I've been dealing with an issue where every directory in our network share is cluttered with a file named "Open Notebook.onetoc2." No matter how many times I try to delete these files, they keep reappearing after just a few moments. After some research, I understand that this happens when someone opens a parent directory as a OneNote notebook, but I'm unable to identify who that person is. When I check the ownership of these .onetoc2 files, they are attributed to random users with access to the share, and bizarrely, one even claims I'm the owner. Since we have hundreds of users on the share, I can't just ask everyone. I would really appreciate any advice on how to track down the culprit or the machine causing this issue!
4 Answers
You can also delete these .onetoc2 files through PowerShell by navigating to the right top-level folder and using this command: Get-ChildItem -Filter "*.onetoc2" -Force -Recurse | Remove-Item –Force. Make sure all OneNote notebooks are closed before doing this, but be careful with this command as it might also remove valid OneNote contents!
If you're using a Windows server, I recommend running Process Monitor with a filter on the specific folders where these files appear. Delete the .onetoc2 file from those folders and watch to see if Process Monitor logs when it gets recreated. You'll likely find out who or what created it, plus the file ownership of the new instance should match the original creator.
Definitely consider enabling file auditing, if you haven’t already. This will help you see what’s creating the file. Just be cautious, as auditing can put a significant load on a large share.
Have you checked the file properties to see who is listed as the owner? That might give you a clue about who is causing this.
Yeah, I mentioned that in my question. The owners are random users, which is part of the problem!
Totally agree! Process Monitor is fantastic. Just make sure to get familiar with the filters since there’s so much data flowing through it.