How to get full access to all contents?

I'm inclined to agree, Roger. Sometimes, however, when what is supposed to
work doesn't, it's worth a shot to try something that might be a cause but
isn't directly indicated. I didn't feel there was any harm in exploring the
option though I'm not sure if he can even take ownership of encrypted files.

That said, something he had said about changing the computer or workgroup
name, sorry I don't recall, triggered me to reconsider the possibility of a
file ownership issue.

--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/

"Roger Abell" wrote in message
...
I believe that we earlier resolved that it is not an
NTFS permissions issue.
Administrator is a recovery agent only in Windows 2000.
Windows XP has no recovery agent until one is configured
or the machine is joined to an Active Directory.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
"the following people can decrypt an encrypted file.
Any user who was designated as a recovery agent" is written in the


http://support.microsoft.com/default...&Product=winxp
The user who was designated as a recovery agent is the Administrator. I
tried to decrypt the file under the Administrator account and got the
same
error message "Error Applying Attributes
An error occurred applying attributes to the file:
Path:\Filename
Access is denied"
"Michael Solomon (MS-MVP Windows Shell/User)" wrote in
message ...
I don't know if you've seen this or if it will help but you might want
to
have a look at the following Knowledge Base Article:



http://support.microsoft.com/default...&Product=winxp

--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/

"Dmitriy Kopnichev" wrote in message
...
The fixes didn't help.
"Kelly" wrote in message
...
Without knowing more, see if this helps:

EXE and LNK Fix for Windows XP - Line 12
http://www.kellys-korner-xp.com/xp_tweaks.htm

To use the Regedit: Save the REG File to your hard disk. Double
click
it
and answer yes to the import prompt. REG files can be viewed in
Notepad
by
right clicking on the file and selecting Edit.

--
All the Best,
Kelly

MS-MVP Win98/XP
[AE-Windows® XP]

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm


"Dmitriy Kopnichev" wrote in message
...
Hello
I get "Windows cannot access the specified device, path, or
file.
You
may
not have appropriate permissions to access the item." when I
double-click
a
file. I'm the only owner of the computer. How to get full access
to
all
contents?

"Data Recovery Agents For This File As Defined By Recovery Policy" is
"Administrator" is written in "Encryption Details for" the file window in
"Advanced Attributes" window.
"Roger Abell" wrote in message
...
I believe that we earlier resolved that it is not an
NTFS permissions issue.
Administrator is a recovery agent only in Windows 2000.
Windows XP has no recovery agent until one is configured
or the machine is joined to an Active Directory.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
"the following people can decrypt an encrypted file.
Any user who was designated as a recovery agent" is written in the


http://support.microsoft.com/default...&Product=winxp
The user who was designated as a recovery agent is the Administrator. I
tried to decrypt the file under the Administrator account and got the
same
error message "Error Applying Attributes
An error occurred applying attributes to the file:
Path:\Filename
Access is denied"
"Michael Solomon (MS-MVP Windows Shell/User)" wrote in
message ...
I don't know if you've seen this or if it will help but you might want
to
have a look at the following Knowledge Base Article:



http://support.microsoft.com/default...&Product=winxp

--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/

"Dmitriy Kopnichev" wrote in message
...
The fixes didn't help.
"Kelly" wrote in message
...
Without knowing more, see if this helps:

EXE and LNK Fix for Windows XP - Line 12
http://www.kellys-korner-xp.com/xp_tweaks.htm

To use the Regedit: Save the REG File to your hard disk. Double
click
it
and answer yes to the import prompt. REG files can be viewed in
Notepad
by
right clicking on the file and selecting Edit.

--
All the Best,
Kelly

MS-MVP Win98/XP
[AE-Windows® XP]

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm


"Dmitriy Kopnichev" wrote in message
...
Hello
I get "Windows cannot access the specified device, path, or
file.
You
may
not have appropriate permissions to access the item." when I
double-click
a
file. I'm the only owner of the computer. How to get full access
to
all
contents?

I haven't removed any account.
Isn't the "ME$(ME$@workgroup)" a user account? I used not the cipher, but
"Encryption Details for" the file window in "Advanced Attributes" of the
file window. I saved a Private key to a .pfx file before I was joined the
domain and my computer was renamed by the domain administrators.
"Roger Abell" wrote in message
...
You may own the machine and the files may be yours,
but if it is encrypted and you cannot prove to the system
that you are supposed to be able to decrypt it then it will
not let you.

The only way to prove that you are supposed to be able
to access the EFS encrypted file is to use an account that
has loaded into it the decryption key that corresponds to
the certificate that was used to encrypt the file.

When you renamed the machine, apparently starting down
the road of denied access, something seems to have removed
that capability. When you used cipher to look at the file it
said that there was no user account allowed to decrypt it,
instead indicating the machine was allowed to decrypt it.
That, assuming you have reported accurately what you saw,
is something with which I am unfamiliar, either as to why it
got that way or how to get out of that situation.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
This is my file. I'm the only computer owner.
"Roger Abell" wrote in message
...
code 5 is probably access failure
in this case since you do not have EFS capability to decrypt
you are not allowed to modify who can decrypt

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
I tried to add myself and/or another user to "Users Who Can
Transparently
Access this File" and got an error
"ERSADU
Error in adding new user(s). Error code 5."
"Roger Abell" wrote in message
...
When you look at the file's properties Security dialog
is anything checked for any group in the Deny column ?
You must highlight each group listed one at a time and
then look at what is Granted/Denied.
An account that is only in Administrators group is
actually also in other things to which there can be
NTFS Grants/Denies, like Authenticated Users,
Network, Interactive, Everyone. . . .
Not having EFS authorization appears as if it is a
NTFS permissions denial. You should use the cipher
commandline utility to examine the thumbprint info of
the file to see what accounts are allowed to decrypt it.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
How to become sure that there is no Deny for any group. The file
is
EFS
protected. But I can open other EFS protected files.
"Roger Abell" wrote in message
...
This means that you have full control and it is inherited from
some higher directory.
Are you sure that there is no Deny for some group, and if
there is make sure your account is not a member of the group.
Deny overrides a Grant.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
I'm the Owner of the file and have full access, but the
"Effective
permissions" are all checked and grayed for me.
"Kelly" wrote in message
...
Without knowing more, see if this helps:

EXE and LNK Fix for Windows XP - Line 12
http://www.kellys-korner-xp.com/xp_tweaks.htm

To use the Regedit: Save the REG File to your hard disk.
Double
click
it
and answer yes to the import prompt. REG files can be
viewed
in
Notepad
by
right clicking on the file and selecting Edit.

--
All the Best,
Kelly

MS-MVP Win98/XP
[AE-Windows® XP]

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm


"Dmitriy Kopnichev" wrote in message
...
Hello
I get "Windows cannot access the specified device, path,
or
file.
You
may
not have appropriate permissions to access the item."
when
I
double-click
a
file. I'm the only owner of the computer. How to get
full
access
to
all
contents?

My account isn't a limited account, but administrative.
"Use Simple File Sharing" is disabled when joining a domain.
My account has full control over the file.
"Michael Solomon (MS-MVP Windows Shell/User)" wrote in
message ...
This sounds like a file ownership issue related to NTFS. Note, file
ownership and permissions supersede administrator rights. How you resolve
it depends upon which version of XP you are running.



XP-Home



Unfortunately, XP Home using NTFS is essentially hard wired for "Simple
File
Sharing" at system level.

However, you can set XP Home permissions in Safe Mode. Reboot, and start
hitting F8, a menu should eventually appear and one of the
options is Safe Mode. Select it. Note, it will ask for the
administrator's
password. This is not your administrator account, rather it is the
machine's administrator account for which users are asked to create a
password during setup.

If you created no such password, when requested, leave blank and press
enter.

Open Explorer, go to Tools and Folder Options, on the view tab, scroll to
the bottom of the list, if it shows "Enable Simple File Sharing" deselect
it
and click apply and ok. If it shows nothing or won't let you make a
change,
move on to the next step.

Navigate to the files, right click, select properties, go to the Security
tab, click advanced, go to the Owner tab and select the user that was
logged
on when you were refused permission to access the files. Click apply and
ok. Close the properties box, reopen it, click add and type in the name
of
the user you just enabled. If you wish to set ownership for everything in
the folder, at the bottom of the Owner tab is the following selection:
"Replace owner on subcontainers and objects," select it as well.

Once complete, you should be able to do what you wish with these files
when
you log back on as that user.



XP-Pro



If you have XP Pro, temporarily change the limited account to
administrative. First, go to Windows Explorer, go to Tools, select Folder
Options, go to the View tab and be sure "Use Simple File Sharing" is not
selected. If it is, deselect it and click apply and ok.



If you wish everything in a specific folder to be accessible to a user,
right click the folder, select properties, go to the Security tab, click
Advanced, go to the Owner tab,
select the user you wish to have access, at the bottom of the box, you
should see a check box for "Replace owner on subcontainers and objects,"
place a check in the box and click apply and ok.

The user should now be able to perform necessary functions on files in the
folder even as a limited account. If not, make it an admin account again,
right click the folder, select Properties, go to the Security tab and be
sure the user is listed in the user list. If not, click add and type the
user name in the appropriate box, be sure the user has all the necessary
permissions checked in the permission list below the user list, click
apply
and ok.

That should do it and allow whatever access you desire for that folder
even
in a limited account.






--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/

"Dmitriy Kopnichev" wrote in message
...
"the following people can decrypt an encrypted file.
Any user who was designated as a recovery agent" is written in the


http://support.microsoft.com/default...&Product=winxp
The user who was designated as a recovery agent is the Administrator. I
tried to decrypt the file under the Administrator account and got the
same
error message "Error Applying Attributes
An error occurred applying attributes to the file:
Path:\Filename
Access is denied"
"Michael Solomon (MS-MVP Windows Shell/User)" wrote in
message ...
I don't know if you've seen this or if it will help but you might want
to
have a look at the following Knowledge Base Article:



http://support.microsoft.com/default...&Product=winxp

--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/

"Dmitriy Kopnichev" wrote in message
...
The fixes didn't help.
"Kelly" wrote in message
...
Without knowing more, see if this helps:

EXE and LNK Fix for Windows XP - Line 12
http://www.kellys-korner-xp.com/xp_tweaks.htm

To use the Regedit: Save the REG File to your hard disk. Double
click
it
and answer yes to the import prompt. REG files can be viewed in
Notepad
by
right clicking on the file and selecting Edit.

--
All the Best,
Kelly

MS-MVP Win98/XP
[AE-Windows® XP]

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm


"Dmitriy Kopnichev" wrote in message
...
Hello
I get "Windows cannot access the specified device, path, or
file.
You
may
not have appropriate permissions to access the item." when I
double-click
a
file. I'm the only owner of the computer. How to get full access
to
all
contents?

Will I retain access to needed network folders if I rename my computer back
to ME (and click "Workgroup" in "Computer name changes" window) in "System
Properties" window? This might help get access to the file.
"Roger Abell" wrote in message
...
You may own the machine and the files may be yours,
but if it is encrypted and you cannot prove to the system
that you are supposed to be able to decrypt it then it will
not let you.

The only way to prove that you are supposed to be able
to access the EFS encrypted file is to use an account that
has loaded into it the decryption key that corresponds to
the certificate that was used to encrypt the file.

When you renamed the machine, apparently starting down
the road of denied access, something seems to have removed
that capability. When you used cipher to look at the file it
said that there was no user account allowed to decrypt it,
instead indicating the machine was allowed to decrypt it.
That, assuming you have reported accurately what you saw,
is something with which I am unfamiliar, either as to why it
got that way or how to get out of that situation.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
This is my file. I'm the only computer owner.
"Roger Abell" wrote in message
...
code 5 is probably access failure
in this case since you do not have EFS capability to decrypt
you are not allowed to modify who can decrypt

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
I tried to add myself and/or another user to "Users Who Can
Transparently
Access this File" and got an error
"ERSADU
Error in adding new user(s). Error code 5."
"Roger Abell" wrote in message
...
When you look at the file's properties Security dialog
is anything checked for any group in the Deny column ?
You must highlight each group listed one at a time and
then look at what is Granted/Denied.
An account that is only in Administrators group is
actually also in other things to which there can be
NTFS Grants/Denies, like Authenticated Users,
Network, Interactive, Everyone. . . .
Not having EFS authorization appears as if it is a
NTFS permissions denial. You should use the cipher
commandline utility to examine the thumbprint info of
the file to see what accounts are allowed to decrypt it.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
How to become sure that there is no Deny for any group. The file
is
EFS
protected. But I can open other EFS protected files.
"Roger Abell" wrote in message
...
This means that you have full control and it is inherited from
some higher directory.
Are you sure that there is no Deny for some group, and if
there is make sure your account is not a member of the group.
Deny overrides a Grant.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
I'm the Owner of the file and have full access, but the
"Effective
permissions" are all checked and grayed for me.
"Kelly" wrote in message
...
Without knowing more, see if this helps:

EXE and LNK Fix for Windows XP - Line 12
http://www.kellys-korner-xp.com/xp_tweaks.htm

To use the Regedit: Save the REG File to your hard disk.
Double
click
it
and answer yes to the import prompt. REG files can be
viewed
in
Notepad
by
right clicking on the file and selecting Edit.

--
All the Best,
Kelly

MS-MVP Win98/XP
[AE-Windows® XP]

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm


"Dmitriy Kopnichev" wrote in message
...
Hello
I get "Windows cannot access the specified device, path,
or
file.
You
may
not have appropriate permissions to access the item."
when
I
double-click
a
file. I'm the only owner of the computer. How to get
full
access
to
all
contents?

NG list trimmed to security_admin

Have you yet tried importing the key that was saved into
an account ? When doing this, it will give you the option
to have it prompt you whenerver it is used, or to just do it.
You must select for it to just do it without prompting.
Account names like ME$ are usually the machine account
that represents the machine as a member in the domain.


--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
I haven't removed any account.
Isn't the "ME$(ME$@workgroup)" a user account? I used not the cipher, but
"Encryption Details for" the file window in "Advanced Attributes" of the
file window. I saved a Private key to a .pfx file before I was joined the
domain and my computer was renamed by the domain administrators.
"Roger Abell" wrote in message
...
You may own the machine and the files may be yours,
but if it is encrypted and you cannot prove to the system
that you are supposed to be able to decrypt it then it will
not let you.

The only way to prove that you are supposed to be able
to access the EFS encrypted file is to use an account that
has loaded into it the decryption key that corresponds to
the certificate that was used to encrypt the file.

When you renamed the machine, apparently starting down
the road of denied access, something seems to have removed
that capability. When you used cipher to look at the file it
said that there was no user account allowed to decrypt it,
instead indicating the machine was allowed to decrypt it.
That, assuming you have reported accurately what you saw,
is something with which I am unfamiliar, either as to why it
got that way or how to get out of that situation.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
This is my file. I'm the only computer owner.
"Roger Abell" wrote in message
...
code 5 is probably access failure
in this case since you do not have EFS capability to decrypt
you are not allowed to modify who can decrypt

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
I tried to add myself and/or another user to "Users Who Can
Transparently
Access this File" and got an error
"ERSADU
Error in adding new user(s). Error code 5."
"Roger Abell" wrote in message
...
When you look at the file's properties Security dialog
is anything checked for any group in the Deny column ?
You must highlight each group listed one at a time and
then look at what is Granted/Denied.
An account that is only in Administrators group is
actually also in other things to which there can be
NTFS Grants/Denies, like Authenticated Users,
Network, Interactive, Everyone. . . .
Not having EFS authorization appears as if it is a
NTFS permissions denial. You should use the cipher
commandline utility to examine the thumbprint info of
the file to see what accounts are allowed to decrypt it.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
How to become sure that there is no Deny for any group. The
file
is
EFS
protected. But I can open other EFS protected files.
"Roger Abell" wrote in message
...
This means that you have full control and it is inherited
from
some higher directory.
Are you sure that there is no Deny for some group, and if
there is make sure your account is not a member of the
group.
Deny overrides a Grant.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
I'm the Owner of the file and have full access, but the
"Effective
permissions" are all checked and grayed for me.
"Kelly" wrote in message
...
Without knowing more, see if this helps:

EXE and LNK Fix for Windows XP - Line 12
http://www.kellys-korner-xp.com/xp_tweaks.htm

To use the Regedit: Save the REG File to your hard
disk.
Double
click
it
and answer yes to the import prompt. REG files can be
viewed
in
Notepad
by
right clicking on the file and selecting Edit.

--
All the Best,
Kelly

MS-MVP Win98/XP
[AE-Windows® XP]

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm


"Dmitriy Kopnichev" wrote in message
...
Hello
I get "Windows cannot access the specified device,
path,
or
file.
You
may
not have appropriate permissions to access the item."
when
I
double-click
a
file. I'm the only owner of the computer. How to get
full
access
to
all
contents?

Sure, I understand, but we already covered that ground
back toward the beginning of this (? he has started so many)
thread.

--
Roger

"Michael Solomon (MS-MVP Windows Shell/User)" wrote in
message ...
I'm inclined to agree, Roger. Sometimes, however, when what is supposed
to
work doesn't, it's worth a shot to try something that might be a cause but
isn't directly indicated. I didn't feel there was any harm in exploring
the
option though I'm not sure if he can even take ownership of encrypted
files.

That said, something he had said about changing the computer or workgroup
name, sorry I don't recall, triggered me to reconsider the possibility of
a
file ownership issue.

--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/

"Roger Abell" wrote in message
...
I believe that we earlier resolved that it is not an
NTFS permissions issue.
Administrator is a recovery agent only in Windows 2000.
Windows XP has no recovery agent until one is configured
or the machine is joined to an Active Directory.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
"the following people can decrypt an encrypted file.
Any user who was designated as a recovery agent" is written in the



http://support.microsoft.com/default...&Product=winxp
The user who was designated as a recovery agent is the Administrator.
I
tried to decrypt the file under the Administrator account and got the
same
error message "Error Applying Attributes
An error occurred applying attributes to the file:
Path:\Filename
Access is denied"
"Michael Solomon (MS-MVP Windows Shell/User)" wrote
in
message ...
I don't know if you've seen this or if it will help but you might
want
to
have a look at the following Knowledge Base Article:




http://support.microsoft.com/default...&Product=winxp

--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/

"Dmitriy Kopnichev" wrote in message
...
The fixes didn't help.
"Kelly" wrote in message
...
Without knowing more, see if this helps:

EXE and LNK Fix for Windows XP - Line 12
http://www.kellys-korner-xp.com/xp_tweaks.htm

To use the Regedit: Save the REG File to your hard disk. Double
click
it
and answer yes to the import prompt. REG files can be viewed in
Notepad
by
right clicking on the file and selecting Edit.

--
All the Best,
Kelly

MS-MVP Win98/XP
[AE-Windows® XP]

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm


"Dmitriy Kopnichev" wrote in message
...
Hello
I get "Windows cannot access the specified device, path, or
file.
You
may
not have appropriate permissions to access the item." when I
double-click
a
file. I'm the only owner of the computer. How to get full
access
to
all
contents?

NGs trimmed to security_admin

But what does cipher say ? The same ?
For the file to have an associated recovery agent
of Administrator it seems you had to have configured
a recovery agent (in XP). Was this machine a clean
install or an upgrade from W2k ??

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
"Data Recovery Agents For This File As Defined By Recovery Policy" is
"Administrator" is written in "Encryption Details for" the file window in
"Advanced Attributes" window.
"Roger Abell" wrote in message
...
I believe that we earlier resolved that it is not an
NTFS permissions issue.
Administrator is a recovery agent only in Windows 2000.
Windows XP has no recovery agent until one is configured
or the machine is joined to an Active Directory.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
"the following people can decrypt an encrypted file.
Any user who was designated as a recovery agent" is written in the



http://support.microsoft.com/default...&Product=winxp
The user who was designated as a recovery agent is the Administrator.
I
tried to decrypt the file under the Administrator account and got the
same
error message "Error Applying Attributes
An error occurred applying attributes to the file:
Path:\Filename
Access is denied"
"Michael Solomon (MS-MVP Windows Shell/User)" wrote
in
message ...
I don't know if you've seen this or if it will help but you might
want
to
have a look at the following Knowledge Base Article:




http://support.microsoft.com/default...&Product=winxp

--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/

"Dmitriy Kopnichev" wrote in message
...
The fixes didn't help.
"Kelly" wrote in message
...
Without knowing more, see if this helps:

EXE and LNK Fix for Windows XP - Line 12
http://www.kellys-korner-xp.com/xp_tweaks.htm

To use the Regedit: Save the REG File to your hard disk. Double
click
it
and answer yes to the import prompt. REG files can be viewed in
Notepad
by
right clicking on the file and selecting Edit.

--
All the Best,
Kelly

MS-MVP Win98/XP
[AE-Windows® XP]

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm


"Dmitriy Kopnichev" wrote in message
...
Hello
I get "Windows cannot access the specified device, path, or
file.
You
may
not have appropriate permissions to access the item." when I
double-click
a
file. I'm the only owner of the computer. How to get full
access
to
all
contents?

How to use cipher to know who are a "Data Recovery Agents" and a decrypter?
This machine was a clean install.
"Roger Abell" wrote in message
...
NGs trimmed to security_admin

But what does cipher say ? The same ?
For the file to have an associated recovery agent
of Administrator it seems you had to have configured
a recovery agent (in XP). Was this machine a clean
install or an upgrade from W2k ??

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
"Data Recovery Agents For This File As Defined By Recovery Policy" is
"Administrator" is written in "Encryption Details for" the file window
in
"Advanced Attributes" window.
"Roger Abell" wrote in message
...
I believe that we earlier resolved that it is not an
NTFS permissions issue.
Administrator is a recovery agent only in Windows 2000.
Windows XP has no recovery agent until one is configured
or the machine is joined to an Active Directory.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
"the following people can decrypt an encrypted file.
Any user who was designated as a recovery agent" is written in the




http://support.microsoft.com/default...&Product=winxp
The user who was designated as a recovery agent is the
Administrator.
I
tried to decrypt the file under the Administrator account and got
the
same
error message "Error Applying Attributes
An error occurred applying attributes to the file:
Path:\Filename
Access is denied"
"Michael Solomon (MS-MVP Windows Shell/User)"
wrote
in
message ...
I don't know if you've seen this or if it will help but you might
want
to
have a look at the following Knowledge Base Article:





http://support.microsoft.com/default...&Product=winxp

--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/

"Dmitriy Kopnichev" wrote in message
...
The fixes didn't help.
"Kelly" wrote in message
...
Without knowing more, see if this helps:

EXE and LNK Fix for Windows XP - Line 12
http://www.kellys-korner-xp.com/xp_tweaks.htm

To use the Regedit: Save the REG File to your hard disk.
Double
click
it
and answer yes to the import prompt. REG files can be viewed
in
Notepad
by
right clicking on the file and selecting Edit.

--
All the Best,
Kelly

MS-MVP Win98/XP
[AE-Windows® XP]

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm


"Dmitriy Kopnichev" wrote in message
...
Hello
I get "Windows cannot access the specified device, path, or
file.
You
may
not have appropriate permissions to access the item." when I
double-click
a
file. I'm the only owner of the computer. How to get full
access
to
all
contents?

Importing the saved key didn't help. How to logon to the
"ME$(ME$@workgroup)" account?
"Roger Abell" wrote in message
...
NG list trimmed to security_admin

Have you yet tried importing the key that was saved into
an account ? When doing this, it will give you the option
to have it prompt you whenerver it is used, or to just do it.
You must select for it to just do it without prompting.
Account names like ME$ are usually the machine account
that represents the machine as a member in the domain.


--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
I haven't removed any account.
Isn't the "ME$(ME$@workgroup)" a user account? I used not the cipher,
but
"Encryption Details for" the file window in "Advanced Attributes" of the
file window. I saved a Private key to a .pfx file before I was joined
the
domain and my computer was renamed by the domain administrators.
"Roger Abell" wrote in message
...
You may own the machine and the files may be yours,
but if it is encrypted and you cannot prove to the system
that you are supposed to be able to decrypt it then it will
not let you.

The only way to prove that you are supposed to be able
to access the EFS encrypted file is to use an account that
has loaded into it the decryption key that corresponds to
the certificate that was used to encrypt the file.

When you renamed the machine, apparently starting down
the road of denied access, something seems to have removed
that capability. When you used cipher to look at the file it
said that there was no user account allowed to decrypt it,
instead indicating the machine was allowed to decrypt it.
That, assuming you have reported accurately what you saw,
is something with which I am unfamiliar, either as to why it
got that way or how to get out of that situation.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
This is my file. I'm the only computer owner.
"Roger Abell" wrote in message
...
code 5 is probably access failure
in this case since you do not have EFS capability to decrypt
you are not allowed to modify who can decrypt

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
I tried to add myself and/or another user to "Users Who Can
Transparently
Access this File" and got an error
"ERSADU
Error in adding new user(s). Error code 5."
"Roger Abell" wrote in message
...
When you look at the file's properties Security dialog
is anything checked for any group in the Deny column ?
You must highlight each group listed one at a time and
then look at what is Granted/Denied.
An account that is only in Administrators group is
actually also in other things to which there can be
NTFS Grants/Denies, like Authenticated Users,
Network, Interactive, Everyone. . . .
Not having EFS authorization appears as if it is a
NTFS permissions denial. You should use the cipher
commandline utility to examine the thumbprint info of
the file to see what accounts are allowed to decrypt it.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
How to become sure that there is no Deny for any group. The
file
is
EFS
protected. But I can open other EFS protected files.
"Roger Abell" wrote in message
...
This means that you have full control and it is inherited
from
some higher directory.
Are you sure that there is no Deny for some group, and if
there is make sure your account is not a member of the
group.
Deny overrides a Grant.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
I'm the Owner of the file and have full access, but the
"Effective
permissions" are all checked and grayed for me.
"Kelly" wrote in message
...
Without knowing more, see if this helps:

EXE and LNK Fix for Windows XP - Line 12
http://www.kellys-korner-xp.com/xp_tweaks.htm

To use the Regedit: Save the REG File to your hard
disk.
Double
click
it
and answer yes to the import prompt. REG files can be
viewed
in
Notepad
by
right clicking on the file and selecting Edit.

--
All the Best,
Kelly

MS-MVP Win98/XP
[AE-Windows® XP]

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm


"Dmitriy Kopnichev" wrote in message
...
Hello
I get "Windows cannot access the specified device,
path,
or
file.
You
may
not have appropriate permissions to access the
item."
when
I
double-click
a
file. I'm the only owner of the computer. How to get
full
access
to
all
contents?

ms-its:C:\WINDOWS\Help\ntcmds.chm::/cipher.htm and cipher help don't say
anything about Users Who Can Transparently Access a File or Data Recovery
Agents For a File.
"Roger Abell" wrote in message
...
NGs trimmed to security_admin

But what does cipher say ? The same ?
For the file to have an associated recovery agent
of Administrator it seems you had to have configured
a recovery agent (in XP). Was this machine a clean
install or an upgrade from W2k ??

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
"Data Recovery Agents For This File As Defined By Recovery Policy" is
"Administrator" is written in "Encryption Details for" the file window
in
"Advanced Attributes" window.
"Roger Abell" wrote in message
...
I believe that we earlier resolved that it is not an
NTFS permissions issue.
Administrator is a recovery agent only in Windows 2000.
Windows XP has no recovery agent until one is configured
or the machine is joined to an Active Directory.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
"the following people can decrypt an encrypted file.
Any user who was designated as a recovery agent" is written in the




http://support.microsoft.com/default...&Product=winxp
The user who was designated as a recovery agent is the
Administrator.
I
tried to decrypt the file under the Administrator account and got
the
same
error message "Error Applying Attributes
An error occurred applying attributes to the file:
Path:\Filename
Access is denied"
"Michael Solomon (MS-MVP Windows Shell/User)"
wrote
in
message ...
I don't know if you've seen this or if it will help but you might
want
to
have a look at the following Knowledge Base Article:





http://support.microsoft.com/default...&Product=winxp

--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/

"Dmitriy Kopnichev" wrote in message
...
The fixes didn't help.
"Kelly" wrote in message
...
Without knowing more, see if this helps:

EXE and LNK Fix for Windows XP - Line 12
http://www.kellys-korner-xp.com/xp_tweaks.htm

To use the Regedit: Save the REG File to your hard disk.
Double
click
it
and answer yes to the import prompt. REG files can be viewed
in
Notepad
by
right clicking on the file and selecting Edit.

--
All the Best,
Kelly

MS-MVP Win98/XP
[AE-Windows® XP]

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm


"Dmitriy Kopnichev" wrote in message
...
Hello
I get "Windows cannot access the specified device, path, or
file.
You
may
not have appropriate permissions to access the item." when I
double-click
a
file. I'm the only owner of the computer. How to get full
access
to
all
contents?

OK Roger, I think I got a little lost in this thread!:-)

--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/

"Roger Abell" wrote in message
...
Sure, I understand, but we already covered that ground
back toward the beginning of this (? he has started so many)
thread.

--
Roger

"Michael Solomon (MS-MVP Windows Shell/User)" wrote in
message ...
I'm inclined to agree, Roger. Sometimes, however, when what is supposed
to
work doesn't, it's worth a shot to try something that might be a cause
but
isn't directly indicated. I didn't feel there was any harm in exploring
the
option though I'm not sure if he can even take ownership of encrypted
files.

That said, something he had said about changing the computer or
workgroup
name, sorry I don't recall, triggered me to reconsider the possibility
of
a
file ownership issue.

--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/

"Roger Abell" wrote in message
...
I believe that we earlier resolved that it is not an
NTFS permissions issue.
Administrator is a recovery agent only in Windows 2000.
Windows XP has no recovery agent until one is configured
or the machine is joined to an Active Directory.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
"the following people can decrypt an encrypted file.
Any user who was designated as a recovery agent" is written in the




http://support.microsoft.com/default...&Product=winxp
The user who was designated as a recovery agent is the
Administrator.
I
tried to decrypt the file under the Administrator account and got
the
same
error message "Error Applying Attributes
An error occurred applying attributes to the file:
Path:\Filename
Access is denied"
"Michael Solomon (MS-MVP Windows Shell/User)"
wrote
in
message ...
I don't know if you've seen this or if it will help but you might
want
to
have a look at the following Knowledge Base Article:





http://support.microsoft.com/default...&Product=winxp

--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/

"Dmitriy Kopnichev" wrote in message
...
The fixes didn't help.
"Kelly" wrote in message
...
Without knowing more, see if this helps:

EXE and LNK Fix for Windows XP - Line 12
http://www.kellys-korner-xp.com/xp_tweaks.htm

To use the Regedit: Save the REG File to your hard disk.
Double
click
it
and answer yes to the import prompt. REG files can be viewed
in
Notepad
by
right clicking on the file and selecting Edit.

--
All the Best,
Kelly

MS-MVP Win98/XP
[AE-Windows® XP]

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm


"Dmitriy Kopnichev" wrote in message
...
Hello
I get "Windows cannot access the specified device, path, or
file.
You
may
not have appropriate permissions to access the item." when I
double-click
a
file. I'm the only owner of the computer. How to get full
access
to
all
contents?

While logged in as an admin schedule a cmd prompt
to open in a couole minutes using task scheduler.
When the cmd prompt opens, it is running as System
(which is the local identity known to the domain
as machinename$).
There is no way I know of to actually log in as that
account, as you do not know the password.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
Importing the saved key didn't help. How to logon to the
"ME$(ME$@workgroup)" account?
"Roger Abell" wrote in message
...
NG list trimmed to security_admin

Have you yet tried importing the key that was saved into
an account ? When doing this, it will give you the option
to have it prompt you whenerver it is used, or to just do it.
You must select for it to just do it without prompting.
Account names like ME$ are usually the machine account
that represents the machine as a member in the domain.


--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
I haven't removed any account.
Isn't the "ME$(ME$@workgroup)" a user account? I used not the cipher,
but
"Encryption Details for" the file window in "Advanced Attributes" of
the
file window. I saved a Private key to a .pfx file before I was joined
the
domain and my computer was renamed by the domain administrators.
"Roger Abell" wrote in message
...
You may own the machine and the files may be yours,
but if it is encrypted and you cannot prove to the system
that you are supposed to be able to decrypt it then it will
not let you.

The only way to prove that you are supposed to be able
to access the EFS encrypted file is to use an account that
has loaded into it the decryption key that corresponds to
the certificate that was used to encrypt the file.

When you renamed the machine, apparently starting down
the road of denied access, something seems to have removed
that capability. When you used cipher to look at the file it
said that there was no user account allowed to decrypt it,
instead indicating the machine was allowed to decrypt it.
That, assuming you have reported accurately what you saw,
is something with which I am unfamiliar, either as to why it
got that way or how to get out of that situation.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
This is my file. I'm the only computer owner.
"Roger Abell" wrote in message
...
code 5 is probably access failure
in this case since you do not have EFS capability to decrypt
you are not allowed to modify who can decrypt

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
I tried to add myself and/or another user to "Users Who Can
Transparently
Access this File" and got an error
"ERSADU
Error in adding new user(s). Error code 5."
"Roger Abell" wrote in message
...
When you look at the file's properties Security dialog
is anything checked for any group in the Deny column ?
You must highlight each group listed one at a time and
then look at what is Granted/Denied.
An account that is only in Administrators group is
actually also in other things to which there can be
NTFS Grants/Denies, like Authenticated Users,
Network, Interactive, Everyone. . . .
Not having EFS authorization appears as if it is a
NTFS permissions denial. You should use the cipher
commandline utility to examine the thumbprint info of
the file to see what accounts are allowed to decrypt it.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
How to become sure that there is no Deny for any group.
The
file
is
EFS
protected. But I can open other EFS protected files.
"Roger Abell" wrote in message
...
This means that you have full control and it is
inherited
from
some higher directory.
Are you sure that there is no Deny for some group, and
if
there is make sure your account is not a member of the
group.
Deny overrides a Grant.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
I'm the Owner of the file and have full access, but
the
"Effective
permissions" are all checked and grayed for me.
"Kelly" wrote in message
...
Without knowing more, see if this helps:

EXE and LNK Fix for Windows XP - Line 12
http://www.kellys-korner-xp.com/xp_tweaks.htm

To use the Regedit: Save the REG File to your hard
disk.
Double
click
it
and answer yes to the import prompt. REG files can
be
viewed
in
Notepad
by
right clicking on the file and selecting Edit.

--
All the Best,
Kelly

MS-MVP Win98/XP
[AE-Windows® XP]

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm


"Dmitriy Kopnichev" wrote in
message
...
Hello
I get "Windows cannot access the specified device,
path,
or
file.
You
may
not have appropriate permissions to access the
item."
when
I
double-click
a
file. I'm the only owner of the computer. How to
get
full
access
to
all
contents?

Sorry, I was being brain dead. The utility to use is
efsinfo.exe
that is part of the Support\Tools optional install on
the XP CD.
efsinfo /?
for usage info.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
ms-its:C:\WINDOWS\Help\ntcmds.chm::/cipher.htm and cipher help don't say
anything about Users Who Can Transparently Access a File or Data Recovery
Agents For a File.
"Roger Abell" wrote in message
...
NGs trimmed to security_admin

But what does cipher say ? The same ?
For the file to have an associated recovery agent
of Administrator it seems you had to have configured
a recovery agent (in XP). Was this machine a clean
install or an upgrade from W2k ??

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
"Data Recovery Agents For This File As Defined By Recovery Policy" is
"Administrator" is written in "Encryption Details for" the file window
in
"Advanced Attributes" window.
"Roger Abell" wrote in message
...
I believe that we earlier resolved that it is not an
NTFS permissions issue.
Administrator is a recovery agent only in Windows 2000.
Windows XP has no recovery agent until one is configured
or the machine is joined to an Active Directory.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
"the following people can decrypt an encrypted file.
Any user who was designated as a recovery agent" is written in the





http://support.microsoft.com/default...&Product=winxp
The user who was designated as a recovery agent is the
Administrator.
I
tried to decrypt the file under the Administrator account and got
the
same
error message "Error Applying Attributes
An error occurred applying attributes to the file:
Path:\Filename
Access is denied"
"Michael Solomon (MS-MVP Windows Shell/User)"
wrote
in
message ...
I don't know if you've seen this or if it will help but you
might
want
to
have a look at the following Knowledge Base Article:






http://support.microsoft.com/default...&Product=winxp

--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/

"Dmitriy Kopnichev" wrote in message
...
The fixes didn't help.
"Kelly" wrote in message
...
Without knowing more, see if this helps:

EXE and LNK Fix for Windows XP - Line 12
http://www.kellys-korner-xp.com/xp_tweaks.htm

To use the Regedit: Save the REG File to your hard disk.
Double
click
it
and answer yes to the import prompt. REG files can be viewed
in
Notepad
by
right clicking on the file and selecting Edit.

--
All the Best,
Kelly

MS-MVP Win98/XP
[AE-Windows® XP]

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm


"Dmitriy Kopnichev" wrote in message
...
Hello
I get "Windows cannot access the specified device, path,
or
file.
You
may
not have appropriate permissions to access the item." when
I
double-click
a
file. I'm the only owner of the computer. How to get full
access
to
all
contents?

I know all passwords used at my computer.
"Roger Abell" wrote in message
...
While logged in as an admin schedule a cmd prompt
to open in a couole minutes using task scheduler.
When the cmd prompt opens, it is running as System
(which is the local identity known to the domain
as machinename$).
There is no way I know of to actually log in as that
account, as you do not know the password.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
Importing the saved key didn't help. How to logon to the
"ME$(ME$@workgroup)" account?
"Roger Abell" wrote in message
...
NG list trimmed to security_admin

Have you yet tried importing the key that was saved into
an account ? When doing this, it will give you the option
to have it prompt you whenerver it is used, or to just do it.
You must select for it to just do it without prompting.
Account names like ME$ are usually the machine account
that represents the machine as a member in the domain.


--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
I haven't removed any account.
Isn't the "ME$(ME$@workgroup)" a user account? I used not the
cipher,
but
"Encryption Details for" the file window in "Advanced Attributes" of
the
file window. I saved a Private key to a .pfx file before I was
joined
the
domain and my computer was renamed by the domain administrators.
"Roger Abell" wrote in message
...
You may own the machine and the files may be yours,
but if it is encrypted and you cannot prove to the system
that you are supposed to be able to decrypt it then it will
not let you.

The only way to prove that you are supposed to be able
to access the EFS encrypted file is to use an account that
has loaded into it the decryption key that corresponds to
the certificate that was used to encrypt the file.

When you renamed the machine, apparently starting down
the road of denied access, something seems to have removed
that capability. When you used cipher to look at the file it
said that there was no user account allowed to decrypt it,
instead indicating the machine was allowed to decrypt it.
That, assuming you have reported accurately what you saw,
is something with which I am unfamiliar, either as to why it
got that way or how to get out of that situation.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
This is my file. I'm the only computer owner.
"Roger Abell" wrote in message
...
code 5 is probably access failure
in this case since you do not have EFS capability to decrypt
you are not allowed to modify who can decrypt

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
I tried to add myself and/or another user to "Users Who Can
Transparently
Access this File" and got an error
"ERSADU
Error in adding new user(s). Error code 5."
"Roger Abell" wrote in message
...
When you look at the file's properties Security dialog
is anything checked for any group in the Deny column ?
You must highlight each group listed one at a time and
then look at what is Granted/Denied.
An account that is only in Administrators group is
actually also in other things to which there can be
NTFS Grants/Denies, like Authenticated Users,
Network, Interactive, Everyone. . . .
Not having EFS authorization appears as if it is a
NTFS permissions denial. You should use the cipher
commandline utility to examine the thumbprint info of
the file to see what accounts are allowed to decrypt it.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
How to become sure that there is no Deny for any group.
The
file
is
EFS
protected. But I can open other EFS protected files.
"Roger Abell" wrote in message
...
This means that you have full control and it is
inherited
from
some higher directory.
Are you sure that there is no Deny for some group, and
if
there is make sure your account is not a member of the
group.
Deny overrides a Grant.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Dmitriy Kopnichev" wrote in message
...
I'm the Owner of the file and have full access, but
the
"Effective
permissions" are all checked and grayed for me.
"Kelly" wrote in message
...
Without knowing more, see if this helps:

EXE and LNK Fix for Windows XP - Line 12
http://www.kellys-korner-xp.com/xp_tweaks.htm

To use the Regedit: Save the REG File to your
hard
disk.
Double
click
it
and answer yes to the import prompt. REG files can
be
viewed
in
Notepad
by
right clicking on the file and selecting Edit.

--
All the Best,
Kelly

MS-MVP Win98/XP
[AE-Windows® XP]

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm


"Dmitriy Kopnichev" wrote in
message
...
Hello
I get "Windows cannot access the specified
device,
path,
or
file.
You
may
not have appropriate permissions to access the
item."
when
I
double-click
a
file. I'm the only owner of the computer. How to
get
full
access
to
all
contents?