Solved Fixing a computer with hosed permissions & activation problems?

You obviously haven't seen some of my snottier posts, then!
emotion-14.gif


I have and enjoyed every one of them.
 

My Computer My Computer

At a glance

Windows 10 Pro. 64/ version 1709 Windows 7 Pr...Intel i7-6800K @ 4.3Corsair Platinum 16 gig @2400EVGA GTX 1070 OC
Computer type
PC/Desktop
Computer Manufacturer/Model Number
Home made Desktop
OS
Windows 10 Pro. 64/ version 1709 Windows 7 Pro/64
CPU
Intel i7-6800K @ 4.3
Motherboard
ASUS X-99 Deluxe II
Memory
Corsair Platinum 16 gig @2400
Graphics Card(s)
EVGA GTX 1070 OC
Monitor(s) Displays
Asus 27" LED LCD/VE278Q
Screen Resolution
1920-1080 or 1280-720 HDMI
Hard Drives
INTEL SSD 730-240 Gb Sata 3.0/
PSU
EVGA Platium 1200W
Case
Phanteks Luxe Tempered Glass 8 fans/ one radiator
Cooling
XSPC/ Water Cooled CPU
Keyboard
Das 4 Professional
Mouse
Logitech M705/MX Anywhere 2-S
Internet Speed
100 mbits
Antivirus
Microsoft Security Essentials/ Malwarebytes Premium 3.0/ SAS
Browser
I.E. 11 default/Firefox/ ISP Time Warner Cable/Spectrum
Other Info
LG BluRay Burner/
Sound system-KLipsch-THX/
Icy Dock ssd Hot Swap bays.
Edit: It's complaining Windows isn't genuine again. Maybe I should try to re-enter the COA key?

Here are the results:

Code: 
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>SC QC EVENTLOG
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: EVENTLOG
        TYPE               : 20  WIN32_SHARE_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
        LOAD_ORDER_GROUP   : Event Log
        TAG                : 0
        DISPLAY_NAME       : Windows Event Log
        DEPENDENCIES       :
        SERVICE_START_NAME : NT AUTHORITY\LocalService

C:\Windows\system32>SC QUERYEX EVENTLOG

SERVICE_NAME: EVENTLOG
        TYPE               : 20  WIN32_SHARE_PROCESS
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 5  (0x5)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
        PID                : 0
        FLAGS              :

C:\Windows\system32>ICACLS C:\Windows\System32\Logfiles\WMI
C:\Windows\System32\Logfiles\WMI NT AUTHORITY\SYSTEM:(F)
                                 BUILTIN\Administrators:(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\System32\Logfiles\WMI\RtBackup
C:\Windows\System32\Logfiles\WMI\RtBackup NT AUTHORITY\SYSTEM:(F)
                                          BUILTIN\Administrators:(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>
 
Last edited:

My Computer My Computer

At a glance

Windows 7 Professional 32-bit
OS
Windows 7 Professional 32-bit
We need to change the permissions there first - it may well be what's causing the problems.
Open an Elevated Command Prompt windows, and run the following commands..

ICACLS C:\Windows\System32\Logfiles\WMI /grant SYSTEM:(OI)(CI)(F)
ICACLS C:\Windows\System32\Logfiles\WMI /grant "LOCAL SERVICE":(OI)(CI)(F)
ICACLS C:\Windows\System32\Logfiles\WMI /grant "NETWORK SERVICE":(OI)(CI)(F)
ICACLS C:\Windows\System32\Logfiles\WMI /grant Administrators:(OI)(CI)(F)
ICACLS C:\Windows\System32\Logfiles\WMI /grant "Performance Log Users":(OI)(CI)(F)
ICACLS C:\Windows\System32\Logfiles\WMI\RtBackup /grant SYSTEM:(OI)(CI)(F)

The reboot and run the following commands....

NET START EVENTLOG
SC QUERYEX EVENTLOG
NET START SPPSVC

post the results of those, and a new MGADiag report - I'll get on the file mismatches soon.
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
After running the icacls commands:

Code: 
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>ICACLS C:\Windows\System32\Logfiles\WMI /grant SYSTEM:(OI)(CI)(F)
processed file: C:\Windows\System32\Logfiles\WMI
Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\System32\Logfiles\WMI /grant "LOCAL SERVICE":(OI)(CI)(F)
processed file: C:\Windows\System32\Logfiles\WMI
Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\System32\Logfiles\WMI /grant "NETWORK SERVICE":(OI)(CI)(F)
processed file: C:\Windows\System32\Logfiles\WMI
Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\System32\Logfiles\WMI /grant Administrators:(OI)(CI)(F)
processed file: C:\Windows\System32\Logfiles\WMI
Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\System32\Logfiles\WMI /grant "Performance Log Users":(OI)(CI)(F)
processed file: C:\Windows\System32\Logfiles\WMI
Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\System32\Logfiles\WMI\RtBackup /grant SYSTEM:(OI)(CI)(F)
processed file: C:\Windows\System32\Logfiles\WMI\RtBackup
Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>

After rebooting and running the second set of commands:

Code: 
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>NET START EVENTLOG
The Windows Event Log service is starting.
The Windows Event Log service could not be started.

A system error has occurred.

System error 5 has occurred.

Access is denied.


C:\Windows\system32>SC QUERYEX EVENTLOG

SERVICE_NAME: EVENTLOG
        TYPE               : 20  WIN32_SHARE_PROCESS
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 5  (0x5)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
        PID                : 0
        FLAGS              :

C:\Windows\system32>NET START SPPSVC
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.


C:\Windows\system32>

Event Viewer/Log isn't starting? :(
 

My Computer My Computer

At a glance

Windows 7 Professional 32-bit
OS
Windows 7 Professional 32-bit
Yeah - that's the root cause of your problem - it's lacking access to necessary files, so we need to work out which ones..... back later.
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
Are you saying that the permissions in the entire Windows folder could possibly have been hosed?

If so, damn, I wonder what this user did to cause that. The thing is, I've done a malware scan with all the usual tools and NOTHING is coming up that could suggest it was malware.

It just sounds like something went horribly wrong and took the entire system down with it.

At this point it almost sounds like it would be better off to just do a repair install, but I'm not giving up yet.
 

My Computer My Computer

At a glance

Windows 7 Professional 32-bit
OS
Windows 7 Professional 32-bit
It certainly looks a possibility - a repair install may be the easiest solution.

Let's see if the RtBackup folder contents have the right permissions - and a few other things as well

In an Elevated Command Prompt window, run the following commands...

DIR C:\Windows\System32 /AR /S
ICACLS C:\Windows\System32\Logfiles\WMI\RtBackup /grant Administrators:(R)
ICACLS C:\Windows\System32\Logfiles\WMI\RtBackup /T
ICACLS C:\Windows\System32\Logfiles\WMI\RtBackup /remove Administrators
ICACLS C:\Windows\System32\Logfiles
ICACLS C:\Windows\System32
ICACLS C:\Windows\Logs
ICACLS C:\Windows\ServiceProfiles\NetworkService
ICACLS C:\Windows\ServiceProfiles\LocalService

post the results - in a Code box, please!
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
Here you go. Word wrapping was a bit messed up so I did my best to clean it up.

Code: 
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>DIR C:\Windows\System32 /AR /S
 Volume in drive C has no label.
 Volume Serial Number is 6EFF-DD7B

 Directory of C:\Windows\System32\config\systemprofile

10/06/2010  03:04 PM    <DIR>          Contacts
               0 File(s)              0 bytes

 Directory of C:\Windows\System32\config\systemprofile\Contacts

10/06/2010  03:04 PM    <DIR>          .
10/06/2010  03:04 PM    <DIR>          ..
               0 File(s)              0 bytes

 Directory of C:\Windows\System32\restore

10/06/2010  03:05 PM                76 MachineGuid.txt
               1 File(s)             76 bytes

     Total Files Listed:
               1 File(s)             76 bytes
               3 Dir(s)  105,073,401,856 bytes free

C:\Windows\system32>ICACLS C:\Windows\System32\Logfiles\WMI\RtBackup /grant Administrators:(R)
processed file: C:\Windows\System32\Logfiles\WMI\RtBackup
Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\System32\Logfiles\WMI\RtBackup /T
C:\Windows\System32\Logfiles\WMI\RtBackup NT AUTHORITY\SYSTEM:(F)
                                          BUILTIN\Administrators:(F)
                                          NT AUTHORITY\SYSTEM:(OI)(CI)(F)
                                          BUILTIN\Performance Log Users:(I)(OI)(CI)(F)
                                          BUILTIN\Administrators:(I)(OI)(CI)(F)
                                          NT AUTHORITY\NETWORK SERVICE:(I)(OI)(CI)(F)
                                          NT AUTHORITY\LOCAL SERVICE:(I)(OI)(CI)(F)
                                          NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)

C:\Windows\System32\Logfiles\WMI\RtBackup\EtwRTDiagLog.etl NT AUTHORITY\SYSTEM:(F)
                                                           BUILTIN\Administrators:(F)
                                                           NT AUTHORITY\SYSTEM:(I)(F)
                                                           BUILTIN\Performance Log Users:(I)(F)
                                                           BUILTIN\Administrators:(I)(F)
                                                           NT AUTHORITY\NETWORK SERVICE:(I)(F)
                                                           NT AUTHORITY\LOCAL SERVICE:(I)(F)

C:\Windows\System32\Logfiles\WMI\RtBackup\EtwRTEventLog-Application.etl NT AUTHORITY\SYSTEM:(F)
                                                                        BUILTIN\Administrators:(F)
                                                                        NT AUTHORITY\SYSTEM:(I)(F)
                                                                        BUILTIN\Performance Log Users:(I)(F)
                                                                        BUILTIN\Administrators:(I)(F)
                                                                        NT AUTHORITY\NETWORK SERVICE:(I)(F)
                                                                        NT AUTHORITY\LOCAL SERVICE:(I)(F)

C:\Windows\System32\Logfiles\WMI\RtBackup\EtwRTEventlog-Security.etl NT AUTHORITY\SYSTEM:(F)
                                                                     BUILTIN\Administrators:(F)
                                                                     NT AUTHORITY\SYSTEM:(I)(F)
                                                                     BUILTIN\Performance Log Users:(I)(F)
                                                                     BUILTIN\Administrators:(I)(F)
                                                                     NT AUTHORITY\NETWORK SERVICE:(I)(F)
                                                                     NT AUTHORITY\LOCAL SERVICE:(I)(F)

C:\Windows\System32\Logfiles\WMI\RtBackup\EtwRTEventLog-System.etl NT AUTHORITY\SYSTEM:(F)
                                                                   BUILTIN\Administrators:(F)
                                                                   NT AUTHORITY\SYSTEM:(I)(F)
                                                                   BUILTIN\Performance Log Users:(I)(F)
                                                                   BUILTIN\Administrators:(I)(F)
                                                                   NT AUTHORITY\NETWORK SERVICE:(I)(F)
                                                                   NT AUTHORITY\LOCAL SERVICE:(I)(F)


C:\Windows\System32\Logfiles\WMI\RtBackup\EtwRTUBPM.etl NT AUTHORITY\SYSTEM:(I)(F)
                                                        BUILTIN\Performance Log Users:(I)(F)
                                                        BUILTIN\Administrators:(I)(F)
                                                        NT AUTHORITY\NETWORK SERVICE:(I)(F)
                                                        NT AUTHORITY\LOCAL SERVICE:(I)(F)

Successfully processed 6 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\System32\Logfiles\WMI\RtBackup /remove Administrators
processed file: C:\Windows\System32\Logfiles\WMI\RtBackup
Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\System32\Logfiles
C:\Windows\System32\Logfiles NT AUTHORITY\SYSTEM:(F)
                             BUILTIN\Administrators:(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\System32
C:\Windows\System32 NT SERVICE\TrustedInstaller:(F)
                    NT SERVICE\TrustedInstaller:(CI)(IO)(F)
                    NT AUTHORITY\SYSTEM:(M)
                    NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
                    BUILTIN\Administrators:(M)
                    BUILTIN\Administrators:(OI)(CI)(IO)(F)
                    BUILTIN\Users:(RX)
                    BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
                    CREATOR OWNER:(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\Logs
C:\Windows\Logs NT AUTHORITY\SYSTEM:(F)
                BUILTIN\Administrators:(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\ServiceProfiles\NetworkService
C:\Windows\ServiceProfiles\NetworkService NT AUTHORITY\SYSTEM:(F)
                                          BUILTIN\Administrators:(F)
                                          NT AUTHORITY\NETWORK SERVICE:(OI)(CI)(F)
                                          NT SERVICE\TrustedInstaller:(I)(F)
                                          NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
                                          NT AUTHORITY\SYSTEM:(I)(F)
                                          NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
                                          BUILTIN\Administrators:(I)(F)
                                          BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
                                          BUILTIN\Users:(I)(RX)
                                          BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
                                          CREATOR OWNER:(I)(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\ServiceProfiles\LocalService
C:\Windows\ServiceProfiles\LocalService NT AUTHORITY\SYSTEM:(OI)(CI)(F)
                                        BUILTIN\Administrators:(OI)(CI)(F)
                                        NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>
 

My Computer My Computer

At a glance

Windows 7 Professional 32-bit
OS
Windows 7 Professional 32-bit
Please let me know what needs to be done next. I see the seven forums are keeping you busy. ;)
 

My Computer My Computer

At a glance

Windows 7 Professional 32-bit
OS
Windows 7 Professional 32-bit
Not just the SF ones - I cover the MS forums as well.

The WBEM structure can also cause major problems - let's have a look there....

DIR C:\Windows\System32\wbem /AR

ICACLS C:\Windows\System32\wbem
ICACLS C:\Windows\System32\wbem\MOF
ICACLS C:\Windows\System32\wbem\xml
ICACLS C:\Windows\System32\wbem\Logs
ICACLS C:\Windows\System32\wbem\Performance
ICACLS C:\Windows\System32\wbem\Repository
ICACLS C:\Windows\System32\wbem\tmf
ICACLS C:\Windows\System32\wbem\en-US


Please post the results in a Code box in your reply (the #symbol in the menu)
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
Here you go.

Code: 
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>DIR C:\Windows\System32\wbem /AR
 Volume in drive C has no label.
 Volume Serial Number is 6EFF-DD7B

 Directory of C:\Windows\System32\wbem

File Not Found

C:\Windows\system32>
C:\Windows\system32>ICACLS C:\Windows\System32\wbem
C:\Windows\System32\wbem NT SERVICE\TrustedInstaller:(F)
                         NT SERVICE\TrustedInstaller:(CI)(IO)(F)
                         NT AUTHORITY\SYSTEM:(M)
                         NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
                         BUILTIN\Administrators:(M)
                         BUILTIN\Administrators:(OI)(CI)(IO)(F)
                         BUILTIN\Users:(RX)
                         BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
                         CREATOR OWNER:(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\System32\wbem\MOF
C:\Windows\System32\wbem\MOF NT AUTHORITY\SYSTEM:(F)
                             BUILTIN\Administrators:(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\System32\wbem\xml
C:\Windows\System32\wbem\xml NT SERVICE\TrustedInstaller:(F)
                             NT SERVICE\TrustedInstaller:(CI)(IO)(F)
                             NT AUTHORITY\SYSTEM:(M)
                             NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
                             BUILTIN\Administrators:(M)
                             BUILTIN\Administrators:(OI)(CI)(IO)(F)
                             BUILTIN\Users:(RX)
                             BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
                             CREATOR OWNER:(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\System32\wbem\Logs
C:\Windows\System32\wbem\Logs NT AUTHORITY\SYSTEM:(F)
                              BUILTIN\Administrators:(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\System32\wbem\Performance
C:\Windows\System32\wbem\Performance NT SERVICE\TrustedInstaller:(I)(F)
                                     NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
                                     NT AUTHORITY\SYSTEM:(I)(F)
                                     NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
                                     BUILTIN\Administrators:(I)(F)
                                     BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
                                     BUILTIN\Users:(I)(RX)
                                     BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
                                     CREATOR OWNER:(I)(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\System32\wbem\Repository
C:\Windows\System32\wbem\Repository BUILTIN\Users:(RX)
                                    BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
                                    NT AUTHORITY\NETWORK SERVICE:(R)
                                    NT AUTHORITY\NETWORK SERVICE:(OI)(CI)(IO)(GR)
                                    No mapping between account names and security IDs was done.
(R,W)
                                    No mapping between account names and security IDs was done.
(OI)(CI)(IO)(GR,GW)
                                    BUILTIN\Administrators:(F)
                                    BUILTIN\Administrators:(OI)(CI)(IO)(F)
                                    NT AUTHORITY\SYSTEM:(F)
                                    NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
                                    OWNER RIGHTS:(OI)(CI)(IO)(Rc)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\System32\wbem\tmf
C:\Windows\System32\wbem\tmf NT AUTHORITY\SYSTEM:(F)
                             BUILTIN\Administrators:(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\System32\wbem\en-US
C:\Windows\System32\wbem\en-US NT SERVICE\TrustedInstaller:(F)
                               NT SERVICE\TrustedInstaller:(CI)(IO)(F)
                               NT AUTHORITY\SYSTEM:(M)
                               NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
                               BUILTIN\Administrators:(M)
                               BUILTIN\Administrators:(OI)(CI)(IO)(F)
                               BUILTIN\Users:(RX)
                               BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
                               CREATOR OWNER:(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>

File not found for the first command? Tried that command on my personal machine - doesn't seem to work either.
 

My Computer My Computer

At a glance

Windows 7 Professional 32-bit
OS
Windows 7 Professional 32-bit
Thse don't look too bad

SO far, the only serious deviation I can see is in the output from
ICACLS C:\Windows\System32\Logfiles

so let's try fixing that - we'll go the easy route.
Open Windows Explorer
Navigate to the C:\Windows\System32 folder
Find the Logfiles entry
right-click on it - select Properties
Click on the Security tab
Click on the Advanced button, then the Change Permissions button.
Make sure that the tick is in the 'Include inheritable permissions from...' box
and click Apply.
You should end up with 5 entries
TrustedInstaller (Special)
SYSTEM (Full control)
Administrators (Full control)
Users (Read & Execute)
CREATOR OWNER (Special)

(all inherited from C:\Windows\System32)
put a tick in the 'Replace all child....' box
Click OK out

Repeat the process for C:\Windows\Logs
(the results in permissions will be slightly different - don't worry about it for the moment)

click OK out

Reboot, and post a new MGADiag report.
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
With the Logfiles folder, I got a:

An error occurred while applying security information to:

C:\Windows\System32\LogFiles\Srt\SrtTrail.log

Access is denied

But the rest of it worked.

With the Log folder, I got the same thing, but for
C:\Windows\Logs\CBS\CbsPersist_*.cab where * is some sort of date.
I also got the error for:
C:\Windows\Logs\SystemRestore\restore.*.etl where * was an integer 1 through 3.

And the rest of it worked.

Here's the attached MGADiag.
 

Attachments

My Computer My Computer

At a glance

Windows 7 Professional 32-bit
OS
Windows 7 Professional 32-bit
Well, no change - but I wonder if the problem is with those files that you couldn't change......
SrtTrail.txt is a simple text file, and shouldn't be locked while the system is running.
Likewise, the CBSpersist files are simple archives, and shouldn't be locked

The SystemRestore files are a slightly different kettle of fish :)


Please run the following commands....

DIR C:\Windows\System32\Logfiles\Srt\SRT*.*
ATTRIB C:\Windows\System32\Logfiles\Srt\SRT*.*
ICACLS C:\Windows\System32\Logfiles\Srt\SRT*.*
DIR C:\Windows\Logs\CBS\CBSPersist*.*
ATTRIB C:\Windows\Logs\CBS\CBSPersist*.*
ICACLS C:\Windows\Logs\CBS\CBSPersist*.*


post the results.
 
Last edited:

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
Code: 
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>DIR C:\Windows\System32\Logfiles\Srt\SRT*.*
 Volume in drive C has no label.
 Volume Serial Number is 6EFF-DD7B

 Directory of C:\Windows\System32\Logfiles\Srt

10/06/2012  05:43 PM            34,584 SrtTrail.log
10/06/2012  05:43 PM            11,960 SrtTrail.txt
               2 File(s)         46,544 bytes
               0 Dir(s)  103,963,242,496 bytes free

C:\Windows\system32>ATTRIB C:\Windows\System32\Logfiles\Srt\SRT*.*
A            C:\Windows\System32\Logfiles\Srt\SrtTrail.log
A            C:\Windows\System32\Logfiles\Srt\SrtTrail.txt

C:\Windows\system32>ICACLS C:\Windows\System32\Logfiles\Srt\SRT*.*
C:\Windows\System32\Logfiles\Srt\SrtTrail.log NT AUTHORITY\SYSTEM:(F)
                                              BUILTIN\Administrators:(RX)

C:\Windows\System32\Logfiles\Srt\SrtTrail.txt NT AUTHORITY\SYSTEM:(I)(F)
                                              BUILTIN\Administrators:(I)(F)
                                              BUILTIN\Users:(I)(RX)

Successfully processed 2 files; Failed processing 0 files

C:\Windows\system32>DIR C:\Windows\Logs\CBS\CBSPersist*.*
 Volume in drive C has no label.
 Volume Serial Number is 6EFF-DD7B

 Directory of C:\Windows\Logs\CBS

09/29/2012  04:18 PM           404,252 CbsPersist_20120930231433.cab
10/08/2012  07:52 AM           472,746 CbsPersist_20121008180820.cab
10/09/2012  09:01 AM           600,645 CbsPersist_20121009204721.cab
10/09/2012  02:30 PM           570,580 CbsPersist_20121010034712.cab
10/10/2012  09:18 AM           753,739 CbsPersist_20121010201704.cab
               5 File(s)      2,801,962 bytes
               0 Dir(s)  103,963,254,784 bytes free

C:\Windows\system32>ATTRIB C:\Windows\Logs\CBS\CBSPersist*.*
A            C:\Windows\Logs\CBS\CbsPersist_20120930231433.cab
A            C:\Windows\Logs\CBS\CbsPersist_20121008180820.cab
A            C:\Windows\Logs\CBS\CbsPersist_20121009204721.cab
A            C:\Windows\Logs\CBS\CbsPersist_20121010034712.cab
A            C:\Windows\Logs\CBS\CbsPersist_20121010201704.cab

C:\Windows\system32>ICACLS C:\Windows\Logs\CBS\CBSPersist*.*
C:\Windows\Logs\CBS\CbsPersist_20120930231433.cab NT AUTHORITY\SYSTEM:(I)(F)
                                                  BUILTIN\Administrators:(I)(F)
                                                  BUILTIN\Users:(I)(RX)

C:\Windows\Logs\CBS\CbsPersist_20121008180820.cab: Access is denied.
Successfully processed 1 files; Failed processing 1 files

C:\Windows\system32>
 

My Computer My Computer

At a glance

Windows 7 Professional 32-bit
OS
Windows 7 Professional 32-bit
Keirnoth said:
C:\Windows\system32>ICACLS C:\Windows\Logs\CBS\CBSPersist*.*
C:\Windows\Logs\CBS\CbsPersist_20120930231433.cab NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Administrators:(I)(F)
BUILTIN\Users:(I)(RX)

C:\Windows\Logs\CBS\CbsPersist_20121008180820.cab: Access is denied.
Successfully processed 1 files; Failed processing 1 files

C:\Windows\system32>
[/code]
Click to expand...
OK - we've found at least one problem file
Please see what the permissions are for it in Windows Explorer - if you can access it at all.

Open Windows Explorer and navigate to the C:\Windows\Logs\CBS folder
right-click on the CbsPersist_20121008180820.cab file, and select Properties
Click on the Security tab
What are the ticked permissions for each entry in the Users box?

Close Windows Explorer, and open an Elevated Command Prompt window.

run the following commands

TAKEOWN /F C:\Windows\Logs\CBS\CbsPersist_20121008180820.cab /A
ICACLS C:\Windows\Logs\CBS\CbsPersist_20121008180820.cab

Post the results.
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
When I check the permissions, it simply says "You do not have permission to view or edit this object's permission settings."

The same goes for these two cab files:
CbsPersist_20121009204721.cab and
CbsPersist_20121010034712.cab

After running those commands on all three of the affected files:

Code: 
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\Logs\CBS>TAKEOWN /F C:\Windows\Logs\CBS\CbsPersist_20121008180820.cab /A

SUCCESS: The file (or folder): "C:\Windows\Logs\CBS\CbsPersist_20121008180820.cab" now owned by the administrators group.

C:\Windows\Logs\CBS>TAKEOWN /F C:\Windows\Logs\CBS\CbsPersist_20121009204721.cab /A

SUCCESS: The file (or folder): "C:\Windows\Logs\CBS\CbsPersist_20121009204721.cab" now owned by the administrators group.

C:\Windows\Logs\CBS>TAKEOWN /F C:\Windows\Logs\CBS\CbsPersist_20121010034712.cab /A

SUCCESS: The file (or folder): "C:\Windows\Logs\CBS\CbsPersist_20121010034712.cab" now owned by the administrators group.

C:\Windows\Logs\CBS>ICACLS C:\Windows\Logs\CBS\CbsPersist_20121008180820.cab
C:\Windows\Logs\CBS\CbsPersist_20121008180820.cab NT AUTHORITY\SYSTEM:(F)
                                                  OWNER RIGHTS:(IO)(Rc)
                                                  NT SERVICE\TrustedInstaller:(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\Logs\CBS>ICACLS C:\Windows\Logs\CBS\CbsPersist_20121009204721.cab
C:\Windows\Logs\CBS\CbsPersist_20121009204721.cab NT AUTHORITY\SYSTEM:(F)
                                                  OWNER RIGHTS:(IO)(Rc)
                                                  NT SERVICE\TrustedInstaller:(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\Logs\CBS>ICACLS C:\Windows\Logs\CBS\CbsPersist_20121010034712.cab
C:\Windows\Logs\CBS\CbsPersist_20121010034712.cab NT AUTHORITY\SYSTEM:(F)
                                                  OWNER RIGHTS:(IO)(Rc)
                                                  NT SERVICE\TrustedInstaller:(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\Logs\CBS>
I also attached a new MGADiag log for your convenience after restarting the machine.
 

Attachments

My Computer My Computer

At a glance

Windows 7 Professional 32-bit
OS
Windows 7 Professional 32-bit
Odd permissions there - it's as if the filesave got blocked before the permissions could be reset byt the TrustedInstaller service.
You should now be able to reset the permissions properly using the Logs folder as the source again - as in post #32 - let's see if there's any other errors brought up
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
Alright, I replaced the permissions and didn't get the errors on the CBSPersist files anymore. It still locked me out of the restore0, 1, and 2.etl files. Is this normal?

Let me know what else I need to do - should I enter the CD key on the COA for this machine and see if it activates or is there something still broken that's causing Windows to think the key installed by the OEM is invalid?
 

My Computer My Computer

At a glance

Windows 7 Professional 32-bit
OS
Windows 7 Professional 32-bit
Probably the best way to attempt to deal with the Sytem Restore problem is to reset System Restore (and VSS) manually.

Click on teh Start button
in the Search box, type Advanced System Settings
You'll see a list of options come up - one should be 'View Advanced system settings'
click on that.
Click on the System Protection tab in the popup that should appear.
Click on the 'Create' button and follow the instructions.

Assuming that the new System Restore point is properly created.......
close the popup
Click on the Start button
in the Search box, type Disk Cleanup and click on the resulting find
Follow the instructions.
UNCHECK ALL BOXES in the initial page of the popup.
Click on the 'Clean up system files' button and select the C: drive to clean up
When the scan has finished, click on the More Options tab
In the System Restore and Shadow Copies area, click on Clean up.
agree to the warning.
Wait for completion (could take a while!) and then close out the Disk Cleanup window.
reboot.

Now see if
a) the files still exist
b) you can access their permissions.
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
You must log in or register to reply here.

Similar threads

Can I put Win 7 HDD in anothe PC without licensing/activation problems
Replies
16
Views
2K
Layback Bear
Layback Bear
SYSTEM and Trusted Installer permissions
Replies
2
Views
7K
Barman58
Barman58
Solved Virtual Box and activation problems exceeded unlock code
Replies
12
Views
2K
townsbg
townsbg
Computer not upgrading to Windows 10 because of Activation Problem
Replies
9
Views
3K
torchwood
torchwood
Solved driver installation and ownership issues
Replies
4
Views
3K
ineuw
ineuw
Back
Top