'Warning: Overlap: Directory' recorded in my CBS.LOG file

streetwolf · 28 Jul 2019

When I look inside CBS.LOG I find the warning messages below. They are not errors and running sfc /scannow comes up clean. I'm curious about these warning messages as they are always the same directories. I checked their permissions and nothing out of the ordinary pops out at me. It appears no harm is being done and other folks with overlay messages think that it's the fault of sfc itself not behaving properly. Any thoughts on this would be appreciated.

2019-07-27 16:43:51, Info CSI 000001cc Warning: Overlap: Directory \??\C:\Program Files (x86)\ is owned twice or has its security set twice
Original owner: Microsoft-Windows-shell32, version 10.0.18362.267, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35}
New owner: Microsoft-Windows-shell32, version 10.0.18362.267, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35}
2019-07-27 16:43:51, Info CSI 000001cd Warning: Overlap: Directory \??\C:\ProgramData\Microsoft\Windows\Start Menu\ is owned twice or has its security set twice
Original owner: Microsoft-Windows-shell32, version 10.0.18362.267, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35}
New owner: Microsoft-Windows-shell32, version 10.0.18362.267, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35}
2019-07-27 16:43:51, Info CSI 000001ce Warning: Overlap: Directory \??\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ is owned twice or has its security set twice
Original owner: Microsoft-Windows-shell32, version 10.0.18362.267, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35}
New owner: Microsoft-Windows-shell32, version 10.0.18362.267, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35}
2019-07-27 16:43:51, Info CSI 000001cf Warning: Overlap: Directory \??\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ is owned twice or has its security set twice
Original owner: Microsoft-Windows-shell32, version 10.0.18362.267, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35}
New owner: Microsoft-Windows-shell32, version 10.0.18362.267, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35}

Try3 · 28 Jul 2019

I always find the same is owned twice or has its security set twice entries as you in my CBS logs for

C:\Program Files (x86)\ C:\ProgramData\Microsoft\Windows\Start Menu\ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ C:\WINDOWS\help\mui\0409\ C:\WINDOWS\System32\drivers\en-US\ C:\WINDOWS\SysWOW64\wbem\en-US\

and when I look at the folder Properties, Security, Advanced, Permissions I see that the Administrators group & System have two entries. Here is an example of such doubling up [upper part of diagram] along with a normal set [lower part of diagram].

'Warning: Overlap: Directory' recorded in my CBS.LOG file-owned-twice-has-its-security-set-twice.png

So I can understand what the CBS log entries are referring to.
- I have only seen security permissions being set twice rather than Owner [which is why the error message says or]. Anyway, I don't know where I could look for Owner being set twice.
- By the way, these are not SFC entries. SFC entries all contain [SR]
- CBS log is also used by other Windows components and these entries are written by {an unknown} one of them.
- I find the same CBS log entries & the same permissions doubling up on other computers.

I have never investigated this and have posted the info in the hope that it will encourage responses to your question.

This topic was discussed in sfc scannow Error-Overlap

uplicate ownership for directory - TenForums but I am not at all persuaded by the alleged fix [Repair install] even though the OP said it worked. The main difference in that case was that the OP reported SFC failing partway through. I think that the OP was probably only ever referring to the SFC failure and not to the entries in the CBS log.

Best of luck,
Denis

71LoveTech · 10 Feb 2021

I'm having this same problem. However, since someone has set up a vlan2 on my router and it does have a public IP address - and restoring my pc does not do any good. Finding the problem would help solve the problem and more.
So, let say this vlan2 is the new account or original , how would I find the activity on it. I also have what looks like a filter when I sign into my computer. Group Policy does not exist on window 10 upgrade apparently. But, I have been in and saw the policy list. There is a defaultuser.1 and some other accounts from studying SQL. I know I can disable them. But, first I wanted to know your opinion on how could I actually find the activity that going on with the original or new account and who is it.

2021-02-03 20:41:34, Info CSI 00000175 Warning:
Overlap: Directory \??\C:\ProgramData\Microsoft\Windows\Start Menu\
Programs\ is owned twice or has its security set twice
Original owner: Microsoft-Windows-shell32, version 10.0.19041.423,
arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35}
New owner: Microsoft-Windows-shell32, version 10.0.19041.423, arch
amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35}

BZ0227 · 25 Mar 2021

My computer (W10 Pro 20H2) is showing the same problem. About a dozen Warnings in the CBS log each time I run sfc /scannow. They are the same folders Try3 listed in his post. Example of mine below:
2021-03-25 10:14:19, Info CSI 000001f5 Warning: Overlap: Directory \??\C:\ProgramData\Microsoft\Windows\Start Menu\ is owned twice or has its security set twice
Original owner: Microsoft-Windows-shell32, version 10.0.19041.844, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35}
New owner: Microsoft-Windows-shell32, version 10.0.19041.844, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35}

Not having any noticable computer problems. I plan to ignore the problem for now, but it is concerning.

swimf1989 · 31 Mar 2021

this same problem is plaguing me for what seems an eternity.

in place upgrade didn't freaking help, shocker it says try another upgrade....

clean install is no better, and i feel as ive tried everything in my power to correct the errors (undoubtedly made to frustrate ). short of swapping out both my 100% healthy ssds, putting windows on a new drive, and booting "fresh" and hoping this nightmare error ****s off from whatever Cloud stored ****ing horror house it survives in...

although i can't really see that being much benefit since this thing seems to occupy more then just hard drive storage if it's protecting physical fkin access to my g damn uefi settings. 🔥

Bree · 31 Mar 2021

Generally I only see those 'overlap' warnings after installing an optional 'preview' CU.

By the way, these are not SFC entries. SFC entries all contain [SR]

Well, they are in the sense that they only get reported when you run SFC, and that SFC /ScanNow will fix them, reporting the new owner and the original owner in the CBS log (which are invariably one and the same).

In practice they are just warnings, not significant errors. They are of no consequence as the correct owner/permissions are in place, just set twice....