator) console.

- Open Task Manager and leave it open! If you close Task Manager you will cause all sorts of problems later on.


- In Task Manager, go to the Processes tab, find “explorer.exe”, highlight, End Process.


Warning! If anyone else is logged into the server (more than one explorer.exe process running) have them log off or log them off before proceeding with this step.

- Your taskbar will now vanish when explorer.exe is killed, but don’t panic, it will be restored later.


- In PowerShell enter: sl “C:\System Volume Information\” ... or whatever path you need to modify.


- Type “dir” (no quotes) and press Enter to get a list of the folder contents.


- Copying in PowerShell is like marking in command prompt. Simply click and drag over the name in the PowerShell window and then press the Enter key to copy it to the clipboard.


- In PowerShell use this to delete content: remove-item ".\<file>" -force ... if you want to delete a folder use -recurse as well.


- Enter “dir” to make sure the file/folder is gone.


- In Task Manager, go to File > New Task (Run…)


- Enter “explorer.exe” and click OK. Your taskbar should now return.


- Start the Volume Shadow Copy service.


Those are the steps. Because you have to stop explorer.exe to gain access to SVI you must use PowerShell or CMD in order to navigate and delete. I'm a PowerSheller so that's what i use, but CMD should work too.

[Umfriend]

Thanks! It's not as simple as I'd have hoped but what can you do?

Yes, WHS 2011 uses VSS for client backups but those are written/used on the _client_ AFAIK, these are all on the Server...

[UtwigMU]

download gparted live CD (or make USB using free

http://www.pendrivelinux.com/universal-usb-installer-easy-as-1-2-3/#button

usb installer)

boot, it's easy, just drag slider to shrink.

Also back up any data before (haven't had a loss using gparted but you never know with partition operations).