Access denied and XX.tmp file visible in target

Espingo · September 24, 2025, 10:43am

Hi,

I installed Syncthing on two Windows servers to run like DFS, using version 2.0.10 on both.
I had permission issues initially, which I no longer have by adjusting them.
But now, I get this type of message on certain files (not all...) on the original server:

BCB\ARGUS\2025\Offres Fetes fin d'année\Argus LMO Cal Avent.indd syncing: finishing: setting metadata: Access denied.

And on the target server, I do have a file that copies itself called: ~syncthing~Argus LMO Cal Avent.pdf.tmp

but it won't name it the same as on the source server.
If I change the extension from .tmp to .pdf, the file opens fine.

How can I fix this problem?

Thank you

chaos · September 24, 2025, 11:15am

Syncthing creates a tmp file and then renames it when the sync is complete. If it’s an existing file, Syncthing renames the tmp file to the correct name, overwriting the previous version of the file.

It seems likely that Syncthing has permission to write but not overwrite files.

Espingo · September 24, 2025, 11:50am

Thanks for your answer, Yes you’re right, but it use my account that is domain admin. I had right problems before, I explicitly give it full control rights to folders, subfolders and files, and the problem is still here

chaos · September 24, 2025, 4:14pm

File permissions can be super weird on Windows. Use Get-ACL in PowerShell or icacls in the Command shell to see what those permissions are in that directory, and for the individual files. I also recommend that you confirm that the process owner of Syncthing is the account you think it is; from an elevated Command or Powershell prompt, use tasklist /v | findstr sync to confirm that. If you use a not-elevated shell, you won’t use the user that owns the process.

Espingo · September 25, 2025, 8:43am

I’ve already done those checks, and I show you the results below, but as far as I can see, there’s no problem… and it’s really frustrating!

get-acl “E:\DFS\XXX\XXX\ARGUS\2025\Offres Fetes fin d’année” | format-list

Path : Microsoft.PowerShell.Core\FileSystem::E:\DFS\Activa\BCB\ARGUS\2025\Offres Fetes fin d’année Owner : COOPERECOM\cpoussade Group : COOPERECOM\Utilisa. du domaine Access : AUTORITE NT\Système Allow FullControl BUILTIN\Administrateurs Allow FullControl COOPERECOM\adm-epujo Allow FullControl COOPERECOM\GG-P-ACTIVA Allow Modify, Synchronize Audit : Sddl : O:S-1-5-21-631715065-1718430045-760694770-3943G:DUD:AI(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;FA;;;S-1-5 -21-631715065-1718430045-760694770-3796)(A;OICIID;0x1301bf;;;S-1-5-21-631715065-1718430045-760694770-4074)

PS C:\Windows\system32> get-acl “E:\DFS\XXX\XXX\ARGUS\2025\Offres Fetes fin d’année\Argus LMO Cal Avent.pdf” | format-list

Path : Microsoft.PowerShell.Core\FileSystem::E:\DFS\XXX\XXX\ARGUS\2025\Offres Fetes fin d’année\Argus LMO Cal Avent.pdf Owner : COOPERECOM\adm-epujo Group : COOPERECOM\Utilisa. du domaine Access : AUTORITE NT\Système Allow FullControl BUILTIN\Administrateurs Allow FullControl COOPERECOM\adm-epujo Allow FullControl COOPERECOM\GG-P-ACTIVA Allow Modify, Synchronize Audit : Sddl : O:S-1-5-21-631715065-1718430045-760694770-3796G:DUD:AI(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;FA;;;S-1-5-21-63171506 5-1718430045-760694770-3796)(A;ID;0x1301bf;;;S-1-5-21-631715065-1718430045-760694770-4074)

PS C:\Windows\system32> tasklist /v | findstr syncthing syncthing.exe 8300 RDP-Tcp#18 3 4?896 Ko Running COOPERECOM\adm-epujo 0:00:01 C:\Users\adm-epujo\AppData\Local\Programs\Syncthing\syncthing.exe syncthing.exe 7248 RDP-Tcp#18 3 48?356 Ko Unknown COOPERECOM\adm-epujo 9:16:38 N/A PS C:\Windows\system32> Get-Process | Where-Object {

$_.Modules | Where-Object { $_.FileName -like "*Argus LMO Cal Avent.pdf*" }
} PS C:\Windows\system32> Get-Item “E:\DFS\XXX\XXX\ARGUS\2025\Offres Fetes fin d’année\Argus LMO Cal Avent.pdf” | Select-Object Attributes