Hi
It seem best solution is to get OS reload, as per article if you debug that will take lot of time if it is in production.
If you want to still check , go to sysinternals.com (now taken over by Microsoft )and find permission tools to get all details on your server and compare.
You can share event logs from server that can also help to check this further