Microsoft utility 'subinacl.msi'

Can someone tell me if the Microsoft utility 'subinacl.msi' will work for W10.
I've made a bit of a mess of my permissions I think. I have a MSI Nightblade with a 2 x mSATA boot drive for Windows and major apps, and a HDD for everything else.
Most things seem OK, but some programs don't run. I'm told to login with administrator privileges and try again. This is for an old program that worked previously on another W10 box.
I figured a utility like subinacl.msi may put things back to normal, if it works for 10.
Any ideas please.
Trevor

Hi,

I hope you solved your problem in the mean time but still:

Yes it works fine under W10 not sure if it will help with your particular problem though.

After installing 'subinacl.msi' open an admin command prompt and run the following by pasting it into the command box:

@echo off
title Resetting ACLs...
cd /d "%ProgramFiles(x86)%\Windows Resource Kits\Tools"
echo.
echo Resetting ACLs...
echo (this may take several minutes to complete)
echo.
echo ==========================================================================
echo.
echo System Drive...
subinacl /subdirectories %SystemDrive% /grant=administrators=f /grant=system=f
echo.
echo.
echo Windows Directory...
subinacl /subdirectories %windir%\*.* /grant=administrators=f /grant=system=f
echo.
echo.
echo ==========================================================================
echo.
echo FINISHED.
echo.
echo Press any key to exit . . .
pause >NUL

Alternatively, you can save the above text as a batch file by opening notepad and paste it there then saving it and changing the .txt extension to .bat. Remember to run it with admin rights though.

Cheers,

Hi,
Thanks for the reply.
I still have an issue or two, but I'll give it a go when I can.
Thanks

hey there @fdegrove, this tool should also revert my changes that I've made on Permission settings (described post here)?
I've used this tool following your instructions but the Owner is the same nothing change back.

In a few words, I am interested to revert back the default state of the C:\ Owner (I suppose that there are some conditions there is not enough to set the Truetedinstaller to Full access, am I right?)
Any thoughts? I appreciate it!

Hi,

Yes, it should. Provided you are a member of the "Administrators" group that is.
If you read through the batch file I posted it shows you exactly what it does.

Cheers,

very strange ...there was no error at the end. Thanks, I'll do that again.
LE: the same. But by default, reverting back to the Trustedinstaller should I check the "Replace owner on the subcontainers and objects" and "Replace all child object permission entries with inheritable permission entries from this object" options?

Sara said:

very strange ...there was no error at the end. Thanks, I'll do that again.
LE: the same. But by default, reverting back to the Trustedinstaller should I check the "Replace owner on the subcontainers and objects" and "Replace all child object permission entries with inheritable permission entries from this object" options?

No. Directories inside C:\Windows aren't all owned by TrustedInstaller. Some are Administrators or SYSTEM.

Code:

C:\WINDOWS\system32>dir c:\ /a:d /q
 Volume in drive C has no label.
 Volume Serial Number is 63D0-2EE0

 Directory of c:\

23-Mar-17  13:31    <DIR>          NT AUTHORITY\SYSTEM    $Recycle.Bin
08-Apr-17  10:56    <DIR>          BUILTIN\Administrators $WINDOWS.~BT
08-Apr-17  10:56    <DIR>          BUILTIN\Administrators $Windows.~WS
07-Apr-17  20:22    <DIR>          BUILTIN\Administrators Config.Msi
30-Jan-17  21:59    <JUNCTION>     NT AUTHORITY\SYSTEM    Documents and Settings [C:\Users]
07-Apr-17  20:21    <DIR>          X201\Hali              OneDriveTemp
18-Mar-17  23:03    <DIR>          NT AUTHORITY\SYSTEM    PerfLogs
22-Mar-17  00:05    <DIR>          NT SERVICE\TrustedInstaProgram Files
22-Mar-17  00:05    <DIR>          NT SERVICE\TrustedInstaProgram Files (x86)
25-Mar-17  22:19    <DIR>          NT AUTHORITY\SYSTEM    ProgramData
22-Mar-17  08:54    <DIR>          BUILTIN\Administrators Recovery
22-Mar-17  00:10    <DIR>          BUILTIN\Administrators System Volume Information
02-Apr-17  18:33    <DIR>          NT AUTHORITY\SYSTEM    Users
27-Mar-17  21:05    <DIR>          NT SERVICE\TrustedInstaWindows
               0 File(s)              0 bytes
              15 Dir(s)  30,483,259,392 bytes free

C:\WINDOWS\system32>dir c:\windows /a:d /q
 Volume in drive C has no label.
 Volume Serial Number is 63D0-2EE0

 Directory of c:\windows

27-Mar-17  21:05    <DIR>          NT SERVICE\TrustedInsta.
27-Mar-17  21:05    <DIR>          NT SERVICE\TrustedInsta..
18-Mar-17  23:03    <DIR>          NT SERVICE\TrustedInstaaddins
24-Mar-17  04:43    <DIR>          NT AUTHORITY\SYSTEM    appcompat
19-Mar-17  04:28    <DIR>          NT SERVICE\TrustedInstaAppPatch
08-Apr-17  15:56    <DIR>          NT AUTHORITY\SYSTEM    AppReadiness
24-Mar-17  01:19    <DIR>          BUILTIN\Administrators assembly
18-Mar-17  23:03    <DIR>          NT SERVICE\TrustedInstabcastdvr
19-Mar-17  04:31    <DIR>          NT SERVICE\TrustedInstaBitLockerDiscoveryVolumeContents
18-Mar-17  23:03    <DIR>          NT SERVICE\TrustedInstaBoot
18-Mar-17  23:03    <DIR>          NT SERVICE\TrustedInstaBranding
07-Apr-17  12:12    <DIR>          BUILTIN\Administrators CbsTemp
30-Jan-17  22:01    <DIR>          ...                    CSC
18-Mar-17  23:03    <DIR>          NT SERVICE\TrustedInstaCursors
22-Mar-17  00:12    <DIR>          NT AUTHORITY\SYSTEM    debug
18-Mar-17  23:03    <DIR>          NT SERVICE\TrustedInstadiagnostics
19-Mar-17  04:28    <DIR>          NT AUTHORITY\SYSTEM    DigitalLocker
01-Feb-17  00:28    <DIR>          BUILTIN\Administrators Downloaded Installations
22-Mar-17  00:07    <DIR>          NT SERVICE\TrustedInstaDownloaded Program Files
18-Mar-17  23:03    <DIR>          NT SERVICE\TrustedInstaELAMBKUP
19-Mar-17  04:28    <DIR>          NT SERVICE\TrustedInstaen-US
22-Mar-17  00:09    <DIR>          NT SERVICE\TrustedInstaFonts
18-Mar-17  23:03    <DIR>          NT SERVICE\TrustedInstaGameBarPresenceWriter
18-Mar-17  23:03    <DIR>          NT SERVICE\TrustedInstaGlobalization
19-Mar-17  04:28    <DIR>          NT AUTHORITY\SYSTEM    Help
22-Mar-17  00:10    <DIR>          NT SERVICE\TrustedInstaHoloShell
19-Mar-17  04:28    <DIR>          NT SERVICE\TrustedInstaIME
22-Mar-17  08:42    <DIR>          NT SERVICE\TrustedInstaImmersiveControlPanel
08-Apr-17  03:44    <DIR>          NT SERVICE\TrustedInstaINF
18-Mar-17  23:03    <DIR>          NT SERVICE\TrustedInstaInfusedApps
18-Mar-17  23:03    <DIR>          NT AUTHORITY\SYSTEM    InputMethod
07-Apr-17  20:22    <DIR>          BUILTIN\Administrators Installer
18-Mar-17  23:03    <DIR>          NT SERVICE\TrustedInstaL2Schemas
22-Mar-17  00:05    <DIR>          NT AUTHORITY\SYSTEM    LiveKernelReports
08-Apr-17  10:56    <DIR>          NT AUTHORITY\SYSTEM    Logs
18-Mar-17  23:03    <DIR>          NT SERVICE\TrustedInstaMedia
08-Apr-17  01:46    <DIR>          NT SERVICE\TrustedInstaMicrosoft.NET
18-Mar-17  23:03    <DIR>          NT AUTHORITY\SYSTEM    Migration
23-Mar-17  13:47    <DIR>          NT SERVICE\TrustedInstaMiracastView
18-Mar-17  23:03    <DIR>          NT AUTHORITY\SYSTEM    ModemLogs
19-Mar-17  04:30    <DIR>          NT SERVICE\TrustedInstaOCR
18-Mar-17  23:03    <DIR>          NT SERVICE\TrustedInstaOffline Web Pages
08-Apr-17  11:24    <DIR>          BUILTIN\Administrators Panther
18-Mar-17  23:03    <DIR>          NT SERVICE\TrustedInstaPerformance
18-Mar-17  23:03    <DIR>          NT AUTHORITY\SYSTEM    PLA
19-Mar-17  04:31    <DIR>          NT SERVICE\TrustedInstaPolicyDefinitions
09-Apr-17  14:55    <DIR>          BUILTIN\Administrators Prefetch
23-Mar-17  13:47    <DIR>          NT SERVICE\TrustedInstaPrintDialog
18-Mar-17  23:03    <DIR>          NT SERVICE\TrustedInstaProvisioning
22-Mar-17  00:11    <DIR>          BUILTIN\Administrators Registration
19-Mar-17  04:31    <DIR>          NT AUTHORITY\SYSTEM    RemotePackages
22-Mar-17  00:13    <DIR>          NT SERVICE\TrustedInstarescache
18-Mar-17  23:03    <DIR>          NT SERVICE\TrustedInstaResources
18-Mar-17  23:03    <DIR>          NT AUTHORITY\SYSTEM    SchCache
22-Mar-17  08:58    <DIR>          NT SERVICE\TrustedInstaschemas
19-Mar-17  04:31    <DIR>          NT SERVICE\TrustedInstasecurity
22-Mar-17  00:03    <DIR>          NT AUTHORITY\SYSTEM    ServiceProfiles
19-Mar-17  04:28    <DIR>          NT SERVICE\TrustedInstaservicing
22-Mar-17  09:00    <DIR>          BUILTIN\Administrators Setup
18-Mar-17  23:03    <DIR>          NT SERVICE\TrustedInstaShellExperiences
19-Mar-17  04:29    <DIR>          NT SERVICE\TrustedInstaSKB
22-Mar-17  00:12    <DIR>          NT AUTHORITY\SYSTEM    SoftwareDistribution
18-Mar-17  23:03    <DIR>          NT SERVICE\TrustedInstaSpeech
18-Mar-17  23:03    <DIR>          NT SERVICE\TrustedInstaSpeech_OneCore
18-Mar-17  23:03    <DIR>          NT SERVICE\TrustedInstaSystem
07-Apr-17  20:26    <DIR>          NT SERVICE\TrustedInstaSystem32
19-Mar-17  04:31    <DIR>          NT AUTHORITY\SYSTEM    SystemApps
19-Mar-17  04:31    <DIR>          NT SERVICE\TrustedInstaSystemResources
07-Apr-17  20:11    <DIR>          NT SERVICE\TrustedInstaSysWOW64
18-Mar-17  23:03    <DIR>          NT AUTHORITY\SYSTEM    TAPI
22-Mar-17  00:10    <DIR>          NT AUTHORITY\SYSTEM    Tasks
09-Apr-17  14:13    <DIR>          NT AUTHORITY\SYSTEM    Temp
18-Mar-17  23:03    <DIR>          NT AUTHORITY\SYSTEM    tracing
18-Mar-17  23:03    <DIR>          NT SERVICE\TrustedInstatwain_32
18-Mar-17  23:03    <DIR>          NT AUTHORITY\SYSTEM    Vss
18-Mar-17  23:03    <DIR>          NT SERVICE\TrustedInstaWeb
08-Apr-17  01:46    <DIR>          NT SERVICE\TrustedInstaWinSxS
               0 File(s)              0 bytes
              77 Dir(s)  30,483,259,392 bytes free

C:\WINDOWS\system32>

@​lx07 Thanks, and is there any possibility to automatically restore these settings as you shown above?
I suppose that is a long list, you exposed just a part of it ...am I right?

Sara said:

@​lx07 Thanks, and is there any possibility to automatically restore these settings as you shown above?
I suppose that is a long list, you exposed just a part of it ...am I right?

I don't know how I'm afraid.

There are some places with odd authority ("C:\Program Files\WindowsApps", "C:\Windows\Fonts", "C:\Windows\WinSxS") but there may be others.

According to "how-do-i-restore-security-settings-to-a-known-working-state" secedit is no longer supported to reset default permissions and you would have to manually set permissions with icacls if you have no backup. This might be an impossibly big task.

There is a list for Windows 7 here and it is huge (and out of date of course).

Perhaps if you have no backup it is better (and quicker) to clean install. You can just leave it if it is working but the security implications of that I don't know - it depends what you changed. Administrators having full authority to everything would certainly be a risk especially if your user is part of Administrators group though.

good to know thanks, meanwhile I've found a tool. Hope that will helps, if not clean install of course.