Access denied editing text files to root C drive

[NoelDP]

Sorry - real life got in the way!

Add the Value and data in yourself
in Regedit, navigate to
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
and right-click on the System entry - select New> DWORD Value
entry the Name, then double-click on the name to open it up and change the data point to 1

 

[logicearth]

Are you falling into the trap of not watching "Applies to" in the permissions? See below for the default permissions placed on the system drive.

 

[morpheus305]

Sorry - real life got in the way!

Add the Value and data in yourself
in Regedit, navigate to
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
and right-click on the System entry - select New> DWORD Value
entry the Name, then double-click on the name to open it up and change the data point to 1

Made the registry entry and tried it out, did not work Even restarted the pc and tried it out again still didnt work.

 

[morpheus305]

Are you falling into the trap of not watching "Applies to" in the permissions? See below for the default permissions placed on the system drive.

Here is what I got set.

 

[NoelDP]

Please run the following command, and post the results...

REG QUERY HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System

 

[morpheus305]

C:\Windows\system32>REG QUERY HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr
entVersion\Policies\System

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
ConsentPromptBehaviorAdmin REG_DWORD 0x0
ConsentPromptBehaviorUser REG_DWORD 0x3
EnableInstallerDetection REG_DWORD 0x1
EnableLUA REG_DWORD 0x0
EnableSecureUIAPaths REG_DWORD 0x1
EnableUIADesktopToggle REG_DWORD 0x0
EnableVirtualization REG_DWORD 0x1
PromptOnSecureDesktop REG_DWORD 0x0
ValidateAdminCodeSignatures REG_DWORD 0x0
dontdisplaylastusername REG_DWORD 0x0
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
scforceoption REG_DWORD 0x0
shutdownwithoutlogon REG_DWORD 0x1
undockwithoutlogon REG_DWORD 0x1
FilterAdministratorToken REG_DWORD 0x0
LocalAccountTokenFilterPolicy REG_DWORD 0x1

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\UIP
I

 

[NoelDP]

Please re-enable User Account Control (LUA) and retest - disabling it does change the effects of some policies.

 

[morpheus305]

I moved the UAC slider bar all the way up and restarted my pc. This is the new results.

C:\Users\Me>REG QUERY HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersi
on\Policies\System

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
ConsentPromptBehaviorAdmin REG_DWORD 0x2
ConsentPromptBehaviorUser REG_DWORD 0x3
EnableInstallerDetection REG_DWORD 0x1
EnableLUA REG_DWORD 0x1
EnableSecureUIAPaths REG_DWORD 0x1
EnableUIADesktopToggle REG_DWORD 0x0
EnableVirtualization REG_DWORD 0x1
PromptOnSecureDesktop REG_DWORD 0x1
ValidateAdminCodeSignatures REG_DWORD 0x0
dontdisplaylastusername REG_DWORD 0x0
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
scforceoption REG_DWORD 0x0
shutdownwithoutlogon REG_DWORD 0x1
undockwithoutlogon REG_DWORD 0x1
FilterAdministratorToken REG_DWORD 0x0
LocalAccountTokenFilterPolicy REG_DWORD 0x1

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\UIP
I

 

[NoelDP]

It only needs to be at the default position - one down from the top.

What happens with file changes after that?
(I'm off to bed now, so no hurry )

 

[morpheus305]

Ok, just tested it with UAC turned to second from the top. Unfortunately i still have the problem Should I switch it back to off again?

 

[NoelDP]

Best left to default - that way everything should be where it normally is expected to be - unless you have an actual need for it to be switched off?

 

[morpheus305]

Best left to default - that way everything should be where it normally is expected to be - unless you have an actual need for it to be switched off?

Right now w/e gets this working but i don't see why i would need this on to do something as simple as this. Right now it's set to default position. What else should I do?

 

[NoelDP]

Lets have a look at the permissions again

ICACLS C:
ICACLS C:\
ICACLS C:\links.txt

(of course - there's always the option of not working in the root folder?? )

 

[morpheus305]

(of course - there's always the option of not working in the root folder?? )

Surrender? Never!!

C:\Users\Me>ICACLS C:
C: NT AUTHORITY\SYSTEMOI)(CI)(F)
BUILTIN\AdministratorsOI)(CI)(F)
Andrew\MeOI)(CI)(F)
Andrew\HomeUsersRX)
Andrew\MeRX)

Successfully processed 1 files; Failed processing 0 files

C:\Users\Me>ICACLS C:\
C:\ NT AUTHORITY\SYSTEMF)
NT AUTHORITY\Authenticated UsersAD)
NT AUTHORITY\Authenticated UsersOI)(CI)(IO)(F)
EveryoneOI)(CI)(F)
NT AUTHORITY\Authenticated UsersOI)(CI)(F)
Andrew\MeOI)(CI)(F)
BUILTIN\AdministratorsOI)(CI)(F)
NT AUTHORITY\SYSTEMOI)(CI)(F)
BUILTIN\UsersOI)(CI)(F)
Mandatory Label\High Mandatory LevelOI)(NP)(IO)(NW)

Successfully processed 1 files; Failed processing 0 files

C:\Users\Me>ICACLS C:\links.txt
C:\links.txt EveryoneF)
Andrew\MeF)
BUILTIN\AdministratorsF)
NT AUTHORITY\SYSTEMF)
BUILTIN\UsersF)
Mandatory Label\High Mandatory LevelI)(NW)

Successfully processed 1 files; Failed processing 0 files

 

[NoelDP]

Ah - a man (?) after my own heart

Too many beers tonight - if you haven't heard in 24 hrs, SHOUT!

 

[NoelDP]

I need to test something...
please create a file on your desktop and then Move it to the root (do NOT copy it!)

then run ICACLS on it, and post the results.
now create a new file directly in the root folder and run ICACLS on that.

Try modifying both files - what happens?

 

[morpheus305]

I need to test something...
please create a file on your desktop and then Move it to the root (do NOT copy it!)

then run ICACLS on it, and post the results.
now create a new file directly in the root folder and run ICACLS on that.

Try modifying both files - what happens?

Ok i was able to make a text file and move it over to the C: drive. I was able to modify across network.

C:\Users\Me>ICACLS C:\test2.txt
C:\test2.txt NT AUTHORITY\Authenticated UsersI)(F)
EveryoneI)(F)
Andrew\MeI)(F)
BUILTIN\AdministratorsI)(F)
NT AUTHORITY\SYSTEMI)(F)
BUILTIN\UsersI)(F)

Successfully processed 1 files; Failed processing 0 files


When i tried to make a text file on the C: it gave me this error message.

 

[Kaktussoft]

Are you logged on on winxp and trying to access win7's C:\ drive (root folder)?

 

[NoelDP]

The results you got are pretty much what I expected.

The problem is that the C:\ folder has that odd permission "Mandatory Label\High Mandatory LevelOI)(NP)(IO)(NW)"
This means that you require local Admin permissions to create a new file there.
the NP means that the permissions are inherited by objects created in the C:\root - but the permissions don't propagate further down the hierarchy.

Moving a file into the folder, it brings its own set of permissions with it, and doesn't inherit the root permissions in the same way, so modification is allowed.
So the solution would appear to be to ensure that whatever file you need to use is created elsewhere, and then moved into the folder, at which point you should be able to modify it at will
(If not - move it out of root, modify it, then move it back!)



I've been unable to remove or modify that permission in my VM

 

[morpheus305]

Hmmm that sucks. I thought we were getting close to solving this.