Need help understanding users and permissions to secure new system

[FluffyBunny]

By the way, the actual error I was getting regarding propagation of permissions is

"Stopping the propagation of [COLOR=#3676A2 ! important][FONT=inherit ! important][COLOR=#3676A2 ! important][FONT=inherit ! important]permission[/FONT][/FONT][/COLOR][/COLOR] settings leads to an inconsistent state, in which some objects have the settings but others don't. If you made the change by mistake, you should apply the [COLOR=#3676A2 ! important][FONT=inherit ! important][COLOR=#3676A2 ! important][FONT=inherit ! important]correct[/FONT][/FONT][/COLOR][/COLOR] change immediately to achieve a consistent state."

This page has an example of such an error occurring, and a possible hint of
how to get out of it:

Solved I am in a loop trying to grant myself permission - Vista Forums

Clearly, this problem exists in Vista as well as Windows 7. But I still don't
understand why it is occurring for me.

 

[Anak]

FB, I regret to tell you, I have run out of ways to repair your situation. Especially since your system seems to be heading towards a state of inconsistency.

This does not mean that I have abandon you, therefore, I have a call out to other members of 7F to survey your particular situation, and see if there may be any avenues that we can use to return your system to stability, along with your desire to have proper permissions across your system.

If at all possible, I beseech you to stop any further adjustments to your system until we receive further help.

Edit:
Don't worry I will be here every time anyone responds. If you have any questions for them or for me, you will receive an answer.

Steve

 

[FluffyBunny]

Sigh. Okay, I'll stop adjustments for now, in the hope that
someone else might be able to gain some insight into the problems.
I really, really hope that someone can find an answer within the
next 48 hours or so, as I'm already way behind where I should be
on getting this system up and running.

It sounds like somebody at Microsoft really needs to write a program
analogous to CHKDSK, to check the consistency of the permissions/
rights tree. They could call it CHKPERM. I imagine it would be a tough
program to write, given that different rights are stored in different
places, but if the company is going to provide end users with a system
that can so easily be put into an inconsistent state, they ought to
make the effort. It's not like they don't have any money to spend. :-(

 

[Anak]

Hang in there FB.

I talked with Brink, one of the Admins here, and the fellow that writes most of the tutorials, and he told me he looked into your situation here, but because it was getting late for him. He had to sleep on it, and once he had his day organized he was going to post with some advice.

He may ask you to post a screen-shot of some of your permissions boxes. Here are two tutorials to help you.

This one shows how to use the snipping tool located in your start menu.
If you do not see it as soon as you open the start menu, it is listed under All Programs >Accessories.
This tool helps you to snip/cut areas of the working desktop, and save them in your pictures library:
How to Use the Snipping Tool in Vista and Windows 7- Vista Forums

This tutorial will show you how to post what you have saved, into your next message.
http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html#post93869

Once you told me that your log-on screen was black instead of the normal blue I am thinking there may be bigger problems here, I hope not.

Steve

 

[FluffyBunny]

Steve,

I talked with Brink, one of the Admins here, and the fellow that writes most of the tutorials, and he told me he looked into your situation here, but because it was getting late for him. He had to sleep on it, and once he had his day organized he was going to post with some advice.

No problem; thanks for replying. Sleep is a good thing! Thanks for the
info on the use of the Snipping Tool. I had read a little about that, and
I guess I'll be getting some practice soon. I have historically used a
program called ScreenHunter for this purpose, but since that isn't on
my laptop yet, I'll use the Snipping Tool.

Once you told me that your log-on screen was black instead of the normal blue I am thinking there may be bigger problems here, I hope not.

I hope not too. It is black because somehow my account doesn't have
permission to open the Desktop file. Which implies that I took away one
permission too many. I'm guessing that denying all permissions to the
User group might be the culprit.

I probably won't be back online until late this afternoon (PST).
Thanks for all your efforts to track down the problem!

 

[Anak]

I do not know about you FB, but for me the silence is deafening.


Researching what we know so far. This:

E:\Users\admin\Desktop is not accessible.Access is denied.

points to a corrupt Users Profile, and because of this:

I hope not too. It is black because somehow my account doesn't have permission to open the Desktop file. Which implies that I took away one permission too many. I'm guessing that denying all permissions to the User group might be the culprit.

Your best course of action now would be to do a System Restore: http://www.sevenforums.com/tutorials/700-system-restore.html To a date closest to right after you created the E:\ partition.

If you are unsure of that date. Go to E Drive properties It will be listed either on the General tab or the Details tab under install or creation date.

If you are having problems with System Restore follow this tutorial:http://www.sevenforums.com/tutorials/57746-system-restore-general-troubleshooting-fix-issues.html

 

[FluffyBunny]

Anak,

I appreciate your advice, but will it really do any good to do a
System Restore? Not opening the desktop is clearly a permissions
issue, which should be curable by setting the permissions correctly.

If I do a System Restore, this might put me back to a point before
the problem occurred, but it still tells me nothing about how to set
the permissions correctly in the first place. What is to prevent me
from having the same problems again if I try to re-apply the earlier
instructions?

One thing it occurs to me to ask is, has anyone on your end actually
tried to reproduce the problem? I realize that none of you may have
re-partitioned your drive, but it isn't clear yet (to me, at any rate) that
the partitioning had anything to do with the problem. So, for example,
suppose your machine has an account with user name RabbitFoot,
and that you have logged in as an administrative user. (And suppose
that you have just created another restore point to make sure you
can back out easily if the following test messes up your machine.)
Further suppose that you look at the permissions on the folder
C:\Users\RabbitFoot. Now, explicitly Deny all permissions for the
Users group. When you click the Apply button, what happens?
Is your action quietly accepted, or do you see any of the error
messages I reported? And if you see any of the error messages,
can you escape from the error dialogs without having to log out
of your account?

I'm really curious to know whether any of you have seen the
problem first-hand, and I hope that if you do, it might give you
some insight into what is going on. It seems like there are three
major possibilities for my problems:

1. Partitioning the drive or the way in which I moved the existing
folders to the new partition somehow caused the problem.

2. There is a serious bug or design flaw in Microsoft's rights and
permissions architecture.

3. Or (perhaps my best hope), none of us fully understands how
the rights and permissions architecture really works, and we're
missing some key bit of information about how to make a folder
unreadable by others, but still readable by oneself. (For example,
in addition to Allowing all permissions for user RabbitFoot and
Denying all permissions to the Users group and the Authenticated
users group, might I need to explicitly remove user RabbitFoot
from either of the groups that I am denying all permissions to,
since Microsoft errs on the side of denying permissions when
more than one possible set of permissions applies?)

Thanks for keeping me up to date, and let me know if you get any
interesting experimental results.

 

[Anak]

FB,

While reading another thread here not-enough-free-memory-run-program I ran across this web site that I thought may interest you SetACL: Windows ACL management | at SourceForge.net

Support Forum: SourceForge.net: SetACL: Windows ACL management: Topics for Using SetACL Where the conversations are Windows permissions oriented.

Concerns about running on x64: SourceForge.net: SetACL: Windows ACL management: Topic: 64 or 32 bit Version of EXE
Where it might be better to run the COM version that would work with both x32, andx64: COM Version (SetACL.ocx) – Syntax and Description | Helge Klein | Home of SetACL


Main page here: Helge Klein | Home of SetACL