Changing owner back to TrustedInstaller

I recently took ownership of the explorer.exe file so that I could modify my Windows 7 start orb. Everything went well and my new orb looks great. I am now trying to give ownership back to TrustedInstaller using NT SERVICE\TrustedInstaller. It appears that ownership does in fact change to TrustedInstaller, however, I'm still able to change and modify the explorer.exe file, even though I'm not the owner anymore. I've gone into permissions but I can't "allow" any control on the administrator account. (it's all grayed out) I can only "deny" control. I remember seeing a warning about inherited permissions on that file but when I unchecked it, the only account remaining in the accounts list was TrustedInstaller.
All I really want to do is put the owner back to TrustedInstaller and set the permissions on the administrator account the way they were before I changed them.
Any ideas?

mborner said:

I recently took ownership of the explorer.exe file so that I could modify my Windows 7 start orb. Everything went well and my new orb looks great. I am now trying to give ownership back to TrustedInstaller using NT SERVICE\TrustedInstaller. It appears that ownership does in fact change to TrustedInstaller, however, I'm still able to change and modify the explorer.exe file, even though I'm not the owner anymore. I've gone into permissions but I can't "allow" any control on the administrator account. (it's all grayed out) I can only "deny" control. I remember seeing a warning about inherited permissions on that file but when I unchecked it, the only account remaining in the accounts list was TrustedInstaller.
All I really want to do is put the owner back to TrustedInstaller and set the permissions on the administrator account the way they were before I changed them.
Any ideas?

If it truly is a permissions issue and you have a restore point why not restore it to a point before the problem existed?


Ken

zigzag3143 said:

If it truly is a permissions issue and you have a restore point why not restore it to a point before the problem existed?
Ken

System restore will revert my new custom orb back to the original one.

Thanks, Shawn, I'll give it a try.

Brink said:

Hello Mborner,

You will need to take ownership of the explorer.exe file again with your account, uncheck all of the "Allow" options except the default "Read" and "Read & Execute" for your account, then change the owner back to "NT SERVICE\TrustedInstaller".

Hope this helps,
Shawn

Well, I took ownership of the explorer.exe file again but I somehow denied myself permission for it to even load and run. Fatal error. Windows will boot to the log in screen but after logging on the screen goes black. Tried it on both accounts, same thing. I ran a system image restore but unfortunately, the latest image backup was just done only hours before so it did nothing. I tried safe mode, nothing. System restore from the boot disc, nothing. Repair computer from F8 boot, nothing. I'm going to have to: a) do a clean install, which I know will work, or: b)do an upgrade install which could go either way. I don't know, maybe I'll boot to a command prompt and try running SFC, although, I don't know how that will fix the now corrupted permissions in the explorer.exe file.

mborner said:

I recently took ownership of the explorer.exe file so that I could modify my Windows 7 start orb. Everything went well and my new orb looks great. I am now trying to give ownership back to TrustedInstaller using NT SERVICE\TrustedInstaller. It appears that ownership does in fact change to TrustedInstaller, however, I'm still able to change and modify the explorer.exe file, even though I'm not the owner anymore. I've gone into permissions but I can't "allow" any control on the administrator account. (it's all grayed out) I can only "deny" control. I remember seeing a warning about inherited permissions on that file but when I unchecked it, the only account remaining in the accounts list was TrustedInstaller.
All I really want to do is put the owner back to TrustedInstaller and set the permissions on the administrator account the way they were before I changed them.
Any ideas?

Go back into Explorer properties and under security set TrustedInstaller to 'Allow' Full Control, Modify, Read & execute, Read and Write but not Special permissions.

Set your Administrators to 'Allow' Read & execute and Read and leave all others blank.

Set Your Users to 'Allow' Read & execute and Read and leave all others blank, which is the same as your Administrators account. Nothing else should have the same permissions as TrustedInstaller.

Basically you'll need to remove your account as able to write or control and thats it..