Access denied editing text files to root C drive

[morpheus305]

I thought i had all my permissions and sharing done correctly until i tried to edit a text file across my network on another windows 7 machine. When i go to save the file it ask me "save as" which it never did while trying to do the same thing on a windows xp machine. Well after the save as i try to save over the existing file and it as if i wanna replace the file then after hitting ok i get Access Denied message.

-I have sharing on the drive and the file set to Everyone with full access
-I have security tab setup so Everyone and Administrators have full access on both drive and file
-I tried changing ownership of the file several times and that has done nothing on both drive and file
-Also tried owership with inheritance turned off and on
-Even tried with firewalls/av software turned on and off
-The file is not blocked or anything like that
-UAC is turned off on both machines
-I can edit the file locally
-I have notepad set to "Run as Administrator" on both windows 7 machines
-I can write to the root C: such as copying over a .exe file or something like that. The issue is editing a text file only.

I can edit a text file on the root C drive on a windows xp machine but not any windows 7 machines across network. I am guessing i must of missed some windows 7 permissions policy some where to enable this. Now i can edit a file on windows 7 machines if it's not on the root of the drive say C:\testfolder\testfile.txt

 

[Layback Bear]

Just a thought; would that file be set read only on the Windows 7 computer?

 

[morpheus305]

How do i check that?

 

[Layback Bear]

Go to the program, file or folder and right click and choose properties. See if the Read Only is darkened.

 

[morpheus305]

Go to the program, file or folder and right click and choose properties. See if the Read Only is darkened.

No it's not.

 

[Layback Bear]

The only other thing I can think of is while in properties of that program on the problem computer is to tick Security and make sure every one you want to have permission has the control you desire.
Everyone isn't everyone. At least on my system.
Look in Group of user Names.

Notice that Everyone has all check marks but when JACK (BLACK/JACK) is selected their are no check marks. So ever Everyone does not mean Everyone.
I would have to select each individually and give the permission of my choice.





Looks like this this when I give JACK (BLACK/JACK) full permission.



I hope this helps.

This might also help.

http://www.sevenforums.com/tutorials/24232-sharing-permissions.html

 

[morpheus305]

The only other thing I can think of is while in properties of that program on the problem computer is to tick Security and make sure every one you want to have permission has the control you desire.
Everyone isn't everyone. At least on my system.
Look in Group of user Names.

Notice that Everyone has all check marks but when JACK (BLACK/JACK) is selected their are no check marks. So ever Everyone does not mean Everyone.
I would have to select each individually and give the permission of my choice.

View attachment 264921

View attachment 264922

Looks like this this when I give JACK (BLACK/JACK) full permission.

View attachment 264923

I hope this helps.

This might also help.

http://www.sevenforums.com/tutorials/24232-sharing-permissions.html

Went back and double checked all of that on both computers. Program, folder, and file. This has to be a windows 7 root drive only problem cause i can edit text file from all other places well except from places like c:\windows and such. Did they change some from xp to win 7 about writing or modifying files on the root of the system drive?

 

[Layback Bear]

I really don't know. I haven't used XP for a long time so my memory is falling short.
I will go back to the Ranch and see if I can find some help.
Should be some folks by when they get a chance.
Hang in there.

Did you look through the Tutorial I posted.

Sharing and Permissions

 

[morpheus305]

I really don't know. I haven't used XP for a long time so my memory is falling short.
I will go back to the Ranch and see if I can find some help.
Should be some folks by when they get a chance.
Hang in there.

Did you look through the Tutorial I posted.

Sharing and Permissions

Yes and everything is setup like that.

Here is a test for you or who ever. If you have to windows 7 machines in your home on the same workgroup(not homegroup) just try and open a text file on the root of of OS drive across the network and modify and try saving it to the same location. It should be a pretty simple test.

 

[NoelDP]

I find it easier to read ICACLS output for permissions.

ICACLS <pathname>\<filename>

(e.g. ICACLS C:\Windows\System32\slui.exe )

You can try running it locally by remote, and running it remotely, and see if there's a difference.

Post the results, and I'll try and interpret them

 

[morpheus305]

I find it easier to read ICACLS output for permissions.

ICACLS <pathname>\<filename>

(e.g. ICACLS C:\Windows\System32\slui.exe )

You can try running it locally by remote, and running it remotely, and see if there's a difference.

Post the results, and I'll try and interpret them

C:\Users\Me>ICACLS C:\links.txt
C:\links.txt Everyone: (F)
Andrew\Me: (F)
BUILTIN\Administrators: (F)
NT AUTHORITY\SYSTEM: (F)
BUILTIN\Users: (F)
Mandatory Label\High Mandatory Level: (I)(NW)

Successfully processed 1 files; Failed processing 0 files

 

[NoelDP]

There's one default permission entry missing there - which may be because it's missing from the parent folder...

Run the following command and let's see what we get...

ICACLS C:\

 

[morpheus305]

There's one default permission entry missing there - which may be because it's missing from the parent folder...

Run the following command and let's see what we get...

ICACLS C:\

C:\Users\Me>ICACLS C:\
C:\ Everyone: (OI)(CI)(F)
NT AUTHORITY\Authenticated Users: (OI)(CI)(F)
Andrew\Me: (OI)(CI)(F)
BUILTIN\Administrators: (OI)(CI)(F)
NT AUTHORITY\SYSTEM: (OI)(CI)(F)
BUILTIN\Users: (OI)(CI)(F)
Mandatory Label\High Mandatory Level: (OI)(NP)(IO)(NW)

Successfully processed 1 files; Failed processing 0 files

 

[NoelDP]

OK - maybe if we change that permission then, it'll correct things. (there's a minor inheritance error)

run the following commands from an Elevated Command prompt...

ICACLS C:\links.txt /remove "Mandatory Label\High Mandatory Level"
ICACLS C:\ /grant "NT AUTHORITY\Authenticated Users"IO)(OI)(CI)(F)
ICACLS C:\ /grant "NT AUTHORITY\Authenticated Users"AD)
ICACLS C:\ /grant "NT AUTHORITY\SYSTEM"F)

ICACLS C:\
ICACLS C:\links.txt

post the results, and test the open/amend/save routine again.

 

[Layback Bear]

Thank you Noel for coming to help.

 

[NoelDP]

Interesting problem

 

[morpheus305]

OK - maybe if we change that permission then, it'll correct things. (there's a minor inheritance error)

run the following commands from an Elevated Command prompt...

ICACLS C:\links.txt /remove "Mandatory Label\High Mandatory Level"
ICACLS C:\ /grant "NT AUTHORITY\Authenticated Users": (IO)(OI)(CI)(F)
ICACLS C:\ /grant "NT AUTHORITY\Authenticated Users": (AD)
ICACLS C:\ /grant "NT AUTHORITY\SYSTEM": (F)

ICACLS C:\
ICACLS C:\links.txt

post the results, and test the open/amend/save routine again.

Ok just did everything you asked. Everything responded with successful messages but afterwards I tested it and the problem is still there

C:\Users\Me>ICACLS C:\
C:\ NT AUTHORITY\SYSTEMF)
NT AUTHORITY\Authenticated UsersAD)
NT AUTHORITY\Authenticated UsersOI)(CI)(IO)(F)
EveryoneOI)(CI)(F)
NT AUTHORITY\Authenticated UsersOI)(CI)(F)
Andrew\MeOI)(CI)(F)
BUILTIN\AdministratorsOI)(CI)(F)
NT AUTHORITY\SYSTEMOI)(CI)(F)
BUILTIN\UsersOI)(CI)(F)
Mandatory Label\High Mandatory LevelOI)(NP)(IO)(NW)

Successfully processed 1 files; Failed processing 0 files

C:\Users\Me>ICACLS C:\links.txt
C:\links.txt EveryoneF)
Andrew\MeF)
BUILTIN\AdministratorsF)
NT AUTHORITY\SYSTEMF)
BUILTIN\UsersF)
Mandatory Label\High Mandatory LevelI)(NW)

Successfully processed 1 files; Failed processing 0 files

 

[NoelDP]

If you open Notepad as Administrator, does this give you sufficient rights?
Who is the Owner of the file?

By default, Standard users don't have access to the root folder - I think this is caused by the "Mandatory Label\High Mandatory Level" permission setting, which is inherited - and I can't find an easy way to switch it off....

This is actually a 'good thing' under most circumstances, as it prevents a lot of potential malware threats.

You can change this default using the procedures here...

http://en.wikipedia.org/wiki/Administrative_share

 

[morpheus305]

Well I said this in my OP "-I have notepad set to "Run as Administrator" on both windows 7 machines" maybe I don't understand exactly what you want me to do. I have switched ownership of the file multiple times testing it out to see if it would fix the problem. I have tried Everyone, Me (Andrew\Me), Administrators(Andrew\Administrators), Authenticated Users, Users(Andrew\Users), SYSTEM. Right now it's set to Me (Andrew\Me).

How to enable in Windows Vista, Windows 7, and Windows 8

By default, Windows Vista and newer versions of Windows prevent local accounts from accessing administrative shares through the network.
To enable administrative shares you have to make a registry change. Click on Start Menu and in the search box type ‘regedit’ and press ENTER. Add this registry item:
Hive: HKEY_LOCAL_MACHINE
Key: Software\Microsoft\Windows\CurrentVersion\Policies\System
Name: LocalAccountTokenFilterPolicy
Data Type: REG_DWORD
Value: 1
After rebooting, the hidden share is accessible from other computers. Note that this change removes Windows' restrictions on remote User Account Control.
You may be able to use 'net stop server' and then 'net start server' from an administrative command prompt instead of rebooting.


When I was researching on how to fix this problem i saw a post with someone saying to do that. Problem is, I don't have LocalAccountTokenFilterPolicy in that folder. Not sure why or what I should do.

 

[morpheus305]

NoelDP you still around? You were responding back pretty fast. Just wondering if you stopped posting cause you were stumped or something else? I thought we might of been close to figuring this out.