Lost settings

[Wolfgang.Juchmes]

From time to time my Textpad 9.6.1 loses its settings - I cannot see what causes that.
Can someone explain that?

(Woly)

[bbadmin]

TextPad saves its settings in this file:

Code: Select all

%APPDATA%\Helios\TextPad\9\ConfigState.xml

In case that file is on a bad sector of your disk, you should check for bad sectors as follows:

1. Start File Explorer
2. Open This PC
3. Right click C:
4. Choose Properties
5. Click the Tools tab.
6. Click the Check button.

[Wolfgang.Juchmes]

My disk is okay. Thats not the reason. Must be something different.

Yesterday it happened again: Started TextPad and it came with "Liesmich.txt" (readme.txt). Then I took a short look at my settings and they were all set to defaults (the general checkboxes, the file settings, tabstops..)

What can cause that?

[bbadmin]

The only way that can happen is if ConfigState.xml has been deleted. When TextPad detects that it does not exist, it recreates it with default settings, which causes it to open the selected language version of Readme.txt.

You can enable monitoring of file deletion in a folder using auditing as follows:

1. Enable File System Audit Policy:

• Display the Windows Run dialog using Windows Key + R.
• Type "gpedit.msc" and click OK.
• Select Windows Settings » Security Settings » Advanced Audit Policy Configuration » System Audit Policies » Object Access
• Double click "Audit File System" and check Configure and Success.
• In the Windows Run command, type "gpupdate /force"

2. Enable Auditing a specific folder:

• Right-click on the folder "%APPDATA%\Helios\TextPad\9" and choose "Properties."
• Go to the "Security" tab and click on the "Advanced" button.
• Switch to the "Auditing" tab and click on the "Add" button.
• In the "Select a principal" dialog, type "Everyone" and click "Check Names" then "OK."
• Click on "Advanced" to reveal all the options to monitor, including "Delete".
• Select the actions "Delete subfolders and files" and "Delete", and then click "OK."

3. View the Auditing Log:

• Open the Event Viewer, from the Windows key + X menu.
• Navigate to "Windows Logs" » "Security" in the Event Viewer.
• Choose the Find Action and search for "4660", for deleted files.

There's more information on deletion events here:

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4660

I hope this helps.

[Wolfgang.Juchmes]

I enabled auditing as described, but in Event Viewer there is no entry 4660 logged even if I delete a file (for testing).

[bbadmin]

Sorry, I already had File System Audit Policy enabled so I forgot to document that step. I have updated my post to explain how to do that.

In step 2, make sure to select both actions "Delete subfolders and files" and "Delete".

I tested it to make sure it works by deleting a file with Windows File Explorer and was surprised to see that the event is 4659, which is undocumented. However, when deleting it using TextPad's Manage Files command, the event is 4660 with an associated event 4663. Those events show which process was responsible.

[Wolfgang.Juchmes]

Okay - now that works fine. Thanks!