[QuickCate]

Hi! Can anyone help me please! We had a security issue and had to quickly deny access to C drive on a Vista Home premium machine. I assumed standard administrator had full admin rights - but no. Now I'm locked out of the hard drive © and user accounts are denied any access I've tried changing permissions, taking ownership of C and D drives, all access is denied. Then I tried getting into cmd as administrator but cmd access denied too. In cmd if I try and type net user administrator /active:yes, I get 'access is denied.' If I try net user administrator (password) or anything else at all I get Error message System error 5 has occured. Access is denied. My company does not have Vista original installation disks - SOS can anyone help please?

[Advertisements]

By your phrasing I am assuming that this machine is used within a company environment and it may well be that the company systems administrator has still not allowed access to that drive because of the security breach.

I would contact them with regard to this matter.

[Wolfeymole]

By your phrasing I am assuming that this machine is used within a company environment and it may well be that the company systems administrator has still not allowed access to that drive because of the security breach.

I would contact them with regard to this matter.

[tom982]

As an administrator, you have the rights to take ownership of any file on the system and as the owner of a file, you can freely set the permissions to whatever you wish. So you will have access to all of your files, but you may not be doing it right.

How did you deny access to the whole drive? Did you set advanced permissions on C: and set everything to inherit their permissions off that?

[Wolfeymole]

In a domestic situation you'd be right Tom but this issue is clearly not a domestic situation and to my mind any fully qualified systems administrator would be able to set policy across the entire Intranet with regard to access by individuals at any given time until the security breach was rectified.

Would you agree?

[tom982]

I completely agree and reading back over my last post, I didn't make my intentions very clear at all! The reason I asked about how the access was denied was because if it was done through inheritance on C:, or deny ACEs on each individual file, then it isn't reversible (unless all of the DACLs were backed up prior to changing permissions). If it is a policy, then, as you said, the system administrator should be able to restore any access problems.

[Wolfeymole]

I completely agree on your last sentence that this is the scenario because the OP has not replied.

I had occasion once to work on an NHS Intranet and that was locked down tighter than a Camels botty in a sand storm and only a select few were allowed access to the Internet.

[tom982]

I've done quite a lot of work experience in the NHS as I want to study Medicine and completely understand where you're coming from! There was always someone complaining about the computers There was one piece of software that they took a particular disliking to but the name escapes me, it was a few years ago now.

[QuickCate]

Hi guys. Thanks for your views. I think I may have given you an incorrect impression. The computer in question is not part of any system or company network. It is a stand alone Vista Home machine used in a shop. I am the only one of the three of us in the company that knows anything about computers, so I am in charge of all our IT and systems administration. Sorry I didn't reply earlier but I don't usually work at weekends and its a public holiday here in Australia tomorrow! The issue is the comp had two users - an Administrator and a standard user. When I deleted the standard user I naturally assumed the administratort had full administrator rights - but I was wrong. I changed the ownership of the C drive to the administrator, which has now resulted the C drive totally denying access, user account controls are access denied etc. So I tried to activate Vista's 'full' administrator which is usually hidden, by going thru cmd, but it won't allow me to use cmd as an administrator. I've tried booting in safe mode, and using Vista recovery CD, but it won't allow any changes or access to C drive , so won't boot from recovery CD. Does this make the situation clearer? Many thanks again...!

[tom982]

Hi QuickCate,

• Open your start menu and click Computer
• Right-click on C:\ and select Properties:
• Under the Security tab, click Advanced.

Can you take a screenshot of this window and attach it to your next post please?

Tom

P.S. Please ignore this, I'm just saving it here in case we need it later. Do not, under any circumstances, run this fix yet! It will restore access to your disk but will completely destroy the whole Windows security model in the process and the only way to recover from this is to perform a clean install. I don't yet know if it will come to this or not

Spoiler

Modify File/Folder Permissions

• Open your start menu and click Computer
• Right-click on C:\ and select Properties:
• Under the Security tab, click Advanced.
• Under the Owner tab, click Edit.
• Click "Other Users and Groups".
• Click Advanced.
• Click "Find Now".
• Scroll down and double click on Everyone.
• Click OK TWO times.
• Tick Replace owner on subcontainers and objects
• Click OK
• Click on the Permissions tab.
• Under type Deny, single click on any entries and click Remove. (N.B.: There may not be any Deny entries, in which case just ignore this step. Just remove any that do exist)
• Click Change Permissions.
• Click Add.
• Click Advanced.
• Click "Find Now".
• Scroll down and double click on Everyone.
• Click OK.
• Single click on Everyone and then tick the "Full Control" box under Allow.
• Click OK.
• Tick Replace all child permissions with inheritable permissions from this object
• Click OK TWO times.

[QuickCate]

Hi Tom, I'll follow your advice when I'm in work tomorrow, but can tell you what it looks like. It says 'unable to display current owner'. The name of the comp does show on box below, but attempts to allocate ownership to comp owner are denied. All other options in Advanced are greyed out showing Windows lock shield. Sorry I'm replying from my iphone on day off.

[tom982]

Hi QuickCate,

No problem! Enjoy your day off!

I would just like to check Windows recognises you as an Administrator before we go ahead with my fix:

Command Prompt

Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.

• Click on the Start button and in the search box, type Command Prompt
• When you see Command Prompt on the list, right-click on it and select Run as administrator
• When command prompt opens, copy and paste the following commands into it, press enter after each
  
  net localgroup administrators
  
  
• Right-click on the Command Prompt window and click Select All, this will invert all of the colours by selecting the text, now press enter. All of this text is now copied.
• Paste (Ctrl+V) it into your next post please.

Tom

Edited by tom982, 09 June 2013 - 05:21 PM.

[QuickCate]

Hi Tom. Tks again for yr time. My whole issue is that the comp doesn't recognise me as an administrator. My user account (the only one there is) says I 'm an administrator, but I'm not. This is a well documented issue with Vista Home so I'm searching for a workaround. Tried the cmd option, tried safe mode to get cmd, tried to boot from recovery disk and USB, all access denied. Any other ideas? Cheers , Cate

[tom982]

Hi Cate,

Can you follow my instructions here please? Perhaps I wasn't clear in the way I used 'fix' as we're talking about two fixes at the same time.

http://www.geekstogo...ost__p__2302828

Tom

[QuickCate]

Hi Tom, here's screen shot as requested.
Microsoft Windows [Version 6.0.6001]
Copyright © 2006 Microsoft Corporation. All rights reserved.

C:\Users\The Pool and Spa Sho>net localgroup administrators
Alias name administrators
Comment Administrators have complete and unrestricted access to the compu
ter/domain

Members

-------------------------------------------------------------------------------
Administrator
The Pool and Spa Sho
The command completed successfully.


C:\Users\The Pool and Spa Sho>

[QuickCate]

However, when I right-clicked on cmd and selected run as administrator, got the message:

C:\Windows\System32\cmd.exe

The parameter is incorrect