Can anyone help? Windows 7 permissions

[Carol Haynes]

I need to replace corrupted/missing files and folders in Windows 7 64-bit. (A heavy cleanup deleted some stuff that stops SP1 installing).

The path I need to copy into is:

C:\Windows\System32

I have turned off UAC and still get access denied errors (even though the account is in the admin group, and the files/folders are not in use because they don't actually exist).

The problem I have is that I don't want to change the ownership on the folder because it is currently owned by TrustedInstaller and I am not sure how to reinstate the correct permissions after the files are copied.

What I have read suggest I should use the following to gain access from an elevated CMD prompt

takeown /f C:\Windows\System32
icacls C:\Windows\System32 /grant username:F

but that will leave the wrong owner on the whole of System32 which isn't a good idea.

Any ideas how to do this correctly and have the correct permissions afterwards?

[40hz]

If it's just SP1 you want to block by replacing those folders, wouldn't it be easier to use Microsoft's Windows Service Pack Blocker Tool Kit which can be downloaded here? It's a tiny download.

Note: once you run it you'll have to use the standalone installer or a CD to install SP1 if you change your mind later on.

Addendum:

If you go to the properties of the System32 folder and go under the security tab you can select users and temporarily grant FULL control which will get you around the "access denied" error. That should let you replace folders at will.

[Carol Haynes]

Actually I am trying to install SP1 and it is failing with an error. The system used to have an nVidia graphics card and it was swapped for an AMD/ATI card to allow 3 monitors.

The change really got screwed up as the drivers got into an infinite circle or errors and blue screens. The solution I used was to use DriverSweeper to remove the older drivers and start from clean.

Unfortunately DriverSweeper also removed the packaged drivers from MS for ATI and nVidia and SP 1 now wnon't install because preinstalled drivers are missing (even thoigh they aren't being used). This is a known issue with older versions of DriverSweeper.

There is a tool from MS to try and fix this sort of problem but it doesn't work.

The solution is to put the driver packages back and I need access to the winsxs and FileRepository folders.

Unfortunately disabling UAC and granting full access to the user doesn't get round the Access Denied error.

I can take ownership of the folders but the problem arises when I want to revert the ownership to the correct user. Winsxs is owned by "TrustedInstaller" which you can't return ownsership to (the user isn't recognised by the user/group check tool and so you can't assign ownership back). FileRepository seems to belong to "SYSTEM" which isn't a problem as you can return ownership to SYSTEM.

[Stoic Joker]

If you go to the properties of the System32 folder and go under the security tab you can select users and temporarily grant FULL control which will get you around the "access denied" error. That should let you replace folders at will.

If it's configured the way I think it is (and she's already using an admin acct) that will still stop it cold. Kinda like the Windows update folders that get left on the root of C: that are a PITA to delete.

Simplest would be just to configure permissions as needed to get the job done, and then apply the setup security template to put things back to "normal".

[Ath]

The solution is to put the driver packages back and I need access to the winsxs and FileRepository folders.

Have you tried putting the harddisk as a secondary disk in another Win7 system, so it isn't booted from, just a data-disk? Then the permissions should be less stringent, and allow you to add the missing files.

[mwb1100]

Unfortunately DriverSweeper also removed the packaged drivers from MS for ATI and nVidia and SP 1 now wnon't install because preinstalled drivers are missing (even thoigh they aren't being used).

Have you tried to perform a 'repair' installation of Windows to get the packaged drivers back?  I think that's the course of action that Microsoft would suggest.

[Stoic Joker]

He's got (good) a point ^there^.

[Stoic Joker]

Strange. I just tried creating a folder in my System32 folder, and it let me (its owner was/is also TrustedInstaller).

[mwb1100]

Strange. I just tried creating a folder in my System32 folder, and it let me (its owner was/is also TrustedInstaller).

On my system (Win7 x64), Adminstrators have pretty nearly full access to C:\Windows\System32 in general, even if though it's owned by TrustedInstaller. The security settings for objects under the C:\Windows directory is quite a mish-mash because historically it's been used as a dumping ground for all sorts of files - many of which had nothing to do with Microsoft. But MS still feels the need to maintain some level of compatibility with those historical mistakes/oversights.

So for example, many folders and files may have stricter permissions.  c:\Windows\winsxs (note - it's not under System32 on my machine, maybe it is on some?) has only read permissions for everyone other than TrustedInstaller. And on my machine, c:\Windows\System32\DriverStore\FileRepository is pretty much read-only for everyone except "SYSTEM", even though it's owned by the Administrators group.

[Stoic Joker]

Strange. I just tried creating a folder in my System32 folder, and it let me (its owner was/is also TrustedInstaller).

On my system (Win7 x64), Adminstrators have pretty nearly full access to C:\Windows\System32 in general, even if though it's owned by TrustedInstaller. The security settings for objects under the C:\Windows directory is quite a mish-mash because historically it's been used as a dumping ground for all sorts of files - many of which had nothing to do with Microsoft. But MS still feels the need to maintain some level of compatibility with those historical mistakes/oversights.

So for example, many folders and files may have stricter permissions.  c:\Windows\winsxs (note - it's not under System32 on my machine, maybe it is on some?) has only read permissions for everyone other than TrustedInstaller. And on my machine, c:\Windows\System32\DriverStore\FileRepository is pretty much read-only for everyone except "SYSTEM", even though it's owned by the Administrators group.

Understood, and here also on both x86 & x64. My quandry was more regarding why Carol couldn't create the folders she needed to in the same location.


But despite the creative ideas 40hz & I came up with, I think you're right about the repair install being the simplest/best answer. ...We just got busted over-thinking the problem.

[Stoic Joker]

Okay this part was bugging me, so I did some Googling and found this:

http://blogs.msdn.com/b/irenak/archive/2007/01/30/sysk-277-how-to-bring-back-the-trustedinstaller.aspx

Short Version:

If you have moved the ownership to yourself so you could give yourself permissions to modify the resource, and now want to reset it back to TrustedInstaller as the owner, simply follow these steps:
•Right mouse button click on the file and choose Properties
•Click Security tab
•Click Advanced button
•Click Owner tab
•Click Edit button
•Click Other User or Group and type in NT SERVICE\TrustedInstaller
•Press Ok on all dialogs until all property dialogs are closed

Now the part it leaves out, is that if you are on a Domain, You'll need to switch the perms dialog to LM so it can/will find/validate the account.

Using the above I was able to successfully give ownership to the TrustedInstaller group for a test folder.


Great Question Carol!!!

[Carol Haynes]

A repair install; isn't really an option as it is a preinstalled HP installation without disks and I am not 100% sure the license key on the box will work! I don't want to try a repair install from another DVD only to find the license won't work or activation fails!

I can't add folders to Winsxs even with admin permissions - I just get access denied.

How can I reapply TrustedInstaller ownership if I take ownership?

Better does anyone know how to reapply the standard security template to the Windows folder tree if I bugger about - I used to be able to do this to WinXP but I have never done it to Win7 x64 and Microsoft's Support site is now worse than useless - almost all the KB results you get take you to irrelevant community posts.

[Stoic Joker]

A repair install; isn't really an option as it is a preinstalled HP installation without disks and I am not 100% sure the license key on the box will work! I don't want to try a repair install from another DVD only to find the license won't work or activation fails!

A few weeks back I installed Win 7 pro on an HP using Dell media. The Win 7 home key didn't work, but our companies MSDN/Retail key activated just fine (yes it was only for internal testing and therefore "legal" to do ). Point being their flexable. If you have any OEM media (for the correct edition), and a valid legible COA it should activate just fine. Some of the things that did activate (in tests I've run) were actually rather shocking.

I can't add folders to Winsxs even with admin permissions - I just get access denied.

If there is trouble in there, just use the .NET cleanup utility, and reinstall the .NET versions you need.

How can I reapply TrustedInstaller ownership if I take ownership?

I answered that a few posts above.

Better does anyone know how to reapply the standard security template to the Windows folder tree if I bugger about - I used to be able to do this to WinXP but I have never done it to Win7 x64 and Microsoft's Support site is now worse than useless - almost all the KB results you get take you to irrelevant community posts.

It's done using the secedit utility, but thinking after posting I do recall reading that that method doesn't "fix" folder perms in anything past XP. ...Sorry.

[Carol Haynes]

How can I reapply TrustedInstaller ownership if I take ownership?

I answered that a few posts above.

Sorry I missed it because it looked like a quote. Mea culpa - but that is a really useful bit of info thanks!

[mwb1100]

A repair install; isn't really an option as it is a preinstalled HP installation without disks and I am not 100% sure the license key on the box will work!

Doesn't HP generally provided an option to create installation media from their own repair utility? I thought I had done that for my daughter at one point (not having installation media is very irritating).

Since I don't really know much about activation, I can't make any promises, but my recollection is that a repair install doesn't ask for a license key (but maybe it will if it thinks activation is one of the things that's broken?).  But I certainly don't want to goad you into doing something you can't undo, so perhaps I should just quit now...

[Carol Haynes]

Yes but that would mean backing up all the data, reinstallling Windows, reinstalling all applications and restoring all the data. Not something I really want to contemplate.

A repair install is done using Windows 7 installation media and using the Upgrade option. The problem is that unless you have Windows installation media from HP which doesn't require a license key you have to use a commercial copy that does require a license and activation. I have had bad experiences using the license key on the label stuck to the box - they only seem to work about 50% of the time and if it fails HP will say do an install from their backup media and MS will say talk to HP! Either way it would be a real PITA

Even if the license key is accepted and the repair install works you then have to reinstall all windows updates which is a pretty long job and some applications may need to be reactivated which means contacting software vendors if the activation is not successful automatically - that can take days. This is an essential office machine that is used all day everyday - it can't be out of action waiting for companies to respond to emails.

[Stoic Joker]

I have had bad experiences using the license key on the label stuck to the box - they only seem to work about 50% of the time and if it fails HP will say do an install from their backup media and MS will say talk to HP! Either way it would be a real PITA

Carol... You're giving them far too much information when you call. Skip HP's tech support, they're idiots. Just call the MS activation number and play dumb. It's never failed for me, especially if I use a southern accent (they want Billy-Bob off the phone like now!).

Pre XP SP3 disks can be touchy/hit-or-miss. Dell (OEM) XP SP3 disks seem to work the best for me (never rejects a valid COA for any brand PC). Dell (OEM) Vista & 7 I've never had a problem with either.


But if the machines is that critical, I'd just go with the folder perms tweaking and then stuff the SP in too. Especially if it's got some special (/sketchy) verticle market stuff on it. That always turns ugly because the client never seems to have their reg info ... Or the install media for that matter.

[Shades]

Fred Langa recently did a piece about reinstalling Windows 7 without losing your setup, the same as he did for XP.

As I personally can attest to salvaging XP machines with his article about XP, I think it would be worth a try to do the same using his Windows 7 article.

[Carol Haynes]

The trouble is his solution is the 'upgrade' install mentioned above.