A little of the process log I got from Process Monitor (http://technet.microsoft.com/en-us/sysinternals/bb896645)
There’s a sharing violation near the end, but I’m not sure if its anything relevant.
=============================
“Time of Day”,“Process Name”,“PID”,“Operation”,“Path”,“Result”,“Detail”,“User”
“12:56:18.9077307 PM”,“php-cgi.exe”,“14892”,“QueryDirectory”,“C:\egroupware-data”,“SUCCESS”,“Filter: egroupware-data, 1: egroupware-data”,“IIS APPPOOL\eGroupWare”
“12:56:18.9078410 PM”,“php-cgi.exe”,“14892”,“CreateFile”,“C:\egroupware-data”,“SUCCESS”,“Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: NT AUTHORITY\IUSR, OpenResult: Opened”,“IIS APPPOOL\eGroupWare”
“12:56:18.9078649 PM”,“php-cgi.exe”,“14892”,“QueryDirectory”,“C:\egroupware-data\temp”,“SUCCESS”,“Filter: temp, 1: temp”,“IIS APPPOOL\eGroupWare”
“12:56:18.9078908 PM”,“php-cgi.exe”,“14892”,“CloseFile”,“C:\egroupware-data”,“SUCCESS”,"",“IIS APPPOOL\eGroupWare”
“12:56:18.9079700 PM”,“php-cgi.exe”,“14892”,“CreateFile”,“C:\egroupware-data\temp”,“SUCCESS”,“Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: NT AUTHORITY\IUSR, OpenResult: Opened”,“IIS APPPOOL\eGroupWare”
“12:56:18.9079930 PM”,“php-cgi.exe”,“14892”,“QueryDirectory”,“C:\egroupware-data\temp\ganE475.tmp”,“SUCCESS”,“Filter: ganE475.tmp, 1: ganE475.tmp”,“IIS APPPOOL\eGroupWare”
“12:56:18.9080186 PM”,“php-cgi.exe”,“14892”,“CloseFile”,“C:\egroupware-data\temp”,“SUCCESS”,"",“IIS APPPOOL\eGroupWare”
“12:56:18.9081267 PM”,“php-cgi.exe”,“14892”,“CreateFile”,“C:\egroupware-data\temp\ganE475.tmp”,“SUCCESS”,“Desired Access: Generic Write, Read Attributes, Disposition: OverwriteIf, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize: 0, Impersonating: NT AUTHORITY\IUSR, OpenResult: Overwritten”,“IIS APPPOOL\eGroupWare”
“12:56:18.9081413 PM”,“php-cgi.exe”,“14892”,“UnlockFileSingle”,“C:\egroupware-data\temp\ganE475.tmp”,“RANGE NOT LOCKED”,“Offset: 0, Length: 1”,“IIS APPPOOL\eGroupWare”
“12:56:18.9081525 PM”,“php-cgi.exe”,“14892”,“LockFile”,“C:\egroupware-data\temp\ganE475.tmp”,“SUCCESS”,“Exclusive: True, Offset: 0, Length: 1, Fail Immediately: False”,“IIS APPPOOL\eGroupWare”
“12:56:18.9081610 PM”,“php-cgi.exe”,“14892”,“CreateFile”,“C:\egroupware-data\temp\ganE475.tmp”,“SHARING VIOLATION”,“Desired Access: Read Attributes, Delete, Disposition: Open, Options: Non-Directory File, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: NT AUTHORITY\IUSR”,“IIS APPPOOL\eGroupWare”
“12:56:18.9081676 PM”,“php-cgi.exe”,“14892”,“UnlockFileSingle”,“C:\egroupware-data\temp\ganE475.tmp”,“SUCCESS”,“Offset: 0, Length: 1”,“IIS APPPOOL\eGroupWare”
“12:56:18.9273157 PM”,“php-cgi.exe”,“14892”,“CloseFile”,“C:\egroupware-data\temp\ganE475.tmp”,“SUCCESS”,"",“IIS APPPOOL\eGroupWare”