Admin Account Lockout

[Guest]

I have 2 accounts set up on my laptop – One for me as an administrator and
the other for the kids. When I set up the accounts, I restricted the kids’
account from having access to the C: drive. They saved everything to the D:
drive. Now, yesterday, I all of a sudden do not have access to the C: drive
as the administrator. Every time I try to access something on the C: drive
it pops up a window saying, “access denied.†What has caused this? There
have been no changes made to any security settings.
I read a possible solution by a Microsoft MVP

What do I do: I can no longer log in or elevate to an administrator account
http://www.jimmah.com/vista/

And I went through and completed all 3 options listed. On option 3 I was
able to unhide the “hidden administrator†account. But as I logged on as the
administrator and tried to fix whatever problems were with MY admin profile,
that account was denied access to the C: drive as well. If anyone knows a
workaround or a perm solution to this problem, I would greatly appreciate it.
I am running Windows Vista Home Premium.

 

[James Matthews]

no idea

 

[Jimmy Brush]

Hello,

It sounds like you may have accidentally denied yourself access to the C:
drive as well.

How did you deny your kids access to drive C:?

If you used the security tab, added a permission for the users group, and
selected deny, then this would have denied anyone who is a user, including
administrators.

In windows, deny permissions are always evaluated before allow permissions,
so any relevent deny permissions cause an immediate access denied regardless
of what allow permissions on there.

If you can tell us exactly what permissions you set/changed and on what
folders and what options you chose when doing so, we may be able to fix
this.

 

[Guest]

Jimmy,
When I initially set up the accounts, I only selected the Kids' account in
the security tab of the C: drive properties. I checked off, from the list of
what they could and could not do, they did have read access to the C: drive,
but no other access. Now if I try to go back in, under any of the accounts
and look at the security settings for the C: drive....it doesn't show
me...just says that you have to be an administrator to view and make changes.
I understand what you're thinking about maybe I accidentally denied myself
access and any subsequent accounts. But no changes have been made and the
issue only occurred when the kids logged off and I logged onto my
account....the system pretty much stays on 24/7.
If I go back to a backup point, let's say, 2 months ago...will this clear
the issue? I would rather not, but I have my doubts that I could even do
that because of this issue? Thanks again for your help.

 

[Jimmy Brush]

Ok, some more questions.

- Do you have a Windows Setup DVD?
- When you were changing permissions, were you in the normal "edit" screen
on the security tab or did you click the advanced button?
- If you went to the advanced screen, did you create the permissions here,
and did you check 'Replace all existing inheritable...."
- What did you do with the permissions that were already there?
- Did you add any other permissions besides the one for the kids?
- Did you change/remove any pre-existing permissions?
- Did you check any boxes for Deny?
- How long ago did you change permissions?
- When your kids logged off and you logged on, was this the first time you
had tried to access drive c?
- Which drive is Windows installed on, c or d?
- Do the kids have read access to drive c? If so, you should be able to use
their account to look at the security permissions.

I'm not sure if system restore will restore the permissions. You should be
able to get to system restore as long as it is not located in a restricted
portion of the c drive.

 

[Guest]

Yes. I have the Windows OEM DVD that came with the laptop.
When I was setup the permissions, I'm pretty sure I was in the normal edit
screen.
I can't even look at the permissions for the c: drive from any of the
available accounts right now.
From what I can recall of the settings for the Kids' account:
1. I right clicked on the drive.
2. Security Tab
3. Edit button under "Group or user names"
4. Highlighted Kristin(hom-PC/Kristin) account
5. Under the Permissions for Kristin
Full Control Deny
Modify Deny
Read & execute Allow
List folder contents Allow
Read Allow
Write Deny
Special permissions Nothing checked

I set the permissions up back in August. And until the other day have never
had any issues with
accessing anything from my 'Admin' account.
I have not made any changes to the accounts since I first set them up.
This was NOT the first time I had tried to access the c: drive.
Windows is installed on c: drive. D: drive is just a data drive. E: is the
DVD drive.
Thanks for your help, but I am afraid this is a lost cause. If you have no
further advice, I will try to
restore the system back a few weeks, I'm just afraid this may cause more
problems down the road. Thanks
again.

 

[Jimmy Brush]

Hello,

I would try these steps before system restore. Even though you are denied
access to the C drive, as an administrator you have a "back door" into the
files.

Instructions:

- Right-click drive c
- click properties
- click the security tab
- click advanced
- click the owner tab
- click the edit button
- click Administrators under change owner to
- DO NOT select 'replace owner on all subcontainers and objects'
- click ok
- Click OK on all the open windows to competely close out the properties
windows, like the message says
- Go back into drive c properties
- click the security tab
- click the "continue" button under the "To continue you must be an
administrative user..." message
- You can now modify the permissions on the object

You should now be able to fix the permissions.

Here are the default permissions:

Authenticated users: Allow Special permissions (you can't set this thru this
screen... if this is not what authenticated users looks like, please reply
back for specific instructions on how to fix)

System: Allow full control (all allow boxes checked)

Administrators: Allow Full control (all allow boxes checked)

Users: Allow Read & execute, List folder contents, Read

Feel free to post what permissions you see for more specific advice.

Also a WARNING about system restore: It can delete documents and files that
are not in your user profile folders. You should back up your data drive
before using system restore, just in case, although system restore should
let you 'undo' a system restore.

More information on ownership in windows:

In Windows, in almost all cases, owners of files are allowed to look at and
change permissions on the files that they own, regardless of what the
security permissions are for the file. This prevents an owner of a file
from accidently locking themself out of a file.

By default, windows grants administrators the special ability to take
ownership of files by assigning the administrators group as the owner of the
file. This allows administrators to gain access to any file, even if they
are not allowed access to it by the securtiy permissions, by first taking
ownership of the file and then using the magical ownership 'change
permission' ability to grant themself permission to the file.

 

[Petar]

Hi,

i have the same problem

when i browse c:\ vista(home premium) tell mi acces not denied

i chack all contorl deny in my administrator.I try everyting what you
written but not do

pleace HELP

 

[Wes]

hi, I have this same problem and did almost exactly what this guy did,
although my acces to C drive was denied RIGHT after I did it. anyway I
followed the instructions that you've listed but I come to a screeching halt
when you said "click the edit button". when I clicked it, the same error like
always came up saying "access denied". Please tell me if there is a different
way to get by this.