Solved Taking 'ownership' questions.

[tkmops]

I've been told by my Trend Micro Antivirus tech to 'take ownership' of my 'C' drive, but it's been over a week, and I can't get a response to my question.

When I right click my 'C' drive, go to 'properties', then 'security', then 'Advanced', then 'owner', then 'Edit', there's two options in the 'Change owner to' box..

Tod(Tod-PC\Tod) and Administrators(Tod-PC\Administrators).

What is the difference between
between these two?

I normally sign on with my standard user account 'Tod'(not an administrator account).

Which account should I click in the 'Change owner to' box?

Thanks!

 

[Layback Bear]

I recommend not taking ownership of Partition 'C'.

From my old friend Brink. Post #362

Take Ownership Shortcut - Page 13 - Windows 7 Help Forums
Quote:
Originally Posted by johncorosz
Can you literally take ownership of everything and still have Windows work correctly?

No. If you take ownership of the Windows C: drive, it will cause Windows to become unstable. You'll most likely end up having to reinstall Windows if you do.

Jack

 

[Barman58]

You have to be logged in as an administrator to take ownership. if you are being presented with "Tod" as an option to take ownership then "Tod" is an administrator account, It's likely to be a tokenized admin account but is still a very powerful account, and should be used with care.

As for the Trend Micro "Tech" I would suggest that he gets a job that he is qualified to do. Bad programming on behalf of the developer can give a need to take ownership of their own application folder(s), but never the whole system drive.

Take ownership is an emergency tool to get a problem solved until it can be correctly set-up - all changes that are suggested to be made using take ownership should instead be corrected by the correct use of NTFS permissions system.

You also need to be aware that the ownership of files and folders is the baseline level for all the security that is built into a modern era Windows OS, every time a user Takes Ownership of a file or number of files or folder, in the system, then the overall security of the system is eroded, the more that is changed the more the system security is weakened.

Although we are unaware of the actual issue that has led you to the Tech mentioned, I will state that any problem that requires the complete ownership of the system drive to be changed to correct. is likely to beyond saving as a secure system. I would advise that you save your personal data to an external device and reinstall Windows.

 

[ethel]

take ownership

Hi Everyone, I use Trend Micro Internet Security, and purchase it from the technicians who built my pc,

and I have never heard anyone say anything about taking ownership of C drive. Trend seems to work fine

without doing anything to change the system, just my two cents worth.

 

[ThrashZone]

Hi,
The only time I might take ownership of C partition would be if the hdd it was on was hosed already and I wanted assess to personal files on it to transfer off of it after clean installing windows already
TrendMicro product have a nasty past of causing all types of issues requiring people to reinstall windows
But feel free to follow the advice

 

[tkmops]

Taking 'Ownership' questions

Thanks everyone for responding...yikes! looks like I won't be taking ownership of my 'C' drive...sounds very dangerous.

The Trend tech wanted me to take ownership because, about a month ago the Trend scans would 'hang', and just 'freeze'. I let it run for hours, and even overnight, it was still frozen.

The Trend tech and I went back and forth for a month, either on the phone, or via email, trying various things to resolve this. About a week ago, he wanted me to run CHKDSK C:/f/r.

I did that via CMD prompt(elevated), and got this msg::Cannot lock current drive. Chkdsk cannot run because the volume is in use by another process. Would you like to schedule this volume to be checked the next time the system restarts? (Y/N).

Then he wanted me to change permissions to 'Everyone' Full control for CREATOR OWNER, SYSTEM, Administrators(Tod-PC\Administrators), Users(Tod-PC\Users), and TrustedInstaller.

The only group that has full control is 'SYSTEM'(there is no Creator Owner, or TrustedInstaller). When I first checked this(last week), when I clicked the 'Edit' button, and the 'Permissions for Local Disk (C' box came up, the 'Add' button was greyed out, and all the boxes in the 'Permissions for Authenticated Users' were un-clickable. But, trying it today, the 'Add' button is hi-lighted. Should I click the 'Full control' boxes for the Authenticated Users, Administrators(Tod-PC\Administrators), and Users(Tod-PC\Users) groups? Should I add an 'Everyone', and/or a 'Creator Owner' group and give them full control?

Whew, all so confusing!

Thanks!

 

[Barman58]

Everyone and TrustedInstaller are both system generated and have special purposes Everyone has a low rank, very little basic access rights, but contains every user on a system both user generated and system generated, giving everyone full control is almost as bad as taking ownership of the system drive.

Trusted Installer is part of the Windows Virtualized security system It is system generated and Owns all the folders and files in the program files (and Program Files (x86)), folders this user is positioned above even the Administrators Group members and only the Full Hidden Administrator has a higher rank.

Creator Owner is another system generated user that is only used basically as a placeholder to give some special control to the generator of certain files.

Changing the rights of any of these users is likely to completely mess up the carefully designed security and rights that are an essential to the stable running of the system

What I would be tempted to do is to uninstall Trend Micro, preferably using a removal tool on their site, and then running the Admin level CHKDSK C:/f/r. again. it may also be a benefit to run the system file checker to ensure that the system is correctly setup.

after this it should be fine to re-install Trend Micro and hopefully this will run correctly again

 

[tkmops]

Thanks for quick response. Since today is Sunday, I'll wait through Tuesday for Trend to respond. If no response, then I will try what you suggested. Thanks!

 

[ethel]

taking ownership

Hi tkmops I uncheck the box in Trend settings for PC health checkup, as it says it is optimising the pc,

and as I am unsure what it actually does, I leave it unchecked, the machine is running fine on its own.

 

[tkmops]

Taking 'Ownership' questions

I just got a response from the Trend tech, he says to:'Please change the ownership for your drives to Administrators(Tod-PC\Administrators). After changing the ownership,please do the CHKDSK [Drive Letter]: /f /r and afterwards a scan on your drives.'

From what I've read in the prior posts, changing ownership is not a good idea, neither is doing CHKDSK [Drive Letter]: /f /r.

Thoughts, anyone?
Thanks!

 

[Layback Bear]

If you desire to run check disk this tutorial by Brink will give you guidance.

Disk Check - Windows 7 Help Forums

Jack

 

[Barman58]

Ok lets try this ...

Open a CMD window as Admin (Find the CMD shortcut in the start menu right click run as Administrator)
In the CMD window type CHKDSK [Drive Letter]: /f (note the lack of /r) and enter
Make a large coffee, (other non alcoholic drinks are acceptable), and wait until it completes.

Repeat this for each other Drive letter you have on your system.

If there are errors presented but the command is completed ( ie it runs OK and lists some problem files (You may see the occasional error on the system drive where system folders are locked this is expected)) - Now you can run the more aggressive "CHKDSK [Drive Letter]: /f /r " on each drive (/r checks for and attempts repair of bad sectors, it will mark any that cannot be used as such and prevent disk failures in future.

This procedure should check the drive and then if any file structure errors are present the second run should fix them, also be aware that this cannot work on a drive in use so it will ask to schedule a run on reboot - accept this and let it reboot to run.

I would also run the SFC /scannow in an admin CMD window as I suggested earlier

If all else fails you could take ownership of any Data folders (or trees) on your system drive, (the Users folder and folders under it can actually be owned by the main user without serious issues, but do not do anything with things like the Windows folder, the program files folder(s) or other non data folders

 

[tkmops]

Taking 'Ownership' questions

Yes, I've already done the chkdsk thing...but I just did it again...using both methods...via DOS, and the right-click on the drive, properties, tools, check now(unclick both boxes)...all drives came back with 'no problems'.
I'm currently running a SFC /scannow....seems to be stuck at 85%. Does this scan just my 'C' drive, or all the drives in my PC?(besides my main 'C', I have 3 internal data drives, and 4 external drives). If it's scanning all the drives, it could take awhile. Will post back later after something happens.

 

[Barman58]

SFC stands for System File Checker so it should only ever Access the system drive, It is designed to check that all system files in the OS are compatible with each other and will take the correct ones from either the internal OS store or from the net if needed.

These files may be changed by program installers that must have xxx.xxx V.xxx of a system file, so it loads and registers this file, unfortunately this may be an older version than is required by the OS and other applications so can cause issues. SFC uses various techniques including symbolic links, to give each program access to the file it needs

Due to this way of working it can sometimes take a little while, or perhaps long while is more appropriate

 

[tkmops]

Taking 'Ownership' questions

Latest findings:ran chkdsk on my 3 'C' drives(one is my main 'C', one is an old HD, one is an old SSD drive),
all finished OK. Did a sfc /scannow on all three 'C' drives, all ran OK.

As per the Trend tech, I changed the ownership of my old HD to Administrators(Tod-PC\Administrators), and ran the chkdsk and sfc again...both ran OK.

Then Trend hung at 26% scanning my old HD(E) drive.

Emailed this to the Trend tech...waiting for a response.

Thanks everyone for all your help...will post back when I have more info.

 

[tkmops]

Taking 'Ownership' questions

Latest news:The Trend tech wanted to know exactly what file Trend was hanging on...I told him, along with the fact that when I scanned just that file, Trend ran OK.

Then I ran a scan using right-click on the drive(instead of using the Trend interface), and it hung.

Then I ran a scan on just the file it hung on, and it ran OK.

So, I asked the Trend tech why does Trend hang when running scans on whole drive, but works OK when scanning individual files. Waiting for response....

 

[ethel]

account permissions

Hello tkmops, I only run the scans from the Trend Console, and it does only take a couple of minutes to

scan the whole drive. I run a quick scan each day, and a full scan once a week. I received an email from

Trend Micro last week to download the free upgrade due to the WannaCry business. I have downloaded it,

and it uninstalls your current version and installs the new version, but your tech has probably already told

you about it.

 

[tkmops]

Taking 'Ownership' questions

Yes, I have the latest update. Not sure if this is related or not, but WMP is not working again. I've tried to change the owner of my old PC 'C'(E) drive back to 'TrustedInstaller', it comes up with 'name cannot be found'. How can I change this back?

 

[tkmops]

I googled how to do this and was able to use NT SERVICE\TrustedInstaller to put my E drive back to TrustedInstaller owner. WMP still won't work, maybe it will take a reboot? Will post back later...

 

[tkmops]

taking ownership?

After many hours of un-installing/installing, research, this is what happened:

1) I uninstalled Trend
2) uninstalled Mal-Ware Bytes...I didn't know I had this, as there was no desktop, or task bar icon.
3) Noticed that 'TrustedInstaller' was 'stopped' in task manager/services, at first, I got 'unable to start service', but after a few trys, it started.
4) Re-installed Trend, and a 'C' scan to completion(first time in 5 weeks)
5) Re-installed Mal-Ware Bytes, ran a 'C' scan OK
6) Ran another Trend 'C' scan...it hung.

So, it seems that Trend work fine by itself, but hangs when Mal-Ware Bytes is running.

7) Un-installed both Trend and Mal-Ware Bytes
8) Installed Mal-Ware Bytes first this time, then...
9) Installed Trend.
10) Ran a Trend 'C' scan, it hung.

Not sure why this is happening now, as I've had Trend and Mal-Ware Bytes(unknown to me) running for years. Maybe one of the Trend updates has made it impossible to work with
Mal-Ware Bytes?

So, after all this, I have just Mal-Ware Bytes running. I have about 6 months left on my Trend subscription, but it's only about $18...so no big deal.

My two questions now are:should I have 'TrustedInstaller' stopped, or running in Task Manager\services? And, is just having Mal-Ware Bytes(Premium 3.1.2) going to be sufficient protection?

(Latest:'TrustInstaller in Task Manager\Services is Stopped, and I get 'Access Denied' when trying to start it...is this a concern?)

For every scan Mal-Ware Bytes checks for updates, pre-scan operations, scan for rootkits, scan memory, scan startup files, scan registry, scan file system, and Heuristics Analysis.

In the Mal-Ware Bytes dashboard, it has:Web Protection On, Exploit protection On, Malware protection On, and Ransomware protection On.

If just running Mal-Ware Bytes is not going to be enough protect, can the forum community recommend a anti-virus-mal-ware-ransomware/internet protection product? OK if paid.

According the Mal-Ware Bytes web site, it does this:
Protects you from advanced (zero-day) threats, including ransom-ware, so you can surf the Web without worry
Removes all traces of malware for complete safety
Removes potentially unwanted programs (PUPs) that make your computer run poorly
Scans fast so you don't have to sit around and wait for your security to finish working
Easy to use, just set it and forget it
Can replace antivirus or run alongside other antivirus programs(eh, this part not true)