Is there any way to tell who is accessing the registry?

Page 4 of 6 FirstFirst ... 23456 LastLast

  1. Posts : 2,111
    Win7 Build 7600 x86
       #31

    ben07 said:
    Hi squonksc, I don't know how to tell which is Volume 7, I attached two pixs of my HDDs.

    The OS partition was fully formatted/wiped before installation (fresh installation) .

    During installation, I entered "C2Q" as name and computer name C2Q-01.

    Ops, don't tell me Windows 7 is so smart that it knows that partition "H" is an active partition which also has XP SP3.....but I don't do dual boot, if I want to use XP SP3 in H, I simply go into bios and change the HDD boot sequence!
    We are getting closer to the heart of the problem.

    I'm sure it has something to do with the user S-1-5-21-783115880-3742272611-1246857717-1000 that is probably from XP.

    Win7 see it in the NTFS table but doesn't recognize it since it's not a Win7 username.

    Give me a few minutes to do some research.

    I'll post back in 15 min.

    Greetz
      My Computer


  2. Posts : 2,111
    Win7 Build 7600 x86
       #32

    Don't delete the S-1-5-21-783115880-3742272611-1246857717-1000 user just yet.

    It might ruin your XP install.

    Still researching.

    I'll post back in 10min.

    Greetz
      My Computer


  3. Posts : 111
    Windows 7 Pro x64 RTM
    Thread Starter
       #33

    Take your time, squonksc.

      My Computer


  4. Posts : 2,111
    Win7 Build 7600 x86
       #34

    The S user in your screenshot is not the one we are looking for.
    Not the same number.

    But go look for the right number on all your partitions and post a screenshot, the same as the last one, but with the S user selected so I can see the given permissions.

    And one more thing.

    Post every new thing you want to add in a new post, so I won't have to go back all the time.

    Greetz
      My Computer


  5. Posts : 111
    Windows 7 Pro x64 RTM
    Thread Starter
       #35

    I'm lost, there isn't user S-1-5-21-783115880-3742272611-1246857717-1000 to be found under security on all partitions/folders, except in the Event Viewer yellow warning logs.

    Partition H (XP SP3), D, E and P all belongs to the same hard drive and they all have user S-1-5....ending with 500 under security, the rest of the partitions (C, U, T and W)DO NOT have this user.
    Attached Thumbnails Attached Thumbnails Is there any way to tell who is accessing the registry?-xp3.jpg  
      My Computer


  6. Posts : 2,111
    Win7 Build 7600 x86
       #36

    ben07 said:
    I'm lost, there isn't user S-1-5-21-783115880-3742272611-1246857717-1000 to be found under security on all partitions/folders, except in the Event Viewer yellow warning logs.

    Partition H (XP SP3), D, E and P all belongs to the same hard drive and they all have user S-1-5....ending with 500 under security, the rest of the partitions (C, U, T and W)DO NOT have this user.
    Well, that sounds right since I figure H: D: E: and P: originally belonged to XP?

    The S-1-5-21-783115880-3742272611-1246857717-1000 user must be a user that no longer exists, or links to it are lost.

    Can you tell me a bit more about your Win7 install?

    did you do a clean install?
    have you upgraded it at some point to a higher build?
    did you at any point do a repair of Win7?
    and maybe other details you haven't told me yet, related to Win7

    While you post the answers, I will make a few screenshots of where you will have to look to maybe find the mystery S user.

    Greetz
      My Computer


  7. Posts : 118
    windows 7
       #37

    Try a clean boot and post back the results :)

    How to troubleshoot a problem by performing a clean boot in Windows Vista

    This is same for vista and windows 7

    Keep us informed
      My Computer


  8. Posts : 2,111
    Win7 Build 7600 x86
       #38

    Delphin said:
    Try a clean boot and post back the results :)

    How to troubleshoot a problem by performing a clean boot in Windows Vista

    This is same for vista and windows 7

    Keep us informed
    Thanks for the suggestion, but it won't help since the problem is in windows itself, and a clean boot only excludes non OS services.

    I think in this case it's leftovers from a user account that used to exist but no longer does. hence the S-1-5-21-783115880-3742272611-1246857717-1000 user.

    Thanks
      My Computer


  9. Posts : 111
    Windows 7 Pro x64 RTM
    Thread Starter
       #39

    The current W7 installation was a clean install.

    1) I disconnected all hard drives, except C and U during the clean install (C and U belongs to the same drive).

    2) Once the installation was completed, I re-connect the other 3 drives (H,D,E,P) (U) and (T).

    3) Made a GHOST image of C (W7 OS partition)

    4) Enter W7's Key/serial, went online to activate

    5) Made GHOST image of C

    6) Installed 1st line softwares (Office, MS Security Essentials, WinRAR) , went online for WIndows/Office updates

    7) Made a GHOST image

    8) Installed 2nd line softwares (FireFox, Thunderbird, SpywareBlaster, Adobe Reader, FLash/Java, uT, eMule, AntiVir)

    9) Made a GHOST image

    10) Installed 3rd line softwares (VLC, MPC HC, SMPlayer, CCleaner)

    11) Made GHOST image ***


    *** this is the GHOST image I've been using for the past few days to test/sort things out, anytime anything goes wrongs, I just re-image this image to C drive.
      My Computer


  10. Posts : 2,111
    Win7 Build 7600 x86
       #40

    Ben,

    When did you first see the yellow exclamations?

    1. right after install, before other disks were put back.

    2. after putting back the disks.

    3. after 1st line software

    4. after 2nd line software

    5. after 3rd line software
      My Computer


 
Page 4 of 6 FirstFirst ... 23456 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 09:44.
Find Us