NTFS Permissions on System Folders in Vista

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

How does one go about modifying the persmissions on a system folder in Vista?
I have an application that, after installing, I need to add a user to the
System32 folder.

I'm logged in as a local admin and have UAC on, but the Add button is greyed
out if I go into Properties-->Security-->Edit.

How do I do this? Any help would be much appreciated.
 
Todd Bowlsby said:
How does one go about modifying the persmissions on a system folder in
Vista?
I have an application that, after installing, I need to add a user to the
System32 folder.

I'm logged in as a local admin and have UAC on, but the Add button is
greyed
out if I go into Properties-->Security-->Edit.

How do I do this? Any help would be much appreciated.


A better solution would be to only change the NTFS permissions for the files
used by the application. You can use the icacls command from an elevated
command prompt to change folder or file permissions. You can also change the
permissions from an elevated Windows Explorer but the method to run an
elevated Explorer is convoluted at best. Right click on Command Prompt in
the Start Menu. Pick Run as Administrator from the popup menu. In the
elevated command prompt type icacls /? for instructions on it's use.
 
Kerry:

Thanks for the reply. Isn't there an easier way to modify the rights to a
system folder? I have no idea how to use the icacls command. I also have no
idea which files are being used by the program.
 
I wouldn't modify the permissions for the system32 folder. You would
seriously compromise the security of the computer. There is a reason it is
hard to modify them.

Have you tried the combination of using compatibility mode and Run as
administrator to get the program to work? Browse to the EXE file that starts
the program. Right click on it. Click on the Compatibility tab. Set the
compatibility mode for XP SP2 and tick Run this program as an administrator.
Note that every time you start the program you will get a UAC prompt. Don't
turn off UAC as this may actually have the opposite effect and cause the
program to fail when using the compatibility settings.
 
Kerry:

I understand that changing the permissions on a system file can pose serious
security issues, and I appreciate your concern. However, the particular
application I'm attempting to run is a browser-based application that I sell
and I need to be able to demo it.

Can you please just tell me how I can go about modifying the permissions on
a system folder? I have no problem with the security risks, since this is a
demo laptop devoted to this purpose.

Thanks for all of your help.
 
When a customer installs it will they also have to change the permissions on
the system folder? If this is the case it is a very poorly designed
application and will surely run into other problems even if you manage to
change the permissions.

I've never tried it on a system folder but the icacls command should work.
Read my first post. Here's a link to a batch command that can be used to
grant ownership and full permissions to any folder. I really think this is
bad idea. If you can't figure it out from the help I've given you then you
really shouldn't be messing with this stuff.
 
Todd Bowlsby said:
Kerry:

I understand that changing the permissions on a system file can pose
serious
security issues, and I appreciate your concern. However, the particular
application I'm attempting to run is a browser-based application that I
sell
and I need to be able to demo it.


Are you planning on telling any prospective customers that they'll have
to compromise the security of their computers if they buy that product? If
the product cannot be "demonstrated" without compromising security, how can
it ever safely be used?


--
Bruce Chambers

Help us help you:



They that can give up essential liberty to obtain a little temporary safety
deserve neither liberty nor safety. -Benjamin Franklin

Many people would rather die than think; in fact, most do. -Bertrand Russell
 
Hi Kerry,

Regarding the line of text below that I have taken from your reply to Todd,
should the 'run as Administrator' option work when I get "file access is
denied. You don't have the required permission etc" message when attempting
to import my exported .pst files back into the same (personal) folders, in
the same application (Outlook 2003) on the same pc (Windows Vista Home
Premuim) that they were exported from when they were stored on either a FAT32
external USB2 hard drive or an NTFS external USB2 hard drive? There is no
such option when right clicking the Outlook 2003 icon on my Vista desktop but
there was on both THAT 'desktop icon' as well as on the little 'quick launch
icon?' before mistakenly deleted it from the taskbar (close to the other four
that are found near to the 'start' orb)

I am the owner of the pc, the only user, and only ever loged on as an
Administrator (password protected), so as I am a novice home user (despite
having had use of, (and having had no such problems with them) for a whole
three and a half years, three different versions of Office Outlook - 2000,
2002, 2003), I can't understand why I am denied access to my own files nor
how to get that access. As I have changed the original 'permissions' settings
in the security tab in my half assed attempt to get access and none of the
changes have helped I don't know how to get them back to the default and
start again when I eventually do (or IF I ever) get the right instructions.

Bob

:

Have you tried the combination of using compatibility mode and Run as
administrator to get the program to work?
 
Hi Kerry,

Regarding the line of text below that I have taken from your reply to Todd,
should the 'run as Administrator' option work when I get "file access is
denied. You don't have the required permission etc" message when attempting
to import my exported .pst files back into the same (personal) folders, in
the same application (Outlook 2003) on the same pc (Windows Vista Home
Premuim) that they were exported from when they were stored on either a FAT32
external USB2 hard drive or an NTFS external USB2 hard drive? There is no
such option when right clicking the Outlook 2003 icon on my Vista desktop but
there was on both THAT 'desktop icon' as well as on the little 'quick launch
icon?' before mistakenly deleted it from the taskbar (close to the other four
that are found near to the 'start' orb)

I am the owner of the pc, the only user, and only ever loged on as an
Administrator (password protected), so as I am a novice home user (despite
having had use of, (and having had no such problems with them) for a whole
three and a half years, three different versions of Office Outlook - 2000,
2002, 2003), I can't understand why I am denied access to my own files nor
how to get that access. As I have changed the original 'permissions' settings
in the security tab in my half assed attempt to get access and none of the
changes have helped I don't know how to get them back to the default and
start again when I eventually do (or IF I ever) get the right instructions.

Bob

File access is DIFFERENT than program access.

Using Vista if you've used XP or earlier versions of Windows before,
requires a small bit of unlearning. Forgot what you understood about
Administrative rights in earlier versions.

Because of the poor implementation of UAC (User Account Control) if
turned on Vista will act like a gatekeeper trying to defend the
system. Like most things Microsoft comes up with it is not thought
through, is needlessly bloated, adding layer upon layer of clumsy code
that slows the whole system down and worse of all was just dumped on
users without warning, so for many it was a rude awakening that they
could not longer access THEIR files. That's because they no longer are
your files in Vista's mind, but they belong to a particular owner
which you may need to change to match the user you logged in as.

Two ways to work around UAC.

1. Just turn the much cursed "feature" off (easy way)
2. Think like Vista thinks

If you want to keep UAC on to get some of the minimal benefits it
provides behind the scenes look at your system like Vista does.

What's new in Vista is it claims your root drive. If you look at the
left pane when your open up Windows Explorer you'll see a tiny Windows
icon next to your root (typically C) drive. This is Vista's way of
saying hands off, this drive is mine and I don't want you writing to
it. EXCEPT to the folders that come pre installed under each user you
set up like pictures, documents, etc..

If you must, then do not write directly to the drive itself, first
create new folders THEN take ownership of them. This is a murky topic
that has roots in UNIX. Generally, whatever creates a file originally
has ownership of it and the necessary permissions to do whatever is
necessary. The OS itself can "own" files, so can devices,
applications, but you can take ownership.

What confuses lots of people use to being an Administrator in XP where
they could do almost anything, Vista couldn't care less IF a file has
a different owner so being an administrator means nothing, it thinks
hey user X you don't own the file, the owner is "Y" so I'm not
granting you permission to access that file or I've limited what you
can do with the file.

So the hurdle you need to jump over is telling Vista you are the owner
of your hard drives, folders and files you want to control. Since you
don't need to "own" the operating system, best not to mess with any
permissions on your root drive.

Look at the "owner" as the user. So if you are the only user of the
system then you want to "own" everything, (exclusive of what Vista
claims in the root drive) while if you have multiple users on the
system each may own different things.

If you let Vista have your root drive like it wants (recommended) then
it should be smooth sailing more or less. Go to each of your non root
drives, D, E, F, G, whatever, and right click on it, then properties,
then security tab. Under Group or Users names there should be a list
of users. If you only set yourself up that's all that needs to be
there. If you don't see your log on "user" name listed, then you need
to add it. Click Edit, then the Add button. Follow on screen prompts.

Once you do see an entry in the previous window under group or user
names, highlight it, then make sure EVERYTHING in the allow column has
a check mark, press apply, then ok.

Now you "own" the drive and in theory any folder and files in it
should inherit the "rights" or ownerships/permission you just gave it
every time you log on as the user. In practice it doesn't always
work, but should in most cases. Repeat for all your other drives and
you should tame the UAC nag screens to a reasonable level with Vista
no longer nagging as much.
 
Hello Adam,

Ta for the info. I have already tried in my amateurish way most if not all
of what you suggested, but like you said it doesn't always work, like usually
in my case it's more likely I don't understand fully what I am looking at and
selecting/unselecting the wrong thing thereby ending up where I am now. But
anyway I am sure I will (hopefully) figure it out eventually.

Bob
 
Hello Adam,

Ta for the info. I have already tried in my amateurish way most if not all
of what you suggested, but like you said it doesn't always work, like usually
in my case it's more likely I don't understand fully what I am looking at and
selecting/unselecting the wrong thing thereby ending up where I am now. But
anyway I am sure I will (hopefully) figure it out eventually.

For what it's worth, I haven't figured it all out either. I did an
install in place (installed Vista over XP since I got about a million
files literally) and a few folders still have messed up permissions
that remain grayed out and nothing I've tried cures it.

While long (little over an hour) it is a very interesting presentation
from the two Microsoft employees that came up with UAC.

http://channel9.msdn.com/ShowForum.aspx?ForumID=14&TagID=9

Watch UAC, What, How, Why.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Back
Top