Solved Serious bug in win7

i've accidentally set Administrators Group deny Full control on a harddisk using Administrator account.

and now nomatter what i do still can't get my permissions back.

i've try takeown ,cacls commend ,all got access dened
even run as SYSTEM still can't.

HELP

Hi -

See if Windows System Restore can help - choose a restore point before the permission setting changes -
START | type rstrui

Regards. . .

jcgriff2

`

i've disable Windows System Restore
and no backup any restore point

I'm afraid you're left with a clean reinstall of Windows then...however, if you can, install the new Windows to a different harddisk or different partition, then you might be able to regain ownership of any files you need to recover from the current system.

Messing with permissions from an administrator account without having restore points or backups is not very smart. Sorry to be blunt...

If I go out to my car and throw a wrench through my front windshield, I can't call it a bug and blame BMW. There is absolutely no reason to be messing with permissions on Windows 7, especially not on your system volume. As mentioned, it seems like your only option is to back up and do a clean install.

its was a accident
i've click cancel immediately when the loading bar comes up.

why even system account can't access this ?
i only set the Administrators group deny
system account is a member of admins group?
as i remember the system account have full control of this harddisk

You could try Hirens Boot CD (google for download link) there is a tool called NTFS Access 2.1 that may be useful to you.

If it was me, I would probably just go the route of the clean install. I wouldn't ever trust a system again once it had an issue like this. In two hours, you could be back up and running with a new install, fully updated.

Didn't someone post "How to restore Windows default permissions" instructions on a thread recently?

I'm am sure I read something about it on this site in the past few weeks.
I'll try to find it and post the link.

You could try this ...

Have a look at this thread:

Restore security permissions to default settings??
http://www.sevenforums.com/backup-restore/59100-restore-security-permissions-default-settings.html

WARNING:
I haven't tried this, so I can't verify it's accuracy. Use at your own risk.

The "deny" permission in NTFS is a very specialised instruction and it has priority over all other permissions levels, ji is designrd for use in Client server systems where you would normally have a Domain admin that can reset any accidents. It should be used only for very special purposes, normally only for testing, and never to whole areas.

This being said you may be able to recover data on the now locked system partition by the use of a repair install - check tutorials section for detailed instructions, though these permissions may even be to much for this, it is worth a try

As Barman58 said, deny permissions will override allow permissions - and while the SYSTEM might still have access that won't help you unless you can somehow impersonate the system instead of logging in as an administrator. Somehow I doubt you can.

All the tutorials to reset permissions won't help at this point since you've really pulled the rug out from under you. I'm sorry, but accident or not - you must have set up circumstances for the accident to happen in the first place.

I hope that it is a learning experience for you, and that you're not going to have to lose too much important data.

Try a fresh install - remember, to a different partition or HD - and then feel free to get back to us to help get your files off the locked-out system.

Idea: you might be able to retrieve files by booting from a Linux CD with NTFS support. Linux typically ignores Windows' access permissions completely. IF this indeed works, I would recommend copying the files to a FAT32 partition since FAT32 doesn't support permissions either. That way the bad permissions would automatically be stripped off the files, making them accessible for you again.

Corazon said:

...while the SYSTEM might still have access that won't help you unless you can somehow impersonate the system instead of logging in as an administrator.

Click to expand...

How about running another command prompt as a System Service from the user command prompt?

Above code essentially creates a cmd process as a scheduled service under the SYSTEM user, runs it, and then deletes the service immediately after running.

thank for your guys advise.
The data backup is important but not my concern,
i know there are some way to get my data back,
my concern is how to unlock this harddisk without format or reinstall system.

would my harddisk plugin other computer is still locked?
This locked harddisk Q:\ is not my system disk, just a data disk.

btw i find out i can access Q:\ using comodo browse file.
and it can read write delete but not change the permission.

Drive Q: = virtual drive for Office 2010 "Click-to-Run" downloaded versions -
http://blogs.technet.com/b/office20...un-delivering-office-in-the-21st-century.aspx

http://support.microsoft.com/kb/2028653
http://support.microsoft.com/kb/2257628
http://support.microsoft.com/kb/982434

Regards. . .

jcgriff2

`

The NTFS permissions are actually written to the hard disk as part of the file header of each individual file/folder. Generally if you Move a file it's permissions move with it.

When files are copied they take the permissions of the receiving folder so copying is usually a way to reset the file permissions.

As the Deny permission applies to the copying of files this would not normally be possible, though if the Comodo app allows you to copy files and follows convention on permissions, it may allow you to copy the files and set the permissions back to what you wish. Of course the Original files would still be inaccessible and would need to be deleted and replaced by the copies.

So basically, once you have set a deny permission for a user or group there is no way for that user or group to change the permissions, This is by design and is the correct way to work.

It may be possible to work around this issue but as far as I am aware there is not a way to undo this accident with Windows Own tools or any that conform to the NTFS specification

would Windows PE be helpful?

jcgriff2 said:

Drive Q: = virtual drive for Office 2010 "Click-to-Run" downloaded versions -
Click-to-Run: Delivering Office in the 21st Century - Microsoft Office 2010 Engineering - Site Home - TechNet Blogs

Information about Office Click-to-Run installations and about related anti-malware applications
Office 2010 Starter Virtual (Q drive may intermittently disappear from My Computer
An overview of Microsoft Office Click-to-Run for Office 2010

Regards. . .

jcgriff2

`

Click to expand...

the harddisk Q:\ is not relate to any things
its just a harddisk and it name Q:\

Sub Styler said:

You could try Hirens Boot CD (google for download link) there is a tool called NTFS Access 2.1 that may be useful to you.

Click to expand...

good post...

The NTFS permissions are set and imposed by the operating system and they are limited to that operating system in that physical system only.

I had somewhat similar experience for my second hard disk which I was not able to access ( I have made the disk accessible only to my user account stripping off all the other users and groups including the system and administrators group). When I reinstall the OS after a few months later with a new user name (same name but on a fresh install), I could not access this second hard disk as the second hard disk could not identify the credentials of the new user. I just used the take ownership of the disk with the new user (member of admin group) and I got back the access.

Similarly a hard disk locked by an OS in a computer is strong enough only for that OS in that system. Once this hard disk is moved to another system, the NTFS security is weakened and it is easy to break the security with take ownership and assigning the full permissions again. That is why physical security is also important for servers in an enterprise and they are placed in locked rooms.

So it is possible to gain access to this hard disk even if it is assigned with deny permissions to Administrators group (This group is limited to that system only), by the following three methods.

1. Remove the HDD from the system and connect it to another system with Windows (XP, Vista or 7) and take ownership and reassign permissions to include full control to Everyone group only deleting all the other permissions.

2. Make the system a dual boot system and access the HDD from second Windows OS (XP, Vista or 7) and take ownership and reassign permissions to include full control to Everyone group deleting all the other permissions.

3. Try to boot the system with a Live Windows CD (ERD Commander, MSDART 5.0 for Win XP or 5.5 for Win Vista or 6.5 for Win 7, Bart's PE, Win PE or UBCD4Win) and take ownership and reassign permissions to include full control to Everyone group deleting all the other permissions. You will find sources to download one of these CDs on internet.

Once Everyone permissions are set, the HDD becomes accessible to the original OS. Now the OP can set new permissions to his requirements.