Windows Server 2008 Administrator can't take Ownership of file

Question

I'm trying to edit the hosts file on Windows Server 2008.

I right clicked on Notepad and Ran as Administrator, then opened the hosts file, but when I try to save it I get the following error message:

Cannot create the C:\Windows\System32\drivers\etc\hosts file.
Make sure that the path and file name are correct.

Next I checked the permissions for Administrators on the hosts file. The following are checked as Allow:

• Full Control
• Modify
• Read & execute
• Read
• Write

When I edit the permissions, all the check boxes are gray and not editable.

Next I check the file Owner of the hosts file. The Current owner is SYSTEM. When I try to edit the Owner I get the following message.

You only have permission to view the current owner on hosts.

The Windows documentation states

Ownership can be taken by:

An administrator. By default, the Administrators group is given the Take ownership of files or other objects user right.

In the Local Security Policy under the User Rights Assignment section, Take ownership of files or other objects is set to Administrators.

Why wouldn't I be able to change ownership to edit the hosts file?

Solution 1

I have seen antivirus programs do something similar. The AV program can intercept even Administrator file access. Many malware programs modify hosts to redirect certain sites without mucking around with DNS servers, so AV programs are hyper aware of that one file.

Solution 2

Copy hosts file on the other location, for example on Desktop. Edit that file which is on the Desktop and then copy file back to the original location and overwrite the old one.

BR

Comments

[Mark]

Right-click, Run as Administrator is what I meant by ran Notepad as Administrator .. sorry it wasn't clear.

[Florian Haider]

sorry i totally missed that in your post. Well I'm not sure what to tell you then...I wouldn't focus on ownership of the file though. Hosts is a special file so I'm not surprised there are special restrictions on that aspect. Maybe there is something wrong with the admin account you are using?

[Mark]

could be but I can't find any documentation on what those special restrictions are, maybe something related to the SYSTEM owner.

[Mark]

I had the AV disabled, but I went a head an uninstalled it and sure enough I was able to edit the hosts file after that.