Issues with missing permissions [Moved]

[Tarath]

Hi there! I'm new to the forums so go easy on me :S. Recently my laptop has been acting oddly so I wanted to use sfc /scannow to see if it could fix up anything problematic

I've performed the sfc /scannow in cmd as an admin and it came up with "Windows resource protection found some files but was unable to fix some of them".

Then I took the step of Dism /Online /Cleanup-Image /RestoreHealth and it seemed to have gone well. So I rebooted my computer and tried SFC /scannow and it came up with the same unable to fix some of them. I have even tried SFC /scannow 3 times but it came up with the same unable to fix spiel.

I've attached the CBS log because I can't make any sense of it. Could anyone please tell me if it is anything important/crucial that is affecting my computer in the log or if that the "unable to fix some of the files" isn't for anything important?

Thanks.

 

[NoelDP]

You appear to have run the SFC at least twice - and uninstalled an update in between?
The earlier scan had the following error...

 Line 3900: 2015-07-11 16:25:54, Info                  CSI    000008f1 [SR] Repairing 1 components
 Line 3901: 2015-07-11 16:25:54, Info                  CSI    000008f2 [SR] Beginning Verify and Repair transaction
 Line 3904: 2015-07-11 16:25:54, Info                  CSI    000008f4 [SR] Cannot repair member file [l:24{12}]"utc.app.json" of Microsoft-Windows-Unified-Telemetry-Client, Version = 6.3.9600.17842, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 3907: 2015-07-11 16:25:54, Info                  CSI    000008f6 [SR] Cannot repair member file [l:66{33}]"telemetry.ASM-WindowsDefault.json" of Microsoft-Windows-Unified-Telemetry-Client, Version = 6.3.9600.17842, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch

- which according to MS isn't a problem.

The later run had no errors at all as far as the normal extract shows.

However there are a large (400+) number of folders which apparently have no Owner - here's a couple of the errors from the log...

Line 3684: 2015-07-11 16:23:57, Info                  CSI    00000868 [DIRSD OWNER WARNING] Directory [ml:520{260},l:112{56}]"\??\C:\Windows\Inf\.NET Data Provider for SqlServer\0000" is not owned but specifies SDDL in component Microsoft-Windows-NETFXCoreComp, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
 Line 3686: 2015-07-11 16:23:57, Info                  CSI    00000869 [DIRSD OWNER WARNING] Directory [ml:66{33},l:64{32}]"\??\C:\Windows\SysWOW64\MUI\0409" is not owned but specifies SDDL in component Microsoft-Windows-NETFXCoreComp, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral

This looks to me as if you've run some kind of 'fixit' tool which has messed up file ownership and permissions.
I would tend to think that a repair install is going to be your best option, if you have the appropriate media.

 

[Tarath]

You appear to have run the SFC at least twice - and uninstalled an update in between?
The earlier scan had the following error...

 Line 3900: 2015-07-11 16:25:54, Info                  CSI    000008f1 [SR] Repairing 1 components
 Line 3901: 2015-07-11 16:25:54, Info                  CSI    000008f2 [SR] Beginning Verify and Repair transaction
 Line 3904: 2015-07-11 16:25:54, Info                  CSI    000008f4 [SR] Cannot repair member file [l:24{12}]"utc.app.json" of Microsoft-Windows-Unified-Telemetry-Client, Version = 6.3.9600.17842, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 3907: 2015-07-11 16:25:54, Info                  CSI    000008f6 [SR] Cannot repair member file [l:66{33}]"telemetry.ASM-WindowsDefault.json" of Microsoft-Windows-Unified-Telemetry-Client, Version = 6.3.9600.17842, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch

- which according to MS isn't a problem.

The later run had no errors at all as far as the normal extract shows.

However there are a large (400+) number of folders which apparently have no Owner - here's a couple of the errors from the log...

Line 3684: 2015-07-11 16:23:57, Info                  CSI    00000868 [DIRSD OWNER WARNING] Directory [ml:520{260},l:112{56}]"\??\C:\Windows\Inf\.NET Data Provider for SqlServer\0000" is not owned but specifies SDDL in component Microsoft-Windows-NETFXCoreComp, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
 Line 3686: 2015-07-11 16:23:57, Info                  CSI    00000869 [DIRSD OWNER WARNING] Directory [ml:66{33},l:64{32}]"\??\C:\Windows\SysWOW64\MUI\0409" is not owned but specifies SDDL in component Microsoft-Windows-NETFXCoreComp, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral

This looks to me as if you've run some kind of 'fixit' tool which has messed up file ownership and permissions.
I would tend to think that a repair install is going to be your best option, if you have the appropriate media.

A repair install? What is that? Just a complete reformat of the system?
So this tool messed up file ownership and permissions, does that mean its messing up my system or not doing anything bad?
The fixit-esque stuff I have are Advanced Systemcare 8, CC Cleaner, Driver booster 2, Smart Defrag 4, Avast Free antivirus, Malwarebytes.
Any problematic ones in this list?

 

[NoelDP]

1) Advanced System Care is extremely dangerous - you should uninstall it, and any other software from the same house!
2) Driver booster is unnecessary, and potentially dangerous. - Drivers only need to be updated if there are problems with the existing ones that the updates are designed to fix. This type of software will tend to find whatever the latest version is - regardless of whether it's appropriate for your machine, and can result in a mismatch.
3) Windows has a perfectly adequate Defragger out of the box, which runs all the time - a third-party one is unnecessary, and can actually make things worse, if the Windows one isn't properly disabled, as each has a different definition of 'defragged' and one will undo what the other has done - only for that in turn to be undone.

Avast and MBAM are OK.

As far as what's happened is concerned, my suspicion falls on ASC - but it's unlikely that attempting to use any inbuilt Undo option will be effective.

A repair install is also known as an In-place Upgrade install, which requires retail media rather than Recovery media. See the tutorial here... http://www.sevenforums.com/tutorials/3413-repair-install.html?ltr=R

 

[Tarath]

1) Advanced System Care is extremely dangerous - you should uninstall it, and any other software from the same house!
2) Driver booster is unnecessary, and potentially dangerous. - Drivers only need to be updated if there are problems with the existing ones that the updates are designed to fix. This type of software will tend to find whatever the latest version is - regardless of whether it's appropriate for your machine, and can result in a mismatch.
3) Windows has a perfectly adequate Defragger out of the box, which runs all the time - a third-party one is unnecessary, and can actually make things worse, if the Windows one isn't properly disabled, as each has a different definition of 'defragged' and one will undo what the other has done - only for that in turn to be undone.

Avast and MBAM are OK.

As far as what's happened is concerned, my suspicion falls on ASC - but it's unlikely that attempting to use any inbuilt Undo option will be effective.

A repair install is also known as an In-place Upgrade install, which requires retail media rather than Recovery media. See the tutorial here... http://www.sevenforums.com/tutorials/3413-repair-install.html?ltr=R

Hmmm I see. Thanks for the input, I'll remove ASC and driverbooster.
I don't have my windows key with me so I dont think I'll be able to do a repair install. Is my system that bad to warrant a repair install? Could I get an explanation of what is happening and what problems are being caused from the log?
Cheers!

 

[NoelDP]

Let's take one of the folders I used as an example...

Open an Elevated Command Prompt, and run the following commands

DIR C:\Windows\SysWOW64\MUI\0409
ICACLS C:\Windows\SysWOW64\MUI\0409

Post the results.

Here are some instructions to make lifeeasier

1) To open anElevated Command Prompt Window (the ECP window), click on Start, All Programs,Accessories – then right-click on Command Prompt, and select Run asAdministrator. Accept the UAC prompt.

2) To run thecommands easier, highlight the block of commands, and right-click on thehighlight – select Copy. In the CP Window, click on the black/white icon at topleft – select Paste. The commands will run but may not complete the lastcommand, so hit the Enter Key once.

3) To copy theresults... click on the Black/White icon in the top left, and select Edit...'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to pasteit into your response.

 

[Tarath]

For DIR C:\Windows\SysWOW64\MUI\0409:

C:\Windows\system32>
C:\Windows\system32>DIR C:\Windows\SysWOW64\MUI\0409
Volume in drive C is Windows
Volume Serial Number is 38FD-F453

Directory of C:\Windows\SysWOW64\MUI\0409

23/08/2013 01:36 AM <DIR> .
23/08/2013 01:36 AM <DIR> ..
22/08/2013 02:16 PM 5,632 mscorees.dll
1 File(s) 5,632 bytes
2 Dir(s) 370,562,543,616 bytes free

C:\Windows\system32>


For ICACLS C:\Windows\SysWOW64\MUI\0409

Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.

C:\Windows\system32>ICACLS C:\Windows\SysWOW64\MUI\0409
C:\Windows\SysWOW64\MUI\0409 NT SERVICE\TrustedInstallerF)
NT SERVICE\TrustedInstallerCI)(IO)(F)
NT AUTHORITY\SYSTEMM)
NT AUTHORITY\SYSTEMOI)(CI)(IO)(F)
BUILTIN\AdministratorsM)
BUILTIN\AdministratorsOI)(CI)(IO)(F)
BUILTIN\UsersRX)
BUILTIN\UsersOI)(CI)(IO)(GR,GE)
CREATOR OWNEROI)(CI)(IO)(F)
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKA
GESRX)
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKA
GESOI)(CI)(IO)(GR,GE)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>

 

[NoelDP]

Now that does surprise me!

I've never noticed the last entry in anything before - and it doesn't exist on my install.
Is this machine attached to a Domain Server?

 

[Tarath]

A domain server? I don't think so... Why?

 

[Pyprohly]

I've never noticed the last entry in anything before - and it doesn't exist on my install.

The identity reference "APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES" exists abundantly on Windows 8.1, it's non-existent in Win. 7.

 

[NoelDP]

No wonder I'm confused - I never noticed this was Win8!!

Tarath - you'd be much better off reposting this in our sister forums - www.eightforums.com where Win8 specialists can help.

 

[Tarath]

Ah, I'm sorry, I didn't mention it to be windows 8.1, thanks for the help -- I'll take it up there, cheers!

 

[NoelDP]

Good luck! - sorry for the detour.