Items filtered by date: December 2015

Reset a Windows User Profile permissions

This has been tested and works well on Windows 10.

Modify and run the code below from a command prompt with administrator rights.

ICACLS "I:\Users\peter" /grant Everyone:F /C /T

Quick way to reset all security permissions to default

This works for Windows Vista but it works also for windows 7. It might also work for later versions.

Some of the permissions have been changed and I would like to find a way to reset all the permissions to the default settings. Can anyone provide a quick way to reset all permissions to default?

Instructions

Just run in a evalated prompt the following command.

secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose

Links

• How do I restore security settings to a known working state?

Reset the Registry and File Permissions

This was last used by me on Windows XP. Some of this might work on later versions of Windows but has not been tested.

Occassionally the permissions on the windows registry or files become corrupt or altered. The methods below can restore access to all files and registry keys.

Programs will not install if the permissions are not correct in the registry.

SubInACL is a command-line tool that enables administrators to obtain security information about files, registry keys, and services, and transfer this information from user to user, from local or global group to group, and from domain to domain.

Instructions

Here are some steps that can be used to download and run the SubInACL tool to repair file and registry permissions that are often needed to successfully install programs on Windows, particularly for MSI-based (Windows Installer) setups:

1. Download the SubInACL tool and install it.  By default it will install to
   c:\Program Files\Windows Resource Kits\Tools
   
   Or get it from a system with SubInACL installed, can be run like a nbromal DOS program (ie same folder)
    
2. If you are running Windows Vista, click on the Start menu, choose All Programs, then Accessories, then right-click on the item named Command Prompt and choose Run as administrator
3. If you are running an OS other than Windows Vista, go to the Start menu, choose Run, type cmd and click OK
4. In the cmd prompt, type notepad reset.cmd and click yes to open Notepad.exe and create a new text file named reset.cmd
5. Copy and paste the following contents into reset.cmd
   

   cd /d "%programfiles%\Windows Resource Kits\Tools"
   
   subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f /grant=system=f /grant=restricted=r /grant=YOURUSERNAME=f /setowner=administrators > %temp%\subinacl_output.txt
   subinacl /keyreg HKEY_CURRENT_USER /grant=administrators=f /grant=system=f /grant=restricted=r /grant=YOURUSERNAME=f /setowner=administrators >> %temp%\subinacl_output.txt
   
   subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f /grant=system=f /grant=users=r /grant=everyone=r /grant=restricted=r /setowner=administrators >> %temp%\subinacl_output.txt
   subinacl /keyreg HKEY_LOCAL_MACHINE /grant=administrators=f /grant=system=f /grant=users=r /grant=everyone=r /grant=restricted=r /setowner=administrators >> %temp%\subinacl_output.txt
   
   subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f /grant=system=f /grant=users=r /setowner=administrators >> %temp%\subinacl_output.txt
   subinacl /keyreg HKEY_CLASSES_ROOT /grant=administrators=f /grant=system=f /grant=users=r /setowner=administrators >> %temp%\subinacl_output.txt
   
   
   subinacl /subdirectories %programfiles%\ /grant=administrators=f /grant=system=f /grant=users=e >> %temp%\subinacl_output.txt
   
   subinacl /subdirectories %windir%\ /grant=administrators=f /grant=system=f /grant=users=e >> %temp%\subinacl_output.txt

6. Change the values named YOURUSERNAME to be the Windows user account that you are logged in with.
   
   Note:  The YOURUSERNAME value should match the name of your user folder at c:\Documents and Settings (or c:\users on Windows Vista and higher).  You can also find the value to use for YOURUSERNAME by launching Task Manager and looking at the user name listed in the User Name column of the Processes tab.
    
7. Save and close reset.cmd.
8. In the cmd prompt, type reset.cmd and press enter to run the SubInACL tool.  This tool will take several minutes to run, and it requires that the user account you are using has administrator privileges on the system.  This is why it is necessary to run it from an elevated cmd prompt on Windows Vista.  Step 2 above can be used to start an elevated cmd prompt on Windows Vista.
9. After reset.cmd completes, try to install the product that previously failed to install correctly on your system.

Note: There are a couple of scenarios where installing or running SubInAcl can fail.  For example, some non-English versions of Windows have the name of the Administrators group translated to another language, and the command lines listed above will fail in that case.  I have posted workarounds for the issues that I know of in this separate blog post.

Also note: Running the above command lines will cause SubInAcl to create a log file named %temp%\subinacl_output.txt.  If you see any errors reported in the cmd prompt after running SubInAcl, you can look in this log file for more detailed information about what file(s), folder(s) or registry value(s) are causing the errors.  To open this log file, you can click on the Start menu, choose Run, type notepad %temp%\subinacl_output.txt and click OK.

When looking at this log file, you may see some errors reported with error code 5.  That error code means Access Denied, and it is typically caused by Windows or some other program running on your system that is holding files, folders or registry values in use so that SubInAcl is unable to update the permissions for them.  Most of the time, that type of error in the SubInAcl output can be safely ignored, but you may need to try to reboot and then manually fix the permissions for these files, folders or registry keys as a workaround.

Alternate verions of the script

subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f
subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f
subinacl /subdirectories %SystemDrive% /grant=administrators=f
subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=system=f
subinacl /subkeyreg HKEY_CURRENT_USER /grant=system=f
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=system=f
subinacl /subdirectories %SystemDrive% /grant=system=f

Using SECEDIT.EXE (for Windows XP Professional)

In Windows XP Professional, you may use the following secedit command-line to reset the file and registry permissions to defaults.

secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /verbose

For more information, see article How to reset security settings back to the defaults.

This is an alternative permissions reset method using SetACL.exe

SetACL.exe -on "C:\windows" -ot file -actn setprot -op "dacl:np;sacl:nc" -rec cont_obj -actn setowner -ownr "n:S-1-5-32-544;s:y" E:\SetACL.exe -on "C:\windows" -ot file -actn setprot -op "dacl:np;sacl:nc" -rec cont_obj -actn setowner -ownr "n:S-1-5-32-544;s:y"

Symptoms

When you open Disk Management MMC console (diskmgmt.msc), one of the following error messages may occur:

• The Logical Disk Manager service is disabled. A connection cannot be established
• Unable to connect to Logical Disk Manager service.
• The dependency service or group failed to start.
• The specified service does not exist as an installed service.
• The dependency service does not exist or has been marked for deletion.

Resolution

This happens if one of the following services are missing in the system.

• Logical Disk Manager
• Logical Disk Manager Administrative Service

To restore the missing services, use diskmgmt.reg code available at the bottom of this page and create a reg file with it. Then, right-click the file and choose Merge. Click Yes to confirm. Restart Windows and see if you're able to launch Disk Managemt MMC successfully.

diskmgmt.reg

{code class="brush: powershell"}Windows Registry Editor Version 5.00 ;REG fix to reinstate Logical Disk Manager service ;Created on February 03, 2007 by Ramesh Srinivasan ;http://www.winhelponline.com [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmadmin] "DependOnService"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,50,00,6c,00,75,00,\ 67,00,50,00,6c,00,61,00,79,00,00,00,44,00,6d,00,53,00,65,00,72,00,76,00,65,\ 00,72,00,00,00,00,00 "Type"=dword:00000020 "Start"=dword:00000003 "ErrorControl"=dword:00000001 "ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\ 74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,\ 00,6d,00,61,00,64,00,6d,00,69,00,6e,00,2e,00,65,00,78,00,65,00,20,00,2f,00,\ 63,00,6f,00,6d,00,00,00 "DisplayName"="Logical Disk Manager Administrative Service" "ObjectName"="LocalSystem" "Description"="Configures hard disk drives and volumes. The service only runs for configuration processes and then stops." [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmadmin\Enum] "0"="Root\\LEGACY_DMADMIN\\0000" "Count"=dword:00000001 "NextInstance"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmadmin\Parameters] "EnableDynamicConversionFor1394"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmserver] "DependOnService"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,50,00,6c,00,75,00,\ 67,00,50,00,6c,00,61,00,79,00,00,00,00,00 "Type"=dword:00000020 "Start"=dword:00000003 "ErrorControl"=dword:00000001 "ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\ 74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\ 00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\ 6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00 "DisplayName"="Logical Disk Manager" "ObjectName"="LocalSystem" "Description"="Detects and monitors new hard disk drives and sends disk volume information to Logical Disk Manager Administrative Service for configuration. If this service is stopped, dynamic disk status and configuration information may become out of date. If this service is disabled, any services that explicitly depend on it will fail to start." [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmserver\Parameters] "ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\ 00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\ 64,00,6d,00,73,00,65,00,72,00,76,00,65,00,72,00,2e,00,64,00,6c,00,6c,00,00,\ 00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmserver\Enum] "0"="Root\\LEGACY_DMSERVER\\0000" "Count"=dword:00000001 "NextInstance"=dword:00000001 {/code}

The problem seems to be that the ole32.dll COM object registry can be corrupted by a bad interaction between the Windows XP Restore tool and Windows Update. Maybe, it is: update (which changes ole32.dll), ..., restore, ..., re-update.

1. REGSVR32 ole32.dll
2. After that, reinstall the COM+ event classes with the control panel.
   
   
    

DCOM. I'm sure it sounded like a good idea at the time, but in the real world it generates a lot of headaches. Here's some common DCOM, COM+ and WMI errors along with some fixes. There's also some scripts and registry keys at the end of article to help automate the fixes.

CoCreateInstance Errors

Error: CoCreateInstance for APPLICATION.NAME returned 80070005

Cause: This is an access denied error. Usually this is a result of not being to launch the application on the remote server.

Resolution: You'll need to open Component Services on the remote server/workstation and modify the Access, Launch, and Configuration permissions for the particular application. If you're getting this locally, do the same.

Windows Errors

Error: You do not have access rights to Logical Disk Manager on computer

Cause: This error is the result of incorrect DCOM permissions and/or Windows Firewall settings.

Resolution: Option A If you're connecting to a remote computer, make sure you have port 135 set as an exception on both firewalls. You may also need to add dmremote.exe to the exceptions list.

1. Start-->Run, type firewall.cpl and press OK
2. Click on the Exceptions and add C:WINDOWS\system32\dmremote.exe and port 135

If that doesn't resolve it, you'll need to add some additional permissions.

1. Start-->Run, type dcomcnfg and press OK
2. Expand Component Services and then click on Computers
3. Right click on My Computer and click on Properties
4. Click on the COM Security tab
5. Under Access Permissions click on Edit Limits
6. Grant ANONYMOUS LOGON the Remote Access permission
7. Under Launch and Activation Permissions, click Edit Limits
8. Grant Everyone Remote Activation and Remote Launch permissions
9. Click OK twice and reboot the computer

Option B If its you're local PC, you'll need to correct the DCOM permissions.

1. Start-->Run, type dcomcnfg and press OK
2. Expand Component Services and then click on Computers
3. Right click on My Computer and click on Properties
4. Click on the Default Properties tab
5. Set the Default Authentication Level to Connect
6. Set the Default Impersonation Level to Identify
7. Click OK and reboot

Error: Unable to open Component Services (dcomcnfg). The MMC closes instantly as you expand Computers. This also resolves the Win32: Access Denied WMI error (see Option B above).

Cause: This is a combination of bad DCOM permissions and a messed up COM+ system. Usually this is accompanied by several COM+ errors in the event log.

Resolution: Reinstall COM+ and reset the DCOM permissions. Its a simple process.

1. Open a command prompt
2. Type ren %WinDir%\System32\Clbcatq.dll %WinDir%\System32\~Clbcatq.dll
3. Reboot the computer
4. Open regedit
5. Delete the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3
6. Open a command prompt
7. Type cd %windir%
8. Type rmdir /s Registration
9. Open Control Panel
10. Open Add/Remove Programs and then click on Add/Remove Windows Components
11. Simply click next to start the reinstall. You may need your Windows CD. If you have IIS installed, run the following command: rundll32 %windir%\system32\inetsrvwamreg.dll, CreateIISPackage
12. Reboot the computer

Useful Registry Keys

Reset DCOM Permissions - [HKEY_LOCAL_MACHINESOFTWAREMicrosoftOle]
"EnableDCOM"="Y" "LegacyAuthenticationLevel"=dword:00000002
"LegacyImpersonationLevel"=dword:00000002

Reference Articles

• How to clean up a damaged COM+ catalog - http://support.microsoft.com/kb/315296
• You cannot use the Computer Management feature on a Windows XP SP2-based computer to access Logical Disk Manager on a Windows Server 2003-based computer - http://support.microsoft.com/kb/902430

If you get the error The COM+ event classes could not be registered then do the following:

1. REGSVR32 ole32.dll
2. After that, reinstall the COM+ event classes with the control panel.

There is a wiki article with mor info if required.

If mod_rewrite module is not enabled on xammp do the following.

Also to note this procedure should be the same for many other modules.

1. Edit the httpd.conf that is located in ..\xampp\apache\conf
2. Search for "mod_rewrite". You should come to a line like this
   
   #LoadModule rewrite_module modules/mod_rewrite.so
    
3. Remove the hash sign (#) from the line. The # indicates the line is not in effect. The changed line should looks like this:
   
   LoadModule rewrite_module modules/mod_rewrite.so
    
4. Stop and restart Apache if required

The following instructions tell you how to installed Ioncube on xammp

1. Find your PHP version. You will need to know the version when you download the ionCube loaders.
2. Download ionCube loader from: http://www.ionCube.com/loaders.php
   
   Download this version: Windows (x86) -- Windows Installer  (for windows etc..)
    
3. Create a folder in ../xammp/apache/ioncube (can be any folder of your choice)
4. Extract contents of the Ioncube Loader archive in to the folder above
5. Open ../xammp/php/php.ini
6. Add the following line before any other zend_extension statements.
   
   zend_extension_ts = "D:\xampp\apache\ioncube\ioncube_loader_win_5.2.dll"
    
7. Stop and restart xammp

If successful you should now see a section in your PHP Info page that says: (just do a  page search for ioncube)

Additional Modules
Module Name ionCube Loader

These slightly revised instructions allow you to run ioncude successfully on xampp 1.7.3 and on Windows 7 64-bit

I found the solution...

This should be added to the php.ini regardless of the thread safety status:

    zend_extension = "C:\xampp\ioncube\ioncube_loader_win_5.3.dll"

This is wrong but it is in the documentation:

    zend_extension_ts = "C:\xampp\ioncube\ioncube_loader_win_5.3.dll"

It seems like zend_extension_ts does not work anymore.

Everything you need to run CURL on a XAMPP install is included in the download. Just do the following

1. Go to xampp install directory.
2. Go to ../xampp/php/php.ini (for old versions ../xammp/apache/bin/php.ini)
3. Search for curl
4. uncomment extension=php_curl.dll (remove ;)
5. Stop and start xammp if required

Here’s a neat Windows 7 trick that’s been doing the rounds on the Internet. It enables “GodMode,” a term devised by the Microsoft development team, which provides a single place to access all Windows settings without needing to browse options and folders in the Control Panel.

1. Create a new folder.
2. Rename the folder to

   GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}

   (note that you can change the “GodMode” text, but the following period and code number are essential).

3. The folder icon will change — double click it to show the GodMode window:

AD   Andorra
AE   United Arab Emirates
AF   Afghanistan
AG   Antigua and Barbuda
AI   Anguilla
AL   Albania
AM   Armenia
AN   Netherlands Antilles
AO   Angola
AQ   Antarctica
AR   Argentina
AS   American Samoa
AT   Austria
AU   Australia
AW   Aruba
AX   Aland Islands
AZ   Azerbaijan
BA   Bosnia and Herzegovina
BB   Barbados
BD   Bangladesh
BE   Belgium
BF   Burkina Faso
BG   Bulgaria
BH   Bahrain
BI   Burundi
BJ   Benin
BM   Bermuda
BN   Brunei Darussalam
BO   Bolivia
BR   Brazil
BS   Bahamas
BT   Bhutan
BV   Bouvet Island
BW   Botswana
BY   Belarus
BZ   Belize
CA   Canada
CC   Cocos (Keeling) Islands
CD   Democratic Republic of the Congo
CF   Central African Republic
CG   Congo
CH   Switzerland
CI   Cote D'Ivoire (Ivory Coast)
CK   Cook Islands
CL   Chile
CM   Cameroon
CN   China
CO   Colombia
CR   Costa Rica
CS   Serbia and Montenegro
CU   Cuba
CV   Cape Verde
CX   Christmas Island
CY   Cyprus
CZ   Czech Republic
DE   Germany
DJ   Djibouti
DK   Denmark
DM   Dominica
DO   Dominican Republic
DZ   Algeria
EC   Ecuador
EE   Estonia
EG   Egypt
EH   Western Sahara
ER   Eritrea
ES   Spain
ET   Ethiopia
FI   Finland
FJ   Fiji
FK   Falkland Islands (Malvinas)
FM   Federated States of Micronesia
FO   Faroe Islands
FR   France
FX   France, Metropolitan
GA   Gabon
GB   Great Britain (UK)
GD   Grenada
GE   Georgia
GF   French Guiana
GH   Ghana
GI   Gibraltar
GL   Greenland
GM   Gambia
GN   Guinea
GP   Guadeloupe
GQ   Equatorial Guinea
GR   Greece
GS   S. Georgia and S. Sandwich Islands
GT   Guatemala
GU   Guam
GW   Guinea-Bissau
GY   Guyana
HK   Hong Kong
HM   Heard Island and McDonald Islands
HN   Honduras
HR   Croatia (Hrvatska)
HT   Haiti
HU   Hungary
ID   Indonesia
IE   Ireland
IL   Israel
IN   India
IO   British Indian Ocean Territory
IQ   Iraq
IR   Iran
IS   Iceland
IT   Italy
JM   Jamaica
JO   Jordan
JP   Japan
KE   Kenya
KG   Kyrgyzstan
KH   Cambodia
KI   Kiribati
KM   Comoros
KN   Saint Kitts and Nevis
KP   Korea (North)
KR   Korea (South)
KW   Kuwait
KY   Cayman Islands
KZ   Kazakhstan
LA   Laos
LB   Lebanon
LC   Saint Lucia
LI   Liechtenstein
LK   Sri Lanka
LR   Liberia
LS   Lesotho
LT   Lithuania
LU   Luxembourg
LV   Latvia
LY   Libya
MA   Morocco
MC   Monaco
MD   Moldova
MG   Madagascar
MH   Marshall Islands
MK   Macedonia
ML   Mali
MM   Myanmar
MN   Mongolia
MO   Macao
MP   Northern Mariana Islands
MQ   Martinique
MR   Mauritania
MS   Montserrat
MT   Malta
MU   Mauritius
MV   Maldives
MW   Malawi
MX   Mexico
MY   Malaysia
MZ   Mozambique
NA   Namibia
NC   New Caledonia
NE   Niger
NF   Norfolk Island
NG   Nigeria
NI   Nicaragua
NL   Netherlands
NO   Norway
NP   Nepal
NR   Nauru
NU   Niue
NZ   New Zealand (Aotearoa)
OM   Oman
PA   Panama
PE   Peru
PF   French Polynesia
PG   Papua New Guinea
PH   Philippines
PK   Pakistan
PL   Poland
PM   Saint Pierre and Miquelon
PN   Pitcairn
PR   Puerto Rico
PS   Palestinian Territory
PT   Portugal
PW   Palau
PY   Paraguay
QA   Qatar
RE   Reunion
RO   Romania
RU   Russian Federation
RW   Rwanda
SA   Saudi Arabia
SB   Solomon Islands
SC   Seychelles
SD   Sudan
SE   Sweden
SG   Singapore
SH   Saint Helena
SI   Slovenia
SJ   Svalbard and Jan Mayen
SK   Slovakia
SL   Sierra Leone
SM   San Marino
SN   Senegal
SO   Somalia
SR   Suriname
ST   Sao Tome and Principe
SU   USSR (former)
SV   El Salvador
SY   Syria
SZ   Swaziland
TC   Turks and Caicos Islands
TD   Chad
TF   French Southern Territories
TG   Togo
TH   Thailand
TJ   Tajikistan
TK   Tokelau
TL   Timor-Leste
TM   Turkmenistan
TN   Tunisia
TO   Tonga
TP   East Timor
TR   Turkey
TT   Trinidad and Tobago
TV   Tuvalu
TW   Taiwan
TZ   Tanzania
UA   Ukraine
UG   Uganda
UK   United Kingdom
UM   United States Minor Outlying Islands
US   United States
UY   Uruguay
UZ   Uzbekistan
VA   Vatican City State (Holy See)
VC   Saint Vincent and the Grenadines
VE   Venezuela
VG   Virgin Islands (British)
VI   Virgin Islands (U.S.)
VN   Viet Nam
VU   Vanuatu
WF   Wallis and Futuna
WS   Samoa
YE   Yemen
YT   Mayotte
YU   Yugoslavia (former)
ZA   South Africa
ZM   Zambia
ZR   Zaire (former)
ZW   Zimbabwe
BIZ   Business
COM   Commercial
EDU   US Educational
GOV   US Government
INT   International
MIL   US Military
NET   Network
ORG   Nonprofit Organization
PRO   Professional Services
AERO   Aeronautic
ARPA   Arpanet Technical Infrastructure
COOP   Cooperative
INFO   Info Domain
NAME   Personal Name
NATO   North Atlantic Treaty Organization