Don't have the rights to save a file

Hi all,

W7 64b pro. My wifes pc has a funny thing. Permission problem. She tries
to save a pdf file which is generated on the internet. The save location
is My Documents, which is the directory My Documents on the G: drive.
This directory is in the library My Documents and is in the place of the
original \Users\Name\Documents folder on the C: drive.
She then gets the message "You don't have the rights to save files on
this location". She is the owner of that directory and has the full
rights. I already checked that. Tried several solutions I found on the
internet but nothing works so far. Even created a new library
"Downloads" but also there she doesn't have the rights to save that file.

My own pc is practically identical and organized in the same way. I
don't get this problem.

What can I do about this? Any ideas?

Fokke

On 26/01/2016 16:26, Fokke Nauta wrote:
Hi all,

W7 64b pro. My wifes pc has a funny thing. Permission problem. She tries
to save a pdf file which is generated on the internet. The save location
is My Documents, which is the directory My Documents on the G: drive.
This directory is in the library My Documents and is in the place of the
original \Users\Name\Documents folder on the C: drive.
She then gets the message "You don't have the rights to save files on
this location". She is the owner of that directory and has the full
rights. I already checked that. Tried several solutions I found on the
internet but nothing works so far. Even created a new library
"Downloads" but also there she doesn't have the rights to save that file.

My own pc is practically identical and organized in the same way. I
don't get this problem.

What can I do about this? Any ideas?

Fokke

One more thing:
Her directory G:\My Documents is always read-only. I can change that,
but it always changes back.

"Fokke Nauta" wrote in message
...
On 26/01/2016 16:26, Fokke Nauta wrote:
Hi all,

W7 64b pro. My wifes pc has a funny thing. Permission problem. She tries
to save a pdf file which is generated on the internet. The save location
is My Documents, which is the directory My Documents on the G: drive.
This directory is in the library My Documents and is in the place of the
original \Users\Name\Documents folder on the C: drive.
She then gets the message "You don't have the rights to save files on
this location". She is the owner of that directory and has the full
rights. I already checked that. Tried several solutions I found on the
internet but nothing works so far. Even created a new library
"Downloads" but also there she doesn't have the rights to save that file.

My own pc is practically identical and organized in the same way. I
don't get this problem.

What can I do about this? Any ideas?

Fokke

One more thing:
Her directory G:\My Documents is always read-only. I can change that, but
it always changes back.

Do we need to know whether you log on as Administrator or User ?
--
Don Phillipson
Carlsbad Springs
(Ottawa, Canada)

Fokke Nauta wrote:
On 26/01/2016 16:26, Fokke Nauta wrote:
Hi all,

W7 64b pro. My wifes pc has a funny thing. Permission problem. She tries
to save a pdf file which is generated on the internet. The save location
is My Documents, which is the directory My Documents on the G: drive.
This directory is in the library My Documents and is in the place of the
original \Users\Name\Documents folder on the C: drive.
She then gets the message "You don't have the rights to save files on
this location". She is the owner of that directory and has the full
rights. I already checked that. Tried several solutions I found on the
internet but nothing works so far. Even created a new library
"Downloads" but also there she doesn't have the rights to save that file.

My own pc is practically identical and organized in the same way. I
don't get this problem.

What can I do about this? Any ideas?

Fokke

One more thing:
Her directory G:\My Documents is always read-only. I can change that,
but it always changes back.

The Read-Only folder flag is an "overloaded" bit.

It indicates to Explorer, that the folder has customization
inside. A desktop.ini, with a shell32.dll value that picks
out a particular flavor of customization. For example,
your Pictures folder might need thumbnails generated,
and it might use large icons by default. And the desktop.ini
(a text file), holds the customization information. If you
enable the display of "system" files, you should magically
see the desktop.ini located in each (customized) one.

I would not "jump all over" the Read-Only bit.

*******

I'm hardly an authority on how permissions work,
but at least I can deliver some warnings. There
are ALLOW permissions and DENY permissions. It's generally
considered bad practice to sprinkle DENY permissions all
over the place, and then use inheritance. However, ALLOW is
supposed to be fair game, and is used on your regular drive.
And inheritance is also used.

You can save all the permissions on C: , using a command like this.
This command should "fail" in 62 places, every time it hits
a junction point. But otherwise, it should work. The icacls
command allows both saving and restoring permissions, and
can be used for "mop-up" work after you've made a mess. If
reapplying this to an entire drive, you modify the first line
of the ntfsCdrive.txt and put a "." entry implying current
working directory or something. This allows the very top level
of a partition to be restored. Otherwise, the syntax error in
the file, prevents a user from fixing the very top level.
Normally, people are told to be "one level above" where you
are restoring, because it's commonly believed you can't
fix the top of the partition. But if you replace the first
blank line with ".", that's supposed to fix that problem.

icacls c:\ /save "%userprofile%\Downloads\ntfsCdrive.txt" /t /c "%userprofile%\Downloads\CErr.txt" 2&1

The output consists of two line pairs. Here, I've taken
a permission line, and laid it out into its component parts.
This should match the four lines I see in the Advanced properties.

D:AI(A;OICIID;FA;;;SY) --- SYSTEM ???
(A;OICIID;FA;;;BA) --- Built-in Administrator ???
(A;OICIID;FA;;;S-1-5-21-3768549767-1934788099-1503758287-1000) --- my local account
(A;OICIID;FA;;;S-1-5-21-2394456921-3258211444-2531705128-1001) --- an account from
another OS run

Now, yes, that file has a total of four entries.
But the usage of the letter "I" to me, implies
inheritance. It means this item gets some
of its permissions from the folder above it.

The 3768549767-1934788099-1503758287 part is install specific
(each OS you install, probably gets a different random number).
The 1000 part of a SID is where the first user account
might be allocated. The more local accounts you make, that
number gets bumped. The administrator account is 500.

I don't know any more than that. I can't read one of those
things, but you can see from the shape that particular one
must be pretty simple. You should see the truly mangled ones...

I also don't think you're going to instantly figure out
what happened to G: . I have zero confidence in finding
a web recipe page that documents *everything*. Most tutorial
articles trail off into a gray vapor, telling you
"there's more..." but then of course not documenting
it. In some cases, these might be domain-level features
a user typically wouldn't be using. But I'm sure the
Gods of Random Permissions could easily use such
features for creating a road block.

I don't think the Library adds any variables. If I was doing it,
I'd probably be working on G: , as attempting to do something
at the junction point on C: probably won't work. Purely a
guess on my part, based on how icacls trips when it hits
junction points.

And in a situation like this, your problem could be above
the file itself. I expect your G: setup is so simple,
it shouldn't take long to collect the parent, the folder
below it, and some file stored in there. And study how
those might be related to one another.

some_permission ------- folder ------ folder ----- file
inherit inherit

So at the top of the icacls file for G: , you should see

blank line
permissions_string_for_G:
folder_name
permissions_of_folder_name

The blank line pair, I think that defines the top of G: but
is not labeled as such.

HTH,
Paul

On 26/01/2016 16:39, Don Phillipson wrote:
"Fokke Nauta" wrote in message
...
On 26/01/2016 16:26, Fokke Nauta wrote:
Hi all,

W7 64b pro. My wifes pc has a funny thing. Permission problem. She tries
to save a pdf file which is generated on the internet. The save location
is My Documents, which is the directory My Documents on the G: drive.
This directory is in the library My Documents and is in the place of the
original \Users\Name\Documents folder on the C: drive.
She then gets the message "You don't have the rights to save files on
this location". She is the owner of that directory and has the full
rights. I already checked that. Tried several solutions I found on the
internet but nothing works so far. Even created a new library
"Downloads" but also there she doesn't have the rights to save that file.

My own pc is practically identical and organized in the same way. I
don't get this problem.

What can I do about this? Any ideas?

Fokke

One more thing:
Her directory G:\My Documents is always read-only. I can change that, but
it always changes back.

Do we need to know whether you log on as Administrator or User ?


As a user with admin rights.

On 26/01/2016 17:25, Wolf K wrote:
On 2016-01-26 10:32, Fokke Nauta wrote:
On 26/01/2016 16:26, Fokke Nauta wrote:
Hi all,

W7 64b pro. My wifes pc has a funny thing. Permission problem. She tries
to save a pdf file which is generated on the internet. The save location
is My Documents, which is the directory My Documents on the G: drive.
This directory is in the library My Documents and is in the place of the
original \Users\Name\Documents folder on the C: drive.
She then gets the message "You don't have the rights to save files on
this location". She is the owner of that directory and has the full
rights. I already checked that. Tried several solutions I found on the
internet but nothing works so far. Even created a new library
"Downloads" but also there she doesn't have the rights to save that
file.

My own pc is practically identical and organized in the same way. I
don't get this problem.

What can I do about this? Any ideas?

Fokke

One more thing:
Her directory G:\My Documents is always read-only. I can change that,
but it always changes back.

That's the default (also for Downloads, or any other downloads folder
you create), so it's not surprising that a reboot resets it.

You may be able to make the changes stick by invoking the real (hidden)
administrator account:

http://www.howtogeek.com/howto/windo...windows-vista/


Be careful: this account can make changes that Windows otherwise prevents.

HTH


Thanks.
I will give this a try.
I will use GigaTweaker 3 to reveal the real admin account.
I'll come back on this.

On 26/01/2016 20:18, Fokke Nauta wrote:
On 26/01/2016 17:25, Wolf K wrote:
On 2016-01-26 10:32, Fokke Nauta wrote:
On 26/01/2016 16:26, Fokke Nauta wrote:
Hi all,

W7 64b pro. My wifes pc has a funny thing. Permission problem. She
tries
to save a pdf file which is generated on the internet. The save
location
is My Documents, which is the directory My Documents on the G: drive.
This directory is in the library My Documents and is in the place of
the
original \Users\Name\Documents folder on the C: drive.
She then gets the message "You don't have the rights to save files on
this location". She is the owner of that directory and has the full
rights. I already checked that. Tried several solutions I found on the
internet but nothing works so far. Even created a new library
"Downloads" but also there she doesn't have the rights to save that
file.

My own pc is practically identical and organized in the same way. I
don't get this problem.

What can I do about this? Any ideas?

Fokke

One more thing:
Her directory G:\My Documents is always read-only. I can change that,
but it always changes back.

That's the default (also for Downloads, or any other downloads folder
you create), so it's not surprising that a reboot resets it.

You may be able to make the changes stick by invoking the real (hidden)
administrator account:

http://www.howtogeek.com/howto/windo...windows-vista/



Be careful: this account can make changes that Windows otherwise
prevents.

HTH


Thanks.
I will give this a try.
I will use GigaTweaker 3 to reveal the real admin account.
I'll come back on this.



Gigatweaker wasn't able to enable the admin account. I used the info in
the link you sent me. Useful to know.
Using the admin account didn't work, though. The directory remains read
only, and on the G: drive there are some directories where users or the
admin accounts have no rights at all, and the admin account wasn't able
to change that.

What a mess, all these permissions ...

On 26/01/2016 19:15, Paul wrote:
Fokke Nauta wrote:
On 26/01/2016 16:26, Fokke Nauta wrote:
Hi all,

W7 64b pro. My wifes pc has a funny thing. Permission problem. She tries
to save a pdf file which is generated on the internet. The save location
is My Documents, which is the directory My Documents on the G: drive.
This directory is in the library My Documents and is in the place of the
original \Users\Name\Documents folder on the C: drive.
She then gets the message "You don't have the rights to save files on
this location". She is the owner of that directory and has the full
rights. I already checked that. Tried several solutions I found on the
internet but nothing works so far. Even created a new library
"Downloads" but also there she doesn't have the rights to save that
file.

My own pc is practically identical and organized in the same way. I
don't get this problem.

What can I do about this? Any ideas?

Fokke

One more thing:
Her directory G:\My Documents is always read-only. I can change that,
but it always changes back.

The Read-Only folder flag is an "overloaded" bit.

It indicates to Explorer, that the folder has customization
inside. A desktop.ini, with a shell32.dll value that picks
out a particular flavor of customization. For example,
your Pictures folder might need thumbnails generated,
and it might use large icons by default. And the desktop.ini
(a text file), holds the customization information. If you
enable the display of "system" files, you should magically
see the desktop.ini located in each (customized) one.

I would not "jump all over" the Read-Only bit.

OK, that's one problem less. It puzzled me as to why this directory
should be read-only.


*******

I'm hardly an authority on how permissions work,
but at least I can deliver some warnings. There
are ALLOW permissions and DENY permissions. It's generally
considered bad practice to sprinkle DENY permissions all
over the place, and then use inheritance. However, ALLOW is
supposed to be fair game, and is used on your regular drive.
And inheritance is also used.

No. I don't use DENY permissions. I only add ALLOW permissions for the
user accounts.

You can save all the permissions on C: , using a command like this.
This command should "fail" in 62 places, every time it hits
a junction point. But otherwise, it should work. The icacls
command allows both saving and restoring permissions, and
can be used for "mop-up" work after you've made a mess. If
reapplying this to an entire drive, you modify the first line
of the ntfsCdrive.txt and put a "." entry implying current
working directory or something. This allows the very top level
of a partition to be restored. Otherwise, the syntax error in
the file, prevents a user from fixing the very top level.
Normally, people are told to be "one level above" where you
are restoring, because it's commonly believed you can't
fix the top of the partition. But if you replace the first
blank line with ".", that's supposed to fix that problem.

icacls c:\ /save "%userprofile%\Downloads\ntfsCdrive.txt" /t /c
"%userprofile%\Downloads\CErr.txt" 2&1

The output consists of two line pairs. Here, I've taken
a permission line, and laid it out into its component parts.
This should match the four lines I see in the Advanced properties.

D:AI(A;OICIID;FA;;;SY) --- SYSTEM ???
(A;OICIID;FA;;;BA) --- Built-in Administrator ???
(A;OICIID;FA;;;S-1-5-21-3768549767-1934788099-1503758287-1000) ---
my local account
(A;OICIID;FA;;;S-1-5-21-2394456921-3258211444-2531705128-1001) ---
an account from

another OS run

Now, yes, that file has a total of four entries.
But the usage of the letter "I" to me, implies
inheritance. It means this item gets some
of its permissions from the folder above it.

The 3768549767-1934788099-1503758287 part is install specific
(each OS you install, probably gets a different random number).
The 1000 part of a SID is where the first user account
might be allocated. The more local accounts you make, that
number gets bumped. The administrator account is 500.

I don't know any more than that. I can't read one of those
things, but you can see from the shape that particular one
must be pretty simple. You should see the truly mangled ones...

I also don't think you're going to instantly figure out
what happened to G: . I have zero confidence in finding
a web recipe page that documents *everything*. Most tutorial
articles trail off into a gray vapor, telling you
"there's more..." but then of course not documenting
it. In some cases, these might be domain-level features
a user typically wouldn't be using. But I'm sure the
Gods of Random Permissions could easily use such
features for creating a road block.

I don't think the Library adds any variables. If I was doing it,
I'd probably be working on G: , as attempting to do something
at the junction point on C: probably won't work. Purely a
guess on my part, based on how icacls trips when it hits
junction points.

And in a situation like this, your problem could be above
the file itself. I expect your G: setup is so simple,
it shouldn't take long to collect the parent, the folder
below it, and some file stored in there. And study how
those might be related to one another.

some_permission ------- folder ------ folder ----- file
inherit inherit

So at the top of the icacls file for G: , you should see

blank line
permissions_string_for_G:
folder_name
permissions_of_folder_name

The blank line pair, I think that defines the top of G: but
is not labeled as such.

HTH,
Paul

Paul, you're a genius!
But this is way too complicated for me. I'm not going to mess with this
icacls command as I'm afraid I may mess things up too easily. I keep my
hands off from things I don't understand.

I hoped there was an easy way out :-)

Fokke

Fokke Nauta wrote:


I hoped there was an easy way out :-)

Fokke

I would like to learn the right way to
do this stuff. But it's hard.

Paul