How to Restore TrustedInstaller as Owner of a File in Vista and Window

I reviewed the tutorial in VISTA FORUMS that has the same title I placed on this posting. BRINK states:

Hi sbw07,

Most of everything in and including the System32 folder has TrustedInstaller as the owner. There are a few a items that should be owned by System and your administrator account instead, but there is just to many items to go through them all. You should be ok setting everything to TrustedInstaller though since the permission levels will still allow the others access.

Hope this helps,
Shawn

Is the same true on permissions if I make my administrator account the owner on everything within System 32? I am not changing any settings in permissions to my knowledge.

I stand corrected. A dialog box popped up if I wanted to grant FULL priviledges to my admin account & I said yes. Other than that all other permissions remain the same? That should be OK for the system to remain functioning?

Thanks for your opinion

Is the same true on permissions if I make my administrator account the owner on everything within System 32?

Not at all.

Most files in system32 should be owned by TrustedInstaller. This is for security reasons. Changing ownership to any other account will seriously degrade security. This effectively throws Windows Resource Protection out the window.

LMiller7 said:

Is the same true on permissions if I make my administrator account the owner on everything within System 32?

Not at all.

Most files in system32 should be owned by TrustedInstaller. This is for security reasons. Changing ownership to any other account will seriously degrade security. This effectively throws Windows Resource Protection out the window.

What throws PROTECTION out the window, ownership or permissions? If permissions remain the same then is BRINK correct or not?

I can always reset permissions back the way they were even if I am the owner.

Brink is correct, but making the admin account owner of the system32 folder is nothing like he is talking about. The problem when you do this is that the owner has some implicit rights, rights it should not have. As owner, the admin account and any software it runs will have write permission to files in the system32 folder. That means application installers can freely replace critical system files with older or otherwise incompatible versions. That has caused a lot of problems in older operating systems and what Windows Resource Protection was designed to solve.

It is a compromise between convenience and security. Security always has it's price.

Edit: Permissions in Windows is a lot more complicated than is immediately apparent.

LMiller7 said:

Brink is correct, but making the admin account owner of the system32 folder is nothing like he is talking about. The problem when you do this is that the owner has some implicit rights, rights it should not have. As owner, the admin account and any software it runs will have write permission to files in the system32 folder. That means application installers can freely replace critical system files with older or otherwise incompatible versions. That has caused a lot of problems in older operating systems and what Windows Resource Protection was designed to solve.

It is a compromise between convenience and security. Security always has it's price.

Edit: Permissions in Windows is a lot more complicated than is immediately apparent.

So IMPLICIT is the operative word? Despite what permissions say about my admin account I have more access to the system files than what appears in the dialog box?

What I am attempting to do is verify my VHD files created during imaging of my system with the actual source drive, but the UAC permissions are blocking may scanning utility. So to circumvent that I need to take ownership of those directories. At that point I was going to assign a temporary user access to the parent directory /WINDOWS so the utility could scan the files & delete the access once completed. However, if I had to restore the default owner to each & eveery file & subdirectory the process would be tedious.

I guess I could create a system restore point to reset the UAC ownership & priviledges back to default. However, I do not trust the WINDOWS restore point utility.

Any suggestion?

Disregard this entire thread. I keep forgetting you can circumvent UAC priviledges by running programs in WIN-PE mode. So I have navigated around my problem.