Problem With Mixed Up Permissions

Hello and thanks in advance for the help.

I noticed that I was unable to either save to or create certain files in the root of my C: drive. Upon Googling it, I learned that it was because I didn't have proper permissions assigned. I found an article on Microsoft's support site that dealt with this very issue, and they laid out a solution. They instructed that I should go into the Properties>Security>Advanced>Owner tab and select my user name (while also checking the box about "Replace owner on sub container."

Problem is, when I hit apply, I get errors when the system gets to my BitDefender folder. It gives me the error about not being able to apply security information due to access being denied. I'm assuming this has something to do with safeguards BitDefender has put in place to keep a virus from messing with it. I tried disabling it but that didn't work either.

Unfortunately, when finished, Windows gives me a notice about their being an inconsistent state among the ownerships since I couldn't finish applying them uniformly (which I have indeed verified is the case that some folders have different owners).

How do I force uniformed ownership across the board in Windows 7? Will I need a 3rd party program?

Thanks!

 

The best advice I can offer is to try to reset your Win 7 permissions to their default values and then to stop tinkering with things you do not understand.

To reset the permissions first open an elevated command prompt and then type this in. It has to be exact or you will get an error -

secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose

 

Thanks. However, I tried your suggestion and it didn't seem to work. I ran the above line of code in the Command Prompt (by right clicking it and selecting Run As Administrator ), but it just gave me a list of various commands and descriptions. It doesn't look like it actually changed anything.

Did I miss something here?

 

The /verbose argument would cause it to output its actions and the results of those actions to the screen, so it's possible it has done its job. Would need a screenshot to understand better what happened though - this isn't the sort of thing you do every day. Have you been able to ascertain whether any of the folders have or have not had their permissions changed?

Well done btw for actually getting it to work! Plenty of opportunity for syntax errors

EDIT - even better would be to right click in the command window > Select All and paste the results here, unless it's absolutely massive.

 

When I think about it, I probably learned 80% of what I know by tinkering with things I didn't understand, but never without a system image I could fall back on if I really fouled things up. That's the point I really meant to make - sorry.

 

No problem

I tried it again and strangely received a different message this time. It actually says it's running the command, but when it gets to the end it says it completed with an error. Then it tells me to consult the scesrv log(which I have attached).

Could you take a look and tell me what's wrong? I've confirmed there is no change; with some folders having this user and others having that.

Will I be able to uniform this within Windows or is there another way with a third party program if not?

 

Amen to that. If it weren't for the learning through tinkering that computing affords I'd probably still be doing everything with paper and pencil. I finally procured a second computer just so I could tinker with reckless abandon and not risk loss of important data.

For a primary computer however, I'm with Earthling in regards to system imaging. If you don't know what that is then you should definitely look into it. It's a type of backup that copies not only files but also everything you need to completely restore a computer from catastrophic software or hard drive failure, even when the computer no longer boots (things like Master Boot Records and Partition Tables).

Here's a list of some disk imaging programs.

AOMEI Backupper (freeware) http://www.backup-utility.com
Macrium Reflect (freeware) http://www.majorgeeks.com/files/details/macrium_reflect_free_edition.html
Paragon Drive Backup (freeware) http://www.majorgeeks.com/files/details/paragon_drive_backup.html
EaseUS ToDo Backup (freeware) http://www.majorgeeks.com/files/details/easeus_todo_backup_free_edition.html
O&O DiskImage Pro (shareware)** http://www.oo-software.com/en/products/oodiskimage
Acronis TrueImage (shareware) http://www.majorgeeks.com/files/details/acronis_true_image_home_2013.html
NovaStor NovaBackup (shareware) http://www.majorgeeks.com/files/details/novabackup.html

Note that all of these apps are fairly large downloads (50 - 220 MB) because each contains a "mini" version of an operating system (WinPE or Linux) that is used in creating the boot disk that provides the user access to their unbootable system during the image restoration phase.

 

If you still haven't solved this problem and you're out of ideas, you can try resetting file and registry permissions using a couple of small apps from the people at Tweaking.com. You can download them from this site using the following links:

http://www.majorgeeks.com/files/details/tweaking_com_reset_registry_permissions.html
http://www.majorgeeks.com/files/details/tweaking_com_reset_file_permissions.html

However, before you do that, you might want to chat with the Tweaking.com people on their forum at: http://www.tweaking.com/forums

To be honest, I really know very little about system permissions but these apps seem pretty safe in as far as they don't delete any existing permission but instead add permissions to unlock files.

Also, I don't know if you and Earthling are still trying to capture the output from the DOS command that he posted in this thread, but if you are then you might find the following little app useful:

http://dl.dropbox.com/u/9630161/cb-x64.zip

It's just a small command line app that allows you to pipe the output from a DOS command to the clipboard (up to 512 Kb). Very simple to use.

 

I can't interpret the log in any detail but find it a bit odd that access was denied to some folders and that others couldn't be found. It suggests that there are errors in the filing system so I suggest running chkdsk /r from a command prompt. You will then need to reboot for it to run.

Are you aware that if you succeed in applying uniform ownership across the board that you will completely negate Windows' built in security? The default permissions are there for very good reason and should not normally be tampered with. You can always override any particular access problem by activating the hidden built-in Administrator account. This is different from a user account with admin privileges and can be activated with the command net user administrator /active:yes. It gives you unlimited access to all parts of the system. You need to run it from an elevated command prompt.

@rustysavage right clicking in the command window and taking Select All puts the entire output of the command on the clipboard, no app necessary.

 

Are you saying that this is what the Tweaking.com apps do (apply uniform ownership across the board)? Or are you simply hypothesizing?

Isn't using this command and affording "unlimited access to all parts of the system" essentially the same thing as "applying uniform ownership across the board"?

Thanks, I didn't know that. I thought the right click method only copied what was showing in the command window. The cb.exe app is still useful when used in batch files.

 

I don't know anything about the Teaking.com apps. The comment was for the OP as that is what he says he wants.

It's similar to su (superuser) in Linux and is there for occasional use by those who understand the risks. Permanently running a user account in this mode would be highly inadvisable imo.

 

Thanks for all the info guys.

While I did at first open this can of worms because I thought it a bit odd I couldn't do certain things to the root of my C, at this point I don't care. I'm willing to remain limited on what I can there if it's a security precaution.

However, applying uniform privileges across the board is no longer my primary concern. I'm just as content with undoing what little I've done here and leaving it alone.

I really loved the idea of just resetting the permissions to their defaults, yet I've been unable to accomplish that. This is very much where I'd like to go with this. Any thoughts on how to accomplish that?

 

As I've said, you should open a cmd window in elevated mode and run chkdsk /r. It will require a reboot, and then run the secedit command again from an elevated command prompt. That should fix it.

 

I'm sorry but it doesn't. I've tried your suggestion in every way instructed and it has no effect. I still get that same error above about telling me to consult the log file and none of the permissions have changed.

What's my next move? I'm confident this can be done somehow.

 

The only other suggestion I have is to activate the hidden Administrator account - see #9 - and run the command after logging in as Administrator. I guess there will still be errors concerning things it cannot find, which probably won't matter as they don't exist, but it should overcome the reported permission problems.

Best I can do.

 

I think it's safe to say that absolutely nothing works. I've tried everything (including running the command from the hidden Admin account as suggested above) with zero change. I even used my Windows Repair (All-In-One) app I have installed by Tweak.com and used their top two check boxes regarding resetting the permissions for both my files and my registry. After a lengthy scanning process, I still get no results.

At this point, I'm willing to give up but I would like to get confirmation one ONE thing first:

I just checked and in my Programs Files folder alone there are four different users present. In the Security>Owner tab of some folders, I see the owner is Administrator. Others it is my specific user name. Others it's SYSTEM and finally others are what's called TrustedInstaller.

I'm experiencing no system problems regarding these permissions (accept my system takes a bit longer to boot now that I reset things using the Windows Repair (All-In-One) program). The only thing that kinda freaked me out to trouble shoot it in the first place was Windows warning message telling me that having my permissions exist in what it called an "inconsistent state" of multiple users would cause a problem. Clearly that was already the case before I ever touched it a few days ago.

So is this really an issue that's not all that big of a deal to the integrity of my system? If so, I'm fine leaving things as is.

 

That IS the default state. The only reason I have been pursuing this is that in your first post you explained that you had already changed the ownership of your C drive to your username and that you had ticked the option to apply this to sub containers. OK, you did get an error but it did seem that the change must have been applied to large numbers, if not to the majority of folders and that would have almost completely negated Windows security.

From what you are saying now it does look as if either the changes you originally made simply never took effect or that the secedit command has restored them to their original ownership. I assume you are no longer getting the warning about the ownerships being in an inconsistent state? If so either the problem never existed or we have solved it.

 

Well, I thought I'd give it one last try and put your theory to the test. I went into the Programs folder and changed the Windows Sidebar ownership from TrustedInstaller to my User Name (just to test). Then I booted into the hidden Admin account from #9 above and once again tried the reset command. When I check the same folder again I get no effect. These commands are simply not taking.

So again, I'm back to giving up. I've not seen or read anything that would suggest this is going to wreak the havoc on my system that I thought it was (unless there's something I don't know about). My system seems unaffected by the "inconsistent state" Windows warned me about. Any final thoughts?

 

OK, I shan't be recommending that in future and I don't know of any other way of resetting the permissions to default. ATM we don't really have any idea of how much if any damage may have been done, so just as a test, who is currently the owner of C:, and who is the owner of each of the C: first level subfolders? I'll then check them against mine, which is a fairly new Win 7 x64 installation and I haven't tampered with permissions at all.

 

Thanks for the help. I took a look at both my Programs folders (32 and 64 bit)and frankly, I can't really find any consistency.

I know the point was to try and compare notes between my system and yours; but the ownership seems all over the place. It's a total crap shoot in both locations as to which user will have ownership of one folder to the next (ranging from Administrator to SYSTEM to TrustedInstaller).

However, I don't think this has anything to do with anything I did; as this seems to just be the nature of Windows 7 anyway. It appears that it is normal for Windows to have this many variable ownerships applied.

So am I correct in assuming that having an "inconsistent" state in ownerships across the board is not going to be the disaster I feared? My system seems unchanged and it also seems that this was the case long before I ever touched it.

Any insight that could wrap this up would be much appreciated!

 

There is an old thread on this topic which has recently become active again from post #18. If nothing else it illustrates how poorly understood is this whole subject of permissions. However it is well worth reading.

I don't think there is anything else I can add at this point other than to confirm that it is normal for Win 7 files and folders to have several different owners. What matters from a security viewpoint is what rights of access/read/write, i.e. what Permissions the owners of those drives or folders have conferred on other users. It's far too complex for the average or even well experienced user to fully understand and is in my opinion best left untouched.

 

Yes, that was essentially the piece of mind I was looking for (regarding Windows normally having multiple permissions applied). The original dialog box warning is somewhat misleading and led me to believe that all folders should have some kind of uniformity (which clearly they do not).

All in all; I'm going to call this a done deal. My system still works great and it would appear this is a no harm, no foul issue thus far (learning to not worry about changing these kinds of things in the future in the process).

Thanks all!