System user no longer has permissions to access C:\Windows

My PC (Asus P8Z77-M PRO with Intel i-7 3770, 32GB RAM, 2TB system drive with 3 x 3TB hard drives) started up this morning and was working fine. I left it unattended for a few minutes but when I returned to it, it was very "slow" - basically would not load programs, etc, but the cursor moved and I could switch windows, but little else.

I had to use the power button to reboot into safe mode (with networking) and the system logs showed absolutely nothing abnormal until booting into safe mode where it stated that many services failed because there was no access. However, the PC appeared to work normally in safe mode.

So I checked the system properties for C:\Windows and found that Administrators and Users (just myself) had the normal basic rights, but SYSTEM had none at all, nor did CREATOR OWNER, while Trusted Installer just had special rights (but that seems to be the same as my other PC).

If I tried to edit the System rights, everything was greyed out and all boxes empty, with the "add" and "remove" boxes not available. When I went into "advanced", instead of one SYSTEM being listed with "Full control" (as per the other PC), there were 2, each with permissions summarised as "special", one for this folder only and the second for subfolders as well. When I tried to change permissions, the first (for Windows only) had all boxes were greyed out and all ticked EXCEPT for "full control" and "delete subfolders" but also "Permissions" and "Take ownership". However the second (with subfolders) had all boxes ticked including "full control" - but greyed out.

I have no idea how this happened, and is unlikely to be a virus or malware as I run Comodo Premium with Firewall, and I do not allow that PC internet access except to the Comodo site for updates. I manually enable internet access if I need it, but I do all my internet stuff on my other PC (that I am using now).

I realise I am on the very edge of losing the PC (in terms of having to reload everything from scratch). Everything is backed up, so there are no issues there - just the massive hassle of reloading software and getting al the settings back to where they should be - and since it is nearly 5 years since I built the PC, it is well fine-tuned but I don't have a clue what all the optimised settings are any more.

Can anyone advise me on the way forward - preferably someone who has experienced this exact problem before and knows what will happen, However, anyone with a suggestion is welcome to reply.

I think I have 2 options:
(1) I could try to delete the first "SYSTEM" in C:/Windows Properties - but I don't see how I can because I don't have the required permissions
(2) I could try to do a system restore under safe mode, but without permissions, I cannot see it working either.

Over to you ....

Hi amethystina,

After you have followed ICIT2LOL instrutions, please do the following


1. Download Windows Repair (All-in-One) Portable to your desktop.
http://www.tweaking.com/files/setups...repair_aio.zip


2. Once the file is downloaded, right-click on the file on your desktop and choose Extract All...
3. Keep the defaults and click the Extract button.
4. A folder named tweaking.com_windows_repair_aio will be extracted to the desktop. Once the extraction is complete the folder will open.
5. Inside this folder, there is a folder named Tweaking.com - Windows Repair. Open this folder as well.
6. Double-click on Repair_Windows.exe to open. Note: Please make sure all of your programs are closed and anything you were working on is saved as we will be rebooting.
7. When the program opens, click the Reboot to Safe Mode button at the bottom of the screen. Answer Yes to allow.

8. Once rebooted into Safe Mode, open the program again. When the program opens, click the Repairs tab and click the Open Repairs button.

9. A backup of your registry will be made. After a few moments you will have many options from which you can choose.
10. Please click the Unselect All button and then click to enable only the following ones:

01 - Reset Registry Permissions
02 - Reset File Permissions
03 - Reset Service Permissions
04 - Register System Files
10 - Remove Policies Set By Infection
14 - Remove Temp Files


It is rather unusual to lose system permissions, unless its via malware.
Could you try something before you perform the above
UNplug your external drives then boot up does it work correctly if so then 1 of your externals could be the cause, add them in 1 at a time see if the problem resurfaces

Roy

torchwood said:

Hi amethystina,

After you have followed ICIT2LOL instrutions, please do the following

.......

It is rather unusual to lose system permissions, unless its via malware.
Could you try something before you perform the above
UNplug your external drives then boot up does it work correctly if so then 1 of your externals could be the cause, add them in 1 at a time see if the problem resurfaces

Roy

ICIT2LOL and torchwood

My apologies for a delayed response, I lost internet connectivity for a while - I live in rural South Africa, so my wireless connections are not the best in the world ....

I also apologize for not bothering to try out your suggestions, though I have noted them and added them to my collection of potential fixes for future use. Before I was able to reconnect, I tried my own ideas which, as expected, failed. I then replaced the system disk (including the C: drive) with a 6 month old clone and rebooted. As usual, it came up fine. I then added the old drive through an external USB connection and tried to modify the disk permissions on the "failed" drive, but I still could not alter the permissions, even though I was logged in as an administrator with, theoretically, identical permissions.

So I then resorted to brute force and copied the limited new data (I reassign "My documents" to a different logical drive on the same disk, as well as email, etc, so it was only a few items that insist on writing to the User folder that needed copying), and then used Macrium to clone the current C: drive onto the old C: partition (leaving the other disk partitions untouched), and then swapped the disks over again.

So I haven't (in theory) lost anything and am back working. Just slightly annoyed I wasn't able to track down the cause.

But thanks for your advice, and I am in the process of downloading the Windows Repair program - which looks excellent. If you don't use Macrium I can strongly recommend it (I have no stake in it) as it is free, and so long as you have a spare disk of the same size as your operating system disk, it takes all the worries out of many problems. After swapping disks to the clone, unless you have radically changed your hardware setup since performing the clone, you do not need to re-activate Windows or Office (or any other software) - the PC works exactly as it did when cloned (changing hard drives or simple CPU over-clocking ratios are OK, but adding or removing memory or bigger changes to overclocking setup may require a reactivation). And, as I mentioned, if you separate your work from the pure OS and programs folders, you only need to clone the system drive, leaving any others untouched, reducing the need to copy data to a minimum. Obviously you still need to do backups, as the cloning process takes about an hour per TB, so is not an efficient backup tool for normal daily backups.

Amethystina