Windows user security privilege nightmare.

[scotteeo]

While I was modifying the security privileges in windows 7 to delete certain files I somehow managed to set my entire c:\ drive privileges to block Users. Now Even though i have administrator access I can not access any data on the main hard drive. In fact windows itself can not open and run some of its most basic functions. I tried using the cmd command prompt icacls to fix the issue but this failed and no matter how many times tried to change the permissions for anything on the c:\ drive it resulted in "access denied". I do not have a restore point in windows to go back to nor do I have a back up disk to reinstall windows. I have absolutly no clue what to do. The drive is so blocked Im not even able to run most of the basic startup programs. many of the programs that modify settings in the control panel dont even work. Like changing the system local or creating and modifying users.

 

[scotteeo]

I would highly recommend that you create a restore point before making changes to a file, folder, drive, or registry key permission [COLOR=#3485bd !important][COLOR=#3485bd !important]settings[/COLOR]. This way if you make a mistake and lock (access denied) yourself out of the item, you will be able to do a system restore at boot and select the restore point to undo the mistake.

• Be sure to not deny permissions to or remove your user account for the file, folder, drive, or registry key. Doing so could prevent you from having access to the item.
• Be sure to not deny permissions to the Everyone group for the file, folder, drive, or registry key. This will also include your user account.
• Be sure to not deny permissions to or remove TrustedInstaller, LOCAL SERVICE, RESTRICTED, SERVICE, or SYSTEM if listed. Doing so will prevent Windows 7 from having access, and will cause Windows 7 to not run properly afterwards.

Hehe silly me i wish id not done this. heh i guess im screwed. Seeing as I didnt affect the administrators portion or the portion with my account name directly on it I should still be able to access my hard drive. Id call this a glitch or a problem with the software but still my idiot mistake. Problem is I dont have windows to reload onto my computer.

 

[EKMantis]

Possible Fix

I am not sure if this will solve your problem or not, but I made a batch file to give permissions back. You will need to right click on the batch file and click edit. For the last four rows, replace "xxxx" with your username. After you have done that, save it and run the batch file. I would try right clicking on it and clicking "run as administrator" first. If it has 0 successful keys, then try to just run it normally. hope it helps, and good luck!

-Mantis

 

[logicearth]

Users part of the "Administrators" group are still part of the "Users" group. Denying the "Users" group will prevent all Users, because, everyone is part of that group. You really should leave permissions alone, there is no reason to change them. If they need to be changed then it should be done so by one with knowledge on the internals.

 

[scotteeo]

Thank You for the effort mantis. I'm pretty well convinced that this is a hopeless endeavor. I just need to format and reinstall. Although the problem is minor as I have a second hard drive that contains most all of my personal files. All I really need is a windows install disk so I can reboot. I had already tried using similar cmd commands to fix the problem. When I was modifying privileges I had assumed that the administrator account would super cede any others. It does not make sense that they would tie up the whole system under users and make the windows system itself not be able to run basic windows programs. I cant even get into the administration programs that have power to change the system.
I was experimenting with the system itself. I never had this problem with xp, no matter what the security issue was I could always run in safe mode as an admin and fix anything using cmd or run. It all started when I found some unwanted files on my computer I could not delete. I was helping a friend transfer music from his Zune and some of those files ended up on my computer. I found I needed to take ownership of them to delete them. When I attempted the simplest route through just right clicking on the file that failed. So i went into cmd to edit it. I looked up the proper string online and in the help. Ultimately ending up with this problem.

I personally feel this is a flaw in the system. Though you are correct there is usually really no reason to even play with these settings anyways.

I am sorry to have troubled you. Windows 7 support refused to give help due to the fact that this operating system came factory installed on my laptop. They referred me to its manufacturers help line. When I wrote asus an email they promptly ignored it for several days until they removed it all together. All I asked for was a copy of the windows software so I can reboot my system. When I found your forums I thought there might be a shred of hope.

Still it is just a minor nuisance I am still able to use most everything I normally use. As far as saving and deleteing I can use my alternate drive.

 

[EKMantis]

Sorry that didn't help you. Beyond that, have you tried slaving the hdd into another system and changing the ownership/permissions from there? (Kind of a last resort as this can cause problems as well...)

-Mantis

 

[logicearth]

Open up the security dialog of the C drive, I want to see what it is you have done. Right now I'm assuming you set "DENY" something to the Users group. I need to know what.

For the record, the flaw is in the user not the system.
NTFS permissions have not changed since Windows 2000.

 

[scotteeo]

Your right I did set deny to the users group. which i thought was initially clear. Also I cant even view the security privileges on the drive. Instead it has an administration prompt blocking its view. I can click the admin button to try to gain access but it just says access denied. No worries I'm just going to format and reboot. That seems to be the simplest of solutions. Just need to make an ISO and burn it onto a DVD.


so I can get you a screen shot but it wont be of the actual security privileges for each account. I am not allowed to see that.


Still why would anything be able to block the admin other then directly blocking the admin. I mean really. come on. Seems like there is no need for that account in the first place. To have 5 separate accounts then one generic one that ties them all together. JUST UGGHHH
Then not creating a way for users to easily rectify the problem when it has the potential to happen all the time.


somewhere Bill gates is heckling into a monitor of me bashing my head into a wall.


I was just an idiot not to make a restore point or a DVD backup. The asus software during my first boot even recommended making a DVD back up. I was just too lazy to do it.


I would slave it under another system and change the privileges but I don't have another system to do it with. Rather then load my alternate with an operating system I might as well format and reboot. Its no big deal though I stored pretty much everything on my alt and any games and software can just be re downloaded and installed. Also I don't even think I have two hard drives. I think they might be two separate partitions. I never even bothered to check.


I don't feel there is a need to take a screen shot. Problem is pretty cut and dry. I'm going to the pirate bay to download the windows 7 home pro ISO then i will make a boot disk and reinstall using my legit CD key.

Before I had this laptop I built my own system and a friend gave me one of his developer copies of windows 7 Ult. I prefered the subtle differences of that version of the system.