Security Warning on files that I create on the desktop

[jbweb]

Over the weekend at work, my Windows 7 Enterprise machine mysteriously came down with an odd issue. I first noticed it when I went to routinely open my MMC session I saved on my desktop. When I went to open it, it gave me a security warning dialog. Huh, that's odd. I saved a new session file onto my desktop and trying to open that one gives me the same error. I googled around for a bit, found a way to manually enter MSC files into an inclusion list in my local policy, and that was working so I just shrugged and went about my business.

However, this is also happening with batch (.bat) files and PowerShell scripts (.ps1) and presumably any other type of file that might be seen risky. With PowerShell, it's way more annoying because I can save a script that I just wrote onto my desktop and not be able to run it. I have my execution policy set to RemoteSigned and yet the OS thinks the file that I just created isn't local for some reason... yet it also doesn't think it's from the Internet. There's no "Unblock" button on any of the files when I go into their file properties. Nor is there a checkbox on the security warning that lets me to not pester me each time for this particular file.

Even when I change the execution policy to Unrestricted, I still have to manually confirm I want to run a script within PowerShell by hitting the Y key and all that. It's really annoying.

Now I've had limited time to troubleshoot this, but one thing I have found out is that it only does this for files on my profile's desktop. If I save a script to the C drive root: no issue. If I save it to my root user profile folder: no issue. If I save it to my network mapped Z drive: no issue. But heaven forbid I save it to my desktop!

I'm guessing that's enough for one of you gurus to know what happened here. I compared the security and ownership settings on my desktop folder and one of my colleagues and couldn't find anything different. I'm just not sure where to go to get at the security settings for this.

Please note that I don't want to just include all the file types that I work with. Allowing all scripts to run without warning just seems folly to me. I also don't want to blanket disable the security warning across my entire computer--I don't mind the security warning per se, I just don't want my desktop to be lumped into whatever draconian filter it's currently in! Also note that my desktop is not being redirected.

Any ideas? I'd rather do this smartly, but if all else fails I may end up deleting my profile altogether and rebuild it.

By the way, I'm actually off work today, so I probably won't be able to test any suggestions until tomorrow. I just wanted to go in with some ideas and hopefully not lose any more time to this issue than I have already.

Thanks!

 

[Layback Bear]

I'm no expert but I do have two Ideas.
1. Have you contacted your IT department for help?
2. Create a New Folder on the Desktop and use it instead of Desktop.

 

[jbweb]

1. Have you contacted your IT department for help?
2. Create a New Folder on the Desktop and use it instead of Desktop.

1. I am part of the IT department. I've asked the others for help and they weren't sure either.
2. New folders on the desktop inherit the same issue. It's only folders outside my desktop folder that work right. I could use a shortcut to get there, but as I said, that's a workaround and not a fix and I'm not interested in that.

Another new clue to the puzzle: I searched for all the files with alternate data streams on my desktop thinking somehow they were all getting tagged on creation but none of them have any.

 

[Layback Bear]

Let me see if I can find someone that can help you.
I put in a request so just hang in there/their.

 

[A Guy]

Welcome to Seven Forums jbweb. It would also be helpful if you can post a screen shot of the security warning.

http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

A Guy

 

[Layback Bear]

Thank you Guy for being so prompt. I will just watch.

 

[CB]

Just little thought. Is there any security update that chronologically applied prior to the issue?

Kevin

 

[jbweb]

Just little thought. Is there any security update that chronologically applied prior to the issue

I remember cross-checking the list of newest hotfixes on my machine with one of my coworker's and seeing a couple that had only been installed on my machine and I think around or just prior to that weekend. I looked them up where I could and tried to add the KB# to my google search to see if I could find any other people who came down with the same issue lately, but I got no hits [then]. My hotfix printout isn't in my dropbox for some reason though so I'll have to get back to you on the specific, most-recent hotfixes.

I did take a screenshot earlier today so that I could also get the exact message for any home research. Sorry I had to be a bit vague earlier since I didn't have one to go on previously. I'll attach it.

Here are a few other notes (sorry if I already stated these):

• I checked the permissions and can't see anything different with, say, another subfolder in my profile.
• I checked to see if any scripts I create on my desktop get automatically tagged with alternate data streams, but they don't.
• Anyone else who logs into my computer under their profile (domain) doesn't have this issue.
• My desktop is not redirected.
• Still gives a warning in Safe Mode.
• Other computers that I log onto don't exhibit this behavior--it's only my machine, and specifically only on my desktop.
• I've already ran a chkdsk /f.
• Subfolders on my desktop inherit this issue.
• I think that when I make a new batch file on my desktop and MOVE it to another non-desktop place, the warning stays with the file. If I COPY that batch file to the new location, the warning does not follow.
• I've also tried using other editors (than notepad2) to make scripts. For instance, using a command prompt and just typing something like echo echo. > test.bat still results in the warning.

 

[sammy3417]

Crazy to ask you this!! are you the Administrator on this system? If not has someone changed your permissions?

Have you tried a system restore? What AV are you running?

I found this on a different site....

But I tried this, and it worked. It was really easy but it just looks long so print this out and follow along.
Start-->Computer-->Local Disk (C-->Users-->The Administrator Folder(My main account)-->Right Click Desktop-->Click Properties-->Click the Security tab-->Click the Advanced Button-->Now Click the Owner tab-->Now Click the Edit button-->the User Account pop-up comes up, so select yes, and if you have to enter a password do so now-->Here (at the Advanced Security for Desktop) I selected the "Other users or groups" button-->Now I typed "Administrator" in the text box and hit the "check names" button-->My admin account name showed up so I highlighted it and hit the OK button-->that automatically put my main (Administrator) account it into the box in the preceding box(the Advanced Security for Desktop)-->Finally I selected the OK button and I'm done. Yep DONE. I can now add, delete, or change any file on my desktop.
Hope this helps!

 

[A Guy]

I believe most "solutions" I find involve changing security to allow, or adding files to allowed list. Not a great option. For you the question is what changed? And why only the desktop? The simplest thing I find does not address the whys. But may be a workaround that does not just universally lower all security. This site is an example.

I also see

The way we have overcome the problem is in IE 7 or 8 go to Tools, Internet Options, Security, Intranet, Sites, then remove the tick for "Automatically detect intranet network". We leave the other 3 ticks ON. You can then add server names in the advanced button, but we havent found this necessary.

Source

I'm sure others will be along with better ideas. Brink has several tutorials dealing with the general problem.

http://www.sevenforums.com/tutorials/182353-open-file-security-warning-enable-disable.html

http://www.sevenforums.com/tutorial...urity-warning-allow-prevent-unblock-file.html

http://www.sevenforums.com/tutorials/124367-open-file-security-warning-unblock-file.html

A Guy

 

[jbweb]

Crazy to ask you this!! are you the Administrator on this system? If not has someone changed your permissions?

I am an administrator and domain administrator. I don't think anyone was monkeying with my permissions; they looked right and I can't imagine why anyone would want to mess around with it.

We use the enterprise version of Sophos Anti-Virus at work. I've also tried disabling it and then making a new script but the warning persists.

For you the question is what changed? And why only the desktop?

No idea. I used PoSH to list all files that were modified over the weekend to see if someone else did something, but I couldn't find anything that seemed particularly relevant. Sophos did some updates to itself but, yeah, it does that and it also does that to hundreds of other computers on site without apparent issue.

I use Firefox primarily at work and home, so I haven't been fussing about in IE9 much to change any settings. I was looking around in them afterward, of course, and I admit I don't understand full the extent of how IE9 is integrated in Windows Explorer and whatnot. I'll take another look around and try twisting some knobs to see if anything happens.

Thanks for the suggestions and links. Those showed up in my web searches and actually led me to this forum, but the heavy-handedness of their usage turned me off using them as a solution. I was looking for more of a scalpel than a chainsaw, and any further understanding of some under-the-hood mechanisms of Windows 7 would be a bonus.

 

[sammy3417]

Sorry that you haven't had the response that you require...This is a very interesting thread. Do you use app locker? Sorry just trying everything that pops into my head!

System restore ?

 

[A Guy]

System Restore occurred to me, but I assume in the environment the PC is in, this isn't an option? A Guy

 

[jbweb]

Yeah, no can do on the system restore unfortunately.

So there are two Windows updates that were installed over the weekend that this happened: KB2744842 and KB2732059. Maybe I'll try uninstalling those to see if anything changes.

Other than those updates, the only other files that look to have been modified over the weekend are related to Sophos and Chrome updating themselves. I could try uninstalling those as well. Sophos in particular logged a ton of errors in the System event log over that weekend--looked like one of its services got caught in a perpetual loop of trying to restart itself and failing.

Another curiosity: I can make a .bat on my desktop, and it will give the warning. I can copy that elsewhere and the copy doesn't exhibit the warning. If I then move that copy to the desktop, it still doesn't give a warning. The file hashes of the original and copy are exactly the same, however, so I don't know what's happening here other than some metadata thing or external program/service keeping tabs on every file...? I'll see if I can do a ProcMon capture and see if there are any clues there.

It's pretty tenuous, but at least it's a few more things to try before throwing in the towel.

 

[sammy3417]

sfc /scannow ?

 

[jbweb]

SFC gives me:

2012-10-18 15:48:31, Info                  CSI    0000028f [SR] Repairing corrupted file [ml:520{260},l:56{28}]"\??\C:\Windows\Help\mui\0409"\[l:22{11}]"diskmgt.CHM" from store
2012-10-18 15:48:31, Info                  CSI    00000292 [SR] Repairing corrupted file [ml:520{260},l:56{28}]"\??\C:\Windows\Help\mui\0409"\[l:22{11}]"diskmgt.CHM" from store

Which I'm ignoring because it reported the same thing long before this issue. Why SFC has such a fit over diskmgt.CHM would be worthy of its own meticulous investigation--if I actually cared about the diskmgt.CHM file. For anyone curious:

• I can open the diskmgt.chm file just fine, no issues.
• SFC /SCANNOW always complains about the diskmgt.chm file being corrupt, yet it has the same hashes as my coworkers' diskmgt.chm files and yet their SFC runs without any such errors.
• SFC always says it's repairing the diskmgt.chm file, yet it never fails to still show up on subsequent SFC /SCANNOW attempts.
• Despite this, pointing SFC directly to the file with SFC /SCANFILE=C:\Windows\Help\Mui\0409\diskmgt.chm reports the file is perfectly fine. Argh!

Anyway, back to the topic.


Didn't have much spare time today, but I did manage to uninstall both of the aforementioned hotfixes, Chrome, and Sophos. Still get the security warning.



On the plus side, systematically uninstalling Sophos and killing every chunk of it I could find in the registry and hard drive fixed some oddities I was having with it deploying correctly on my machine via policy. I consider that a small win, anyway.

 

[jbweb]

Another update. Sorry it's been a while, but apparently I have to do real work at my job from time to time. :huh:

I tried looking over policies applied to my system/user and comparing them with another. I also even compared my registry hive against another user's to see if anything stood out. A few curiosities but nothing I looked into from there panned out. I even tried resetting all my caspol configurations to no effect (a shot in the dark).

I ended up moving the location of my desktop (right-click on your desktop folder in your profile and go to the Location tab) to a Desktop2 folder in my profile. Success! I then renamed my old, broken desktop folder and moved my desktop back from Desktop2 to the new Desktop and it still works. Yay.

Sorry to report that I still have no idea what the issue was but, hey, at least it was easily remedied. I did notice one new thing when I compared my new desktop folder's SDDL string against the old one when I included audit information (e.g. get-acl -audit). The old one has a blank SACL (apparently) hanging off at the end of the SDDL (it just stops at S:). That seems kinda odd, but I'm hardly an expert. Either way, next time I'm in office, I'll try and wipe the SACL on that folder to see if it clears up the issue (which is still very much intact with items placed in that folder) and/or clone the permissions from my new desktop to that one.

Anyway, if that fixes it then I'll post back here. If not, I suppose it will remain a mystery.

 

[A Guy]

Fingers crossed you found the fix. It's not unusual for us to see corrupted user profiles here on the forum. Hard to say what corrupted them, but creating a new one often proves the corruption. You just his upon what directory was corrupted. A Guy

 

[jbweb]

Today I tried messing with the ACLs on the folder. I tried adding an audit entry to it and then removed it. Re-checked the SDDL on the folder to see that the S: at the end was now S:AI. AI seems to be a propagation flag to child-objects. Problem with that folder persists. Hmm.

I then use PowerShell to copy the ACLs from my new desktop folder (that's working) onto the OldDesktop folder. It does that, but the folder retains the mysterious S:AI.

I try using ICACLS to reset the ACLs on the folder, but that doesn't get rid of it. I take ownership of the folder and wipe all the DACLs/SACLs off the damn thing. I make a DACL for me so I can view the lists and damn if that stupid S:AI is still there.

I downloaded SetACL (command-line) and messed with all the obvious parameters I could find for it. Can't seem to get rid of that pesky thing. Pretty sure I even protected it from inheritance and it still remains there.

So I have no idea what's going on that and even less of an idea of what caused the issue in the first place. I can't be sure if it's the cause since I haven't figured out how to remove it. If you guys have any ideas, I'll take another crack at it. In the meantime, the new desktop folder is working just fine. So that's nice. Maybe I'll add a SACL on it to log when the permissions get changed just in case this happens again.