Something went weird moving from W7 Ult to W10 pro

A bit of history. A year or 2 ago, wanting to upgrade from XP to 7 I
decided to build a new box with SSD. I bought the fastest pre-built,
pre-tested motherboard/processor/RAM/cooler combo I could find
pre-built, put it into a spacious case, and did a clean install of W7
ultimate. Auto updates always. Moved to W10 via the July 31 mass
download.

I noticed soon that I (administrator) am getting 'access denied' on my
own folders and files on C:, and this is the heart of why many errors
occur in Windows, for internal files can't write to the files they need.
I have no idea of what 10 altered over 7, but, for example, that nifty
resetpermissions checker routine gets an access denied against every
item. C: and everything on it is owned by SYSTEM. Is that right? I
have not touched permissions or ownership anywhere.

I did a repair install from the ISO. No change.
--
Robin Bignall
Herts, England

On Fri, 16 Oct 2015 11:53:00 -0400, Wolf K wrote:

On 2015-10-16 11:32, Robin Bignall wrote:
A bit of history. A year or 2 ago, wanting to upgrade from XP to 7 I
decided to build a new box with SSD. I bought the fastest pre-built,
pre-tested motherboard/processor/RAM/cooler combo I could find
pre-built, put it into a spacious case, and did a clean install of W7
ultimate. Auto updates always. Moved to W10 via the July 31 mass
download.

I noticed soon that I (administrator) am getting 'access denied' on my
own folders and files on C:, and this is the heart of why many errors
occur in Windows, for internal files can't write to the files they need.
I have no idea of what 10 altered over 7, but, for example, that nifty
resetpermissions checker routine gets an access denied against every
item. C: and everything on it is owned by SYSTEM. Is that right? I
have not touched permissions or ownership anywhere.

I did a repair install from the ISO. No change.

Did you set up a user account? From W7 on, that's what you should do,
and that's the account you use for work. You should not use the admin
account that's enabled when you install the OS. Your user account can
have (limited) admin privileges, but to change deep aspects of the
system you have to access the hidden Administrator account. Search on
how to do that.

HTH.

Thanks. Of course I have a user account as admin, and a non-admin
account for my wife. I also have access to the built-in administrator
but have not used it for anything.

I don't know what deep aspects of the system to change. I went from a
W7 system where I could access the files I had created on C: to a W10
system where I can't, via Microsoft's auto W10 download July 31. It's
peculiar. It's as though W10 thinks that nothing on the "system" disk
C: should be directly accessible to even admin users. I DO NOT believe
that the solution is take ownership of C: for administrators, but what?
--
Robin Bignall
Herts, England

On Fri, 16 Oct 2015 17:27:23 -0400, Wolf K wrote:

On 2015-10-16 14:38, Robin Bignall wrote:
On Fri, 16 Oct 2015 11:53:00 -0400, Wolf K wrote:

On 2015-10-16 11:32, Robin Bignall wrote:
A bit of history. A year or 2 ago, wanting to upgrade from XP to 7 I
decided to build a new box with SSD. I bought the fastest pre-built,
pre-tested motherboard/processor/RAM/cooler combo I could find
pre-built, put it into a spacious case, and did a clean install of W7
ultimate. Auto updates always. Moved to W10 via the July 31 mass
download.

I noticed soon that I (administrator) am getting 'access denied' on my
own folders and files on C:, and this is the heart of why many errors
occur in Windows, for internal files can't write to the files they need.
I have no idea of what 10 altered over 7, but, for example, that nifty
resetpermissions checker routine gets an access denied against every
item. C: and everything on it is owned by SYSTEM. Is that right? I
have not touched permissions or ownership anywhere.

I did a repair install from the ISO. No change.

Did you set up a user account? From W7 on, that's what you should do,
and that's the account you use for work. You should not use the admin
account that's enabled when you install the OS. Your user account can
have (limited) admin privileges, but to change deep aspects of the
system you have to access the hidden Administrator account. Search on
how to do that.

HTH.

Thanks. Of course I have a user account as admin, and a non-admin
account for my wife. I also have access to the built-in administrator
but have not used it for anything.

I don't know what deep aspects of the system to change. I went from a
W7 system where I could access the files I had created on C: to a W10
system where I can't, via Microsoft's auto W10 download July 31. It's
peculiar. It's as though W10 thinks that nothing on the "system" disk
C: should be directly accessible to even admin users. I DO NOT believe
that the solution is take ownership of C: for administrators, but what?

Of course you should have ownership of any folders/files on C: that
aren't reserved for System use (the ones which are normally hidden).

Your User account isn't really an admin account. It has limited admin
privileges, enough for basic tasks such a creating new user accounts,
but not enough to change the system at the level at which yours
apparently needs to be changed. I think you have to give your own User
account more rights, but that can only be done with the hidden Admin
account.

Thanks.

More he
http://www.howtogeek.com/howto/windo...windows-vista/

http://www.intowindows.com/enable-th...in-windows-10/

I've already done this and can log on as 'administrator'.

Once you know how to do that, you need to know more. Search on "how to
change ownership of files and folders in windows 10".

I already know how to do this and have changed ownership of my own
folders / files to me, but it's the rest. For example, if I look at
some error events in event viewer I can see items like "(name of
internal procedure I've never heard of) cannot write to (C: filename
I've never heard of). Ensure that you have write access to this file."
But the file is totally internal to Windows. It should be the Windows
procedure that has access, not me.

Good luck,

Much obliged.

PS: I would get Start10, it gives you more direct access to Control
Panel, among other things, besides giving you back the look'n'feel of
Windows 7 and earlier.

I have classic shell, which I'm happy with.
--
Robin Bignall
Herts, England

Robin Bignall wrote on 10/16/2015 11:32 AM:
A bit of history. A year or 2 ago, wanting to upgrade from XP to 7 I
decided to build a new box with SSD. I bought the fastest pre-built,
pre-tested motherboard/processor/RAM/cooler combo I could find
pre-built, put it into a spacious case, and did a clean install of W7
ultimate. Auto updates always. Moved to W10 via the July 31 mass
download.

I noticed soon that I (administrator) am getting 'access denied' on my
own folders and files on C:, and this is the heart of why many errors
occur in Windows, for internal files can't write to the files they need.
I have no idea of what 10 altered over 7, but, for example, that nifty
resetpermissions checker routine gets an access denied against every
item. C: and everything on it is owned by SYSTEM. Is that right? I
have not touched permissions or ownership anywhere.

I did a repair install from the ISO. No change.

Did you change permissions while using Windows 7 ?

Did you relocate any of the default Windows 'Documents, Music, Pictures,
Videos, etc. folders and user created folders added to Libraries while
using Windows 7 ?





--
...winston
msft mvp windows experience

On Fri, 16 Oct 2015 18:04:43 -0400, ". . .winston"
wrote:

Robin Bignall wrote on 10/16/2015 11:32 AM:
A bit of history. A year or 2 ago, wanting to upgrade from XP to 7 I
decided to build a new box with SSD. I bought the fastest pre-built,
pre-tested motherboard/processor/RAM/cooler combo I could find
pre-built, put it into a spacious case, and did a clean install of W7
ultimate. Auto updates always. Moved to W10 via the July 31 mass
download.

I noticed soon that I (administrator) am getting 'access denied' on my
own folders and files on C:, and this is the heart of why many errors
occur in Windows, for internal files can't write to the files they need.
I have no idea of what 10 altered over 7, but, for example, that nifty
resetpermissions checker routine gets an access denied against every
item. C: and everything on it is owned by SYSTEM. Is that right? I
have not touched permissions or ownership anywhere.

I did a repair install from the ISO. No change.

Did you change permissions while using Windows 7 ?

No.

Did you relocate any of the default Windows 'Documents, Music, Pictures,
Videos, etc. folders and user created folders added to Libraries while
using Windows 7 ?

Yes, user/robin/documents to D:, but I thought I caught that one and
moved them back when I knew 10 was coming. Maybe it didn't work
properly.
--
Robin Bignall
Herts, England

On Fri, 16 Oct 2015 22:45:56 +0100, Robin Bignall
wrote:

On Fri, 16 Oct 2015 17:27:23 -0400, Wolf K wrote:

PS: I would get Start10, it gives you more direct access to Control
Panel, among other things, besides giving you back the look'n'feel of
Windows 7 and earlier.

I have classic shell, which I'm happy with.


Classic Shell is also good. But like Wolf, I think Start10 is even
better, and it only costs $4.99 USD.

But don't rely on our opinions. I recommend that you download the free
trial of Start10 and choose for yourself which you prefer.

On Fri, 16 Oct 2015 16:30:44 -0700, "Ken Blake, MVP"
wrote:

On Fri, 16 Oct 2015 22:45:56 +0100, Robin Bignall
wrote:

On Fri, 16 Oct 2015 17:27:23 -0400, Wolf K wrote:

PS: I would get Start10, it gives you more direct access to Control
Panel, among other things, besides giving you back the look'n'feel of
Windows 7 and earlier.

I have classic shell, which I'm happy with.


Classic Shell is also good. But like Wolf, I think Start10 is even
better, and it only costs $4.99 USD.

But don't rely on our opinions. I recommend that you download the free
trial of Start10 and choose for yourself which you prefer.

Thanks, Ken, but I have more fundamental problems that tweaking my menu
system.
--
Robin Bignall
Herts, England

Robin Bignall wrote:
On Fri, 16 Oct 2015 16:30:44 -0700, "Ken Blake, MVP"
wrote:

On Fri, 16 Oct 2015 22:45:56 +0100, Robin Bignall
wrote:

On Fri, 16 Oct 2015 17:27:23 -0400, Wolf K wrote:
PS: I would get Start10, it gives you more direct access to Control
Panel, among other things, besides giving you back the look'n'feel of
Windows 7 and earlier.
I have classic shell, which I'm happy with.

Classic Shell is also good. But like Wolf, I think Start10 is even
better, and it only costs $4.99 USD.

But don't rely on our opinions. I recommend that you download the free
trial of Start10 and choose for yourself which you prefer.

Thanks, Ken, but I have more fundamental problems that tweaking my menu
system.

Some commands (from elevated administrator Command Prompt window).

wmic useraccount get name,sid

The output looks like this. When I tried this on a Win7 Pro test
install, there was a HomeGroup account as well. My regular Win7
install on the test machine, didn't have the HomeGroup account.

Name SID
Administrator S-1-5-21-3768549767-1934788099-1503758287-500
Mere User S-1-5-21-3768549767-1934788099-1503758287-1000
Guest S-1-5-21-3768549767-1934788099-1503758287-501

To find out who you are while logged in, you can try these.

whoami /priv /user
whoami /all

To log the permissions on the entire C: drive

icacls c:\ /save "%userprofile%\Downloads\ntfsCdrive.txt" /t /c

And that will put a 10-20MB file in your Downloads folder. The
output to the screen can be redirected if you want to save
all of it. The 62 or so reparse points will return Access Denied
errors when scanned with that utility.

You can also restore permissions later.

icacls c:\ /restore %userprofile%\Downloads\ntfsCdrive.txt

Because of a problem with the output produced by the
command, you can edit the file and place a "." in the
first line to indicate "current working directory" when
working on fixing the permissions on C:. Restoring permissions
using a command sequence like that, is for when you've been
messing about with folders owned by TrustedInstaller, and
want to put the TrustedInstaller ownership back when you
are finished.

https://social.technet.microsoft.com...backup-restore

Entries in the ntfsCdrive.txt file in my example, consist of
two-line pairs. One line is the filename. The other line
has the permissions.

D:AI(A;OICIID;FA;;;SY)
(A;OICIID;FA;;;BA)
(A;OICIID;FA;;;S-1-5-21-3768549767-1934788099-1503758287-1000)
(A;OICIID;FA;;;S-1-5-21-2394456921-3258211444-2531705128-1001)

If you reformat a line to look like that, you can see that
the clusters roughly correspond to the Advanced Security
settings window. The SID on each line, you can compare
to WMIC output. Unfortunately, that particular WMIC command
at the top of this posting, doesn't show all the SIDs. But at
least I can see that account 1000 is from the current OS, while
the stamp from account 1001 came from a TakeOwn applied with
some other OS (different SID value).

That's about all I know, and that's just a quick introduction
to what hides down there. There are several ACL commands
like that, a deprecated one that takes symbolic account names
rather than numeric, that provide similar information,
but perhaps in a more friendly format.

You could probably apply TakeOwn to your data folders, but
you should not apply it to the entire C: . The Program Files
folders on Windows are owned by TrustedInstaller. Which
rather than being an account, is a Service, and TrustedInstaller
doesn't have its own home directory. It's possible to
steal the TrustedInstaller "token" and reapply permissions
one at a time, but that is third-party software which
provides the capability.

Command line Takeown (the basic mechanism) is described here.

http://blogs.msdn.com/b/tims/archive...deletable.aspx

takeown /f %1 /r /d y
icacls %1 /grant administrators:F /t

And adding Takeown as a right-click Context Menu item
is described here. When you download a .reg, you right-click
it, and the word at the top of the menu is "Merge". Merging
in the registry entry, adds the feature. Once this is done,
right clicking a folder tree with inconvenient permissions,
can have an extra line added to it by selecting TakeOwn.
It's something along those lines.

http://www.sevenforums.com/tutorials...cut.html?ltr=T

Add_Take_Ownership_to_context_menu.reg --- add right-click "TakeOwn"
Add_Take_Ownership_with_Pause_to_context_menu.reg
Remove_Take_Ownership_from_context_menu.reg --- remove "Takeown" later
if you don't like it

Before messing around in any significant way, make
a backup of C:. No matter how broken, you want to
be able to undo any experiments you may choose to try.

HTH,
Paul

On Sat, 17 Oct 2015 13:17:39 -0400, Paul wrote:

Robin Bignall wrote:
On Fri, 16 Oct 2015 16:30:44 -0700, "Ken Blake, MVP"
wrote:

On Fri, 16 Oct 2015 22:45:56 +0100, Robin Bignall
wrote:

On Fri, 16 Oct 2015 17:27:23 -0400, Wolf K wrote:
PS: I would get Start10, it gives you more direct access to Control
Panel, among other things, besides giving you back the look'n'feel of
Windows 7 and earlier.
I have classic shell, which I'm happy with.

Classic Shell is also good. But like Wolf, I think Start10 is even
better, and it only costs $4.99 USD.

But don't rely on our opinions. I recommend that you download the free
trial of Start10 and choose for yourself which you prefer.

Thanks, Ken, but I have more fundamental problems that tweaking my menu
system.

Some commands (from elevated administrator Command Prompt window).

[snip detail]

Paul,
thanks for this splendid post. I've saved it and printed it out for
study.
I have a feeling that most system things on c: should be owned by
trustedinstaller. They are on my W10 laptop, but not on this desktop. I
just did a repair install of W10 and nothing has changed. Most of c: is
owned by system; why, I don't know. I never ever touched ownership or
permissions on any machine.
--
Robin Bignall
Herts, England

On Sat, 17 Oct 2015 13:41:40 +0000, Stormin' Norman
wrote:

On Fri, 16 Oct 2015 16:32:17 +0100, Robin Bignall wrote:

A bit of history. A year or 2 ago, wanting to upgrade from XP to 7 I
decided to build a new box with SSD. I bought the fastest pre-built,
pre-tested motherboard/processor/RAM/cooler combo I could find
pre-built, put it into a spacious case, and did a clean install of W7
ultimate. Auto updates always. Moved to W10 via the July 31 mass
download.

I noticed soon that I (administrator) am getting 'access denied' on my
own folders and files on C:, and this is the heart of why many errors
occur in Windows, for internal files can't write to the files they need.
I have no idea of what 10 altered over 7, but, for example, that nifty
resetpermissions checker routine gets an access denied against every
item. C: and everything on it is owned by SYSTEM. Is that right? I
have not touched permissions or ownership anywhere.

I did a repair install from the ISO. No change.

Are you still dealing with this issue? If so, has anyone suggested that you reset all file permissions to
their defaults? This can be done fairly easily using a batch script run under an elevated command prompt.

No, and I wouldn't know how to write such a script. Such a thing to
reset them to their defaults would be a godsend.
--
Robin Bignall
Herts, England

On Sat, 17 Oct 2015 19:51:05 +0000, Stormin' Norman
wrote:

On Sat, 17 Oct 2015 20:32:52 +0100, Robin Bignall wrote:

On Sat, 17 Oct 2015 13:41:40 +0000, Stormin' Norman
wrote:

On Fri, 16 Oct 2015 16:32:17 +0100, Robin Bignall wrote:

A bit of history. A year or 2 ago, wanting to upgrade from XP to 7 I
decided to build a new box with SSD. I bought the fastest pre-built,
pre-tested motherboard/processor/RAM/cooler combo I could find
pre-built, put it into a spacious case, and did a clean install of W7
ultimate. Auto updates always. Moved to W10 via the July 31 mass
download.

I noticed soon that I (administrator) am getting 'access denied' on my
own folders and files on C:, and this is the heart of why many errors
occur in Windows, for internal files can't write to the files they need.
I have no idea of what 10 altered over 7, but, for example, that nifty
resetpermissions checker routine gets an access denied against every
item. C: and everything on it is owned by SYSTEM. Is that right? I
have not touched permissions or ownership anywhere.

I did a repair install from the ISO. No change.

Are you still dealing with this issue? If so, has anyone suggested that you reset all file permissions to
their defaults? This can be done fairly easily using a batch script run under an elevated command prompt.

No, and I wouldn't know how to write such a script. Such a thing to
reset them to their defaults would be a godsend.

You need to log in using the built-in administrator account (not your account with administrative privileges).
Then, from an elevated command prompt, enter the following command:

ICACLS * /reset /t /c /q

Enter it exactly as shown, then press enter.

Let me know if it solves your issue.

Thousands of lines, each saying something like "The system cannot find
the path specified"
--
Robin Bignall
Herts, England

On Sun, 18 Oct 2015 00:00:41 +0000, Stormin' Norman
wrote:

On Sat, 17 Oct 2015 23:40:28 +0100, Robin Bignall wrote:



You need to log in using the built-in administrator account (not your account with administrative privileges).
Then, from an elevated command prompt, enter the following command:

ICACLS * /reset /t /c /q

Enter it exactly as shown, then press enter.

Let me know if it solves your issue.

Thousands of lines, each saying something like "The system cannot find
the path specified"

Try everything I wrote above again, except try the command below:

ICACLS c:\* /reset /t /c /q

This site has details of a nifty little GUI that will generate that
command.
http://lallouslab.net/2009/06/14/res...-in-windows-7/
It's good for W10 too. You can see the command it generates before
running it.
I did as you asked, ran it from the built-in administrator account.
Needless to say it failed again, with either a "path not found" or an
"access denied" against every line item. The writer of that GUI says on
his site that sometimes ICACLS can fail, (he doesn't say why) in which
case take ownership first. I certainly do not want to take ownership of
the system disk.(1)

I have absolutely no idea of how this situation came about. I have
NEVER mucked around with permissions or ownership in any Windows I've
ever had. Its consequences are serious. For example, I have a little
bandwidth monitor running that wants to create its log file in
c:/windows/system32, but access is denied to it, and so is access denied
to Windows internal routines that want to do similar things.

(1) Reading further, I've just discovered that to run ICACLS as an admin
one must take ownership first. I can do that, provided I know who
SHOULD own C: so I can set it back after. It's obviously not System.
I know it's something installer, but I can't recall the something.
--
Robin Bignall
Herts, England

On Sun, 18 Oct 2015 16:09:55 -0400, Paul wrote:

Robin Bignall wrote:
On Sun, 18 Oct 2015 00:00:41 +0000, Stormin' Norman
wrote:

On Sat, 17 Oct 2015 23:40:28 +0100, Robin Bignall wrote:


You need to log in using the built-in administrator account (not your account with administrative privileges).
Then, from an elevated command prompt, enter the following command:

ICACLS * /reset /t /c /q

Enter it exactly as shown, then press enter.

Let me know if it solves your issue.
Thousands of lines, each saying something like "The system cannot find
the path specified"
Try everything I wrote above again, except try the command below:

ICACLS c:\* /reset /t /c /q

This site has details of a nifty little GUI that will generate that
command.
http://lallouslab.net/2009/06/14/res...-in-windows-7/
It's good for W10 too. You can see the command it generates before
running it.
I did as you asked, ran it from the built-in administrator account.
Needless to say it failed again, with either a "path not found" or an
"access denied" against every line item. The writer of that GUI says on
his site that sometimes ICACLS can fail, (he doesn't say why) in which
case take ownership first. I certainly do not want to take ownership of
the system disk.(1)

I have absolutely no idea of how this situation came about. I have
NEVER mucked around with permissions or ownership in any Windows I've
ever had. Its consequences are serious. For example, I have a little
bandwidth monitor running that wants to create its log file in
c:/windows/system32, but access is denied to it, and so is access denied
to Windows internal routines that want to do similar things.

(1) Reading further, I've just discovered that to run ICACLS as an admin
one must take ownership first. I can do that, provided I know who
SHOULD own C: so I can set it back after. It's obviously not System.
I know it's something installer, but I can't recall the something.

Just make sure to backup the permissions first.

I have an autobackup program that takes an incremental backup each hour
(takes seconds and runs in background) and I can always recreate c: to
the latest point.

icacls c:\ /save "%userprofile%\Downloads\ntfsCdrive.txt" /t /c "%userprofile%\Downloads\CErr.txt" 2&1
icacls d:\ /save "%userprofile%\Downloads\ntfsDdrive.txt" /t /c "%userprofile%\Downloads\DErr.txt" 2&1

[snip detail for brevity]

Thanks again. This is going to require some study!
--
Robin Bignall
Herts, England

On Sun, 18 Oct 2015 20:31:20 +0000, Stormin' Norman
wrote:

On Sun, 18 Oct 2015 19:49:29 +0100, Robin Bignall wrote:



This site has details of a nifty little GUI that will generate that
command.
http://lallouslab.net/2009/06/14/res...-in-windows-7/
It's good for W10 too. You can see the command it generates before
running it.
I did as you asked, ran it from the built-in administrator account.
Needless to say it failed again, with either a "path not found" or an
"access denied" against every line item. The writer of that GUI says on
his site that sometimes ICACLS can fail, (he doesn't say why) in which
case take ownership first. I certainly do not want to take ownership of
the system disk.(1)

I have absolutely no idea of how this situation came about. I have
NEVER mucked around with permissions or ownership in any Windows I've
ever had. Its consequences are serious. For example, I have a little
bandwidth monitor running that wants to create its log file in
c:/windows/system32, but access is denied to it, and so is access denied
to Windows internal routines that want to do similar things.

(1) Reading further, I've just discovered that to run ICACLS as an admin
one must take ownership first. I can do that, provided I know who
SHOULD own C: so I can set it back after. It's obviously not System.
I know it's something installer, but I can't recall the something.

In addition to running it from the administrator account did you also run the command from an "Elevated
Command Prompt" while in the administrator account?

See:

http://winaero.com/blog/how-to-open-...in-windows-10/

Yes. Either "cannot find path" or "access denied" against every line.
--
Robin Bignall
Herts, England

On Sun, 18 Oct 2015 22:19:44 +0000, Stormin' Norman
wrote:

On Sun, 18 Oct 2015 23:05:02 +0100, Robin Bignall wrote:


Yes. Either "cannot find path" or "access denied" against every line.


I am going to word this very carefully.

If it were my computer, I would make a full image of the drive. Then, I would run the following command from
an elevated command prompt from within the administrator account.

secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose

I am not telling you to do this, nor am I taking ownership of what may happen. This is why I said I would
take a full image, so I could restore it just in case something goes wrong.

It sounds to me as if your machine was infected and that infection did serious damage.

I have no problems recreating c:. If it was an infection it got past
Kaspersky's Total Internet Security.
--
Robin Bignall
Herts, England