Solved Fixing a computer with hosed permissions & activation problems?

Keirnoth · Oct 7, 2012

I offered to repair a computer for an acquaintance, but I've run into a billion brick walls while doing so. This is an HP Pavilion dv6 running Windows 7 Home Premium 64-bit.

The user got himself locked out of the C:\ drive and a whole bunch of stuff either refused to work or refused to launch, including some Windows services.

The C:\ drive was initially showing up with no information when I opened up Computer - just "NTFS", double clicking on it gave me a C:\ drive is inaccessible. Access is denied error.

I checked the permissions on the root level of the drive - I noticed only the Administrators group and the SYSTEM group were in there. I compared it against my machine's C:\ drive, which had an Authenticated Users and Users group.

I restarted into Safe Mode and for some reason the user account (which is supposed to have admin rights) was NOW able to access the C:\ drive. As a test, I enabled the hidden Administrator account and attempted to access the C:\ drive in both normal and safe mode - success, but Windows services were still messing up.

While in safe mode I disabled UAC and also added the Authenticated Users and Users groups (following the same permissions that were on my own computer's C:\ drive) and applied it to the root level of the C:\ drive (I did not propogate the permissions to the folders below it in fear of breaking something). However, I'm fairly sure that the directories below the root level are also messed up. I also checked to make sure the user account was in the Administrator group by using net localgroup Administrators (had to use the command line since Home Premium doesn't allow access to the snap-in).

After making these changes, I was able to boot into normal mode, log in as the user, and run most programs. However, I still have a second problem - the machine is claiming that it is no longer genuine with the dreaded black background.

I ran a sfc /scannow in normal Windows and I was unable to get it to fix anything - it said it found corrupted files but was unable to repair them. Later on I ran it in the recovery mode (using the offline switches) and it said it didn't find anything that needed to be repaired. Let me know if you need me to upload the CBS log.

I ran a chkdsk /R and it didn't find anything either.

I attached the MGA Diag tool log.

I tried to start a repair install but it's requiring me to deauthorize iTunes, but in order to do that I have to get the password from the user. Unfortunately, I can't contact the user until Tuesday.

Anyone have any ideas what I should do to try to get the permissions on his system back to normal and re-authorize Windows?

Golden · Oct 7, 2012

Hi,

You forgot to attach the MGADIAG report/log. Attach it to your next reply, and I'll have a look for you.

Regards,
Golden

Keirnoth · Oct 7, 2012

Dangit, I knew I forgot something. Here you go.

Golden · Oct 7, 2012

Hi,

Thanks. The report points to several problems, but I've not seen these before. I'll ask NoelDP to look at these, but in the meantime, what happens if you try to activate this installation again using the product key on the COA sticker?

Regards,
Golden

NoelDP · Oct 7, 2012

This is a rare one!

The problem almost certainly lies in the permissions for the AppData folder in the NetworkServices profile.

Let's check
Open an Elevated Command Prompt window, and run the following commands

ICACLS C:\Windows\ServiceProfiles\NetworkService\AppData
ICACLS C:\Windows\ServiceProfiles\Networkservice
ICACLS C:\Windows\ServiceProfiles
ICACLS C:\Windows
ICACLS C:\Windows\System32

post the results

Here are some instructions to make life easier

1) To open an Elevated Command Prompt Window (the CP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

Keirnoth · Oct 7, 2012

Golden said:
Hi,

Thanks. The report points to several problems, but I've not seen these before. I'll ask NoelDP to look at these, but in the meantime, what happens if you try to activate this installation again using the product key on the COA sticker?

Regards,
Golden

I'm unable to do the in-place repair install (and therefore, unable to enter the COA key) because I would have to deauthorize/uninstall iTunes. I won't be able to contact the user about that until Tuesday, so I have to fix this computer the "hard way" or wait until then. I'm genuinely curious about what's broken and I'd like to go through the troubleshooting steps before using the repair install solution just to see if this sort of problem can be remedied.

NoelDP · Oct 7, 2012

Please post the requested registry query results

Keirnoth · Oct 7, 2012

NoelDP said:
Please post the requested registry query results

Sorry about that Noel - I was on my smartphone when I responded to golden and didn't have access to the laptop.

Here's the results:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\>ICACLS C:\Windows\ServiceProfiles\NetworkService\AppData
C:\Windows\ServiceProfiles\NetworkService\AppData NT AUTHORITY\SYSTEM

F)
BUILTIN\Administrators

F)

Successfully processed 1 files; Failed processing 0 files

C:\>ICACLS C:\Windows\ServiceProfiles\Networkservice
C:\Windows\ServiceProfiles\Networkservice NT AUTHORITY\SYSTEM

F)
BUILTIN\Administrators

F)

Successfully processed 1 files; Failed processing 0 files

C:\>ICACLS C:\Windows\ServiceProfiles
C:\Windows\ServiceProfiles NT SERVICE\TrustedInstaller

I)(F)
NT SERVICE\TrustedInstaller

I)(CI)(IO)(F)
NT AUTHORITY\SYSTEM

I)(F)
NT AUTHORITY\SYSTEM

I)(OI)(CI)(IO)(F)
BUILTIN\Administrators

I)(F)
BUILTIN\Administrators

I)(OI)(CI)(IO)(F)
BUILTIN\Users

I)(RX)
BUILTIN\Users

I)(OI)(CI)(IO)(GR,GE)
CREATOR OWNER

I)(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\>ICACLS C:\Windows
C:\Windows NT SERVICE\TrustedInstaller

F)
NT SERVICE\TrustedInstaller

CI)(IO)(F)
NT AUTHORITY\SYSTEM

M)
NT AUTHORITY\SYSTEM

OI)(CI)(IO)(F)
BUILTIN\Administrators

M)
BUILTIN\Administrators

OI)(CI)(IO)(F)
BUILTIN\Users

RX)
BUILTIN\Users

OI)(CI)(IO)(GR,GE)
CREATOR OWNER

OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\>ICACLS C:\Windows\System32
C:\Windows\System32 NT SERVICE\TrustedInstaller

F)
NT SERVICE\TrustedInstaller

CI)(IO)(F)
NT AUTHORITY\SYSTEM

M)
NT AUTHORITY\SYSTEM

OI)(CI)(IO)(F)
BUILTIN\Administrators

M)
BUILTIN\Administrators

OI)(CI)(IO)(F)
BUILTIN\Users

RX)
BUILTIN\Users

OI)(CI)(IO)(GR,GE)
CREATOR OWNER

OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\>

Let me know what you need me to do.

NoelDP · Oct 7, 2012

OK - run the following commands in an Elevated Command prompt....

ICACLS C:\Windows\ServiceProfiles\Networkservice /grant "NT AUTHORITY\Network Service"OI)(CI)(F)

reboot, and run the following commands

ICACLS C:\Windows\ServiceProfiles\NetworkService\AppData
ICACLS C:\Windows\ServiceProfiles\Networkservice
ICACLS C:\Windows\ServiceProfiles

post these results together with a new MGADiag report.

Keirnoth · Oct 7, 2012

Ran the command you told me to run. It was successful with no problems. After the reboot the not genuine notification is gone, but the wallpaper is still black. I'd like to get his original wallpaper back, if it's still cached/stored somewhere.

Also, when I hit "Copy" to copy the MGADiag, I get an error about failing to create output files, but it copies anyway. The error that comes up is "Failed to create output files, hr = 0x800706b5. Please contact support". Is this normal? Does this indicate something else should also be fixed, or can it be safely ignored? I remember there was a similar error code in the first MGA Diag:

Licensing Data-->
On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x800700B7' to display the error text.
Error: 0x800700B7

However, after running that command this error seems to be gone in the second MGADiag log.

Code:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\>ICACLS C:\Windows\ServiceProfiles\NetworkService\AppData
C:\Windows\ServiceProfiles\NetworkService\AppData NT AUTHORITY\SYSTEM:(F)
                                                  BUILTIN\Administrators:(F)
                                                  NT AUTHORITY\NETWORK SERVICE:(I)(OI)(CI)(F)
                                                  NT SERVICE\TrustedInstaller:(I)(F)
                                                  NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
                                                  NT AUTHORITY\SYSTEM:(I)(F)
                                                  NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
                                                  BUILTIN\Administrators:(I)(F)
                                                  BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
                                                  BUILTIN\Users:(I)(RX)
                                                  BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
                                                  CREATOR OWNER:(I)(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\>ICACLS C:\Windows\ServiceProfiles\Networkservice
C:\Windows\ServiceProfiles\Networkservice NT AUTHORITY\SYSTEM:(F)
                                          BUILTIN\Administrators:(F)
                                          NT AUTHORITY\NETWORK SERVICE:(OI)(CI)(F)
                                          NT SERVICE\TrustedInstaller:(I)(F)
                                          NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
                                          NT AUTHORITY\SYSTEM:(I)(F)
                                          NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
                                          BUILTIN\Administrators:(I)(F)
                                          BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
                                          BUILTIN\Users:(I)(RX)
                                          BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
                                          CREATOR OWNER:(I)(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\>ICACLS C:\Windows\ServiceProfiles
C:\Windows\ServiceProfiles NT SERVICE\TrustedInstaller:(I)(F)
                           NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
                           NT AUTHORITY\SYSTEM:(I)(F)
                           NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
                           BUILTIN\Administrators:(I)(F)
                           BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
                           BUILTIN\Users:(I)(RX)
                           BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
                           CREATOR OWNER:(I)(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\>

NoelDP · Oct 7, 2012

OK - this should fix the remaining error....

This may simply be caused by a bad set of Intel Rapid Storage Technology drivers -

Installing the Intel Rapid Storage Drivers
try downloading and installing them from here - http://downloadcenter.intel.com/Detail_Desc.aspx?agr=Y&ProdId=2101&DwnldID=21730

(you want the iata_enu.exe download)

Once complete, please reboot twice, then post another MGADiag report.

Keirnoth · Oct 7, 2012

Done. Install update was successful. Still got that error when I tried to "Copy".

I'm having a problem that's possibly related to these permissions. Google Chrome won't start. Simply nothing happens - when I launch the shortcut from the start menu or directly from the Google Chrome program directory it shows up in the Task Manager process list for a split second and closes.

Not sure what's causing it, but I guess I'll have to make another thread about that?

Anyway, let me know what else you need me to do.

NoelDP · Oct 8, 2012

Hmm - the driver install didn't fix the remaining problem

Never mind, we have a few other tricks

try this.
Open Windows Explorer and navigate to the C:\Windows\System32 folder. find the Catroot2 folder there, and right-click on it - select Properties.

In the General tab, clear the box beside 'Read-only (Only.....' by clicking in it until it's empty (it cycles around three values)

Click Apply.
Accept any warnings that come up - if you get a 'Ignore/Ignore All/Try again' option, pick 'Ignore all'

Once complete (may be almost instantaneous),

reboot, and run another MGADiag report.

Keirnoth · Oct 8, 2012

Done, here's the fourth report. I still get that error when hitting the "Copy" button.

I noticed the Catroot2 directory would revert back to being a kinda grey-blue box when I brought up the Properties menu again after clicking Apply/OK. In other words, the "Read-only" flag refuses to stick (I see a couple folders in there that look like registry key IDs and those are the two folders that refuse to go out of read-only state.

Also, I checked inside the Catroot2 folder and opened up the dberr text file, I noticed the following:
CatalogDB: 7:46:54 AM 10/8/2012: catdbsvc.cpp at line #7075 encountered error 0x00000005
CatalogDB: 7:46:54 AM 10/8/2012: catdbsvc.cpp at line #3454 encountered error 0x00000005
CatalogDB: 7:46:54 AM 10/8/2012: catdbsvc.cpp at line #2702 encountered error 0x00000005
CatalogDB: 7:46:54 AM 10/8/2012: catdbcli.cpp at line #610 encountered error 0x00000005
CatalogDB: 7:46:54 AM 10/8/2012: catadnew.cpp at line #1915 encountered error 0x00000005
CatalogDB: 7:46:54 AM 10/8/2012: catadnew.cpp at line #907 encountered error 0x00000005
CatalogDB: 7:48:52 AM 10/8/2012: catdbsvc.cpp at line #1711 encountered error 0x00000005
CatalogDB: 7:48:52 AM 10/8/2012: catdbsvc.cpp at line #1859 encountered error 0x00000005
CatalogDB: 7:48:52 AM 10/8/2012: catdbsvc.cpp at line #994 encountered error 0x00000005
CatalogDB: 7:48:52 AM 10/8/2012: catdbsvc.cpp at line #6724 encountered error 0x00000005
CatalogDB: 7:48:52 AM 10/8/2012: catdbsvc.cpp at line #6918 encountered error 0x00000005

Being repeated quite often.

This happens if I run any program installs or updates. Should I be concerned? I checked against my personal machine and the personal machine comes out clean.

Additionally, on occasion a couple startup programs fail - HP Wireless Assistant and Facebook Messenger - the former Windows says "has stopped working" while the latter says something about a user-initiated halt, even though I didn't do anything. Not sure if it's related to this mess we have right now. They're random and don't happen every startup. :|

I'll try to figure out Google Chrome - let me know what else you need me to do.

NoelDP · Oct 8, 2012

The error when you hit the Copy button is not unusual - I haven't even attempted to find out what causes it yet, beyond establishing that it's simply a failure to copy the backup data to the hard drive (and since no-one I know of actually uses the backup data, it's irrelevant<g>) I suspect that at least sometimes it's caused by a 'double-hit' on the button causing a clash in the save procedures.

...back to your problem...
No change in the report.
Let's have a look at the SFC report details - but since it's a while ago, it would be best to repeat it, and then post the results....

SFC -System File Checker - Instructions
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.
At the Command prompt, type
SFC /SCANNOW
and hit the Enter key

Wait for the scan to finish - make a note of any error messages - and then reboot.
Copy the CBS.log file created to your desktop (you can't manipulate it directly) and then compress the copy and attach it to your response.

Also, Post a new MGADiag report with details of any error messages encountered.

Keirnoth · Oct 8, 2012

Scan's done:

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.
Windows Resource Protection found corrupt files but was unable to fix some of them.
Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example
C:\Windows\Logs\CBS\CBS.log

Here's the CBS log. I didn't want to transfer the CBS log across the network so I uploaded it to Dropbox. Let me know if you have problems retrieving it.

https://dl.dropbox.com/u/18373432/CBS1.zip

MGA log also attached.

But yeah, things still aren't working "right". Windows Updates are failing, PC Spyware Tools Doctor's service isn't running, etc. Lots of little things here and there that gives me the impression it's a permissions issue. As I said before, I don't want to resort to a repair install, but I will if our efforts does not fix this, but I also want to go through this troubleshooting process because I want to know exactly WHAT is broken. A repair install will probably fix these issues but I don't think I would've learned much compared to going through this stuff step by step.

I really appreciate your help - I've seen you post in a lot of other threads here and at Microsoft Answers and you're incredibly helpful and knowledgeable, and most importantly, patient.

NoelDP · Oct 8, 2012

You obviously haven't seen some of my snottier posts, then! :devil:

As far as I can see, there are no significant errors in your CBS.log.
Let's double-chceck it with a CheckSUR scan...

Please run the CheckSUR tool from http://support.microsoft.com/kb/947821
(you'll need to look in the details for Method 2)

Then zip the CheckSUR.log and attach it to your reply.
The tool can take anywhere from 5 mins to a couple of hours to run (or 'Install') depending on how much it has to do, and may exit silently - it may appear to freeze for most of that time, but be patient.

Keirnoth · Oct 8, 2012

Okay, I'm running CheckSUR, but it seems to be taking a LONG time. The disk is being thrashed though, so I guess it's working. I'll get back to you when it's finished.

Keirnoth · Oct 8, 2012

Alright, it's done.

NoelDP · Oct 8, 2012

You have 18 problem files there - all of them to do with Internet Explorer. The fact that they are all Manifest files probably means that there will be a huge number of files to repair once we get these sorted - but I'll have a go anyway (tomorrow - it's too late tonight!)

In the meantime, please run the following commands, and post the results.

SC QC EVENTLOG
SC QUERYEX EVENTLOG
ICACLS C:\Windows\System32\Logfiles\WMI
ICACLS C:\Windows\System32\Logfiles\WMI\RtBackup

Solved Fixing a computer with hosed permissions & activation problems?

New member

My Computer My Computer

At a glance

000

My Computer My Computer

At a glance

New member

Attachments

My Computer My Computer

At a glance

000

My Computer My Computer

At a glance

Three-Toed Sloth

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Three-Toed Sloth

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Three-Toed Sloth

My Computer My Computer

At a glance

New member

Attachments

My Computer My Computer

At a glance

Three-Toed Sloth

My Computer My Computer

At a glance

New member

Attachments

My Computer My Computer

At a glance

Three-Toed Sloth

My Computer My Computer

At a glance

New member

Attachments

My Computer My Computer

At a glance

Three-Toed Sloth

My Computer My Computer

At a glance

New member

Attachments

My Computer My Computer

At a glance

Three-Toed Sloth

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

Attachments

My Computer My Computer

At a glance

Three-Toed Sloth

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer