Re: Cannot Access "Program Files"


Thanks for the reply, and my apologies for not getting back to you
sooner. The owner of that PC decided to live with the problem so I
stopped following this, and I signed up for the forum using a throwaway
email account which I do not check very often so I also did not
immediately receive the notice that you had posted a possible
solution.

I will forward this on to the user and perhaps they will have a change
of heart and at least try this. I assume that since it says you have
to be "the" adminstrator, you must do this is safe mode.

I am also not sure why you presented the last paragraph of the
solution. They never wanted to deny any user or group access, and
still don't. The problem is that all of a sudden only one user could
access Program Files when they wanted all users to be able to access
it, and could not seem to correct the problem.

If they decide to give it a try, I will report back. It is the least I
can do, and again my thanks and apologies.


=?Utf-8?B?UnV0Z2VyIEgu?= Wrote:
Hi,

Log on as the administrator, open explorer, right click "Program
Files",
click the tab "security", click "advanced", click the "Owner" tab,
select
administrators, select the "Replace owner on subcontainers and object"
box,
click aply. Might take a while depending on the number of files located
in
program files.

If you don't see the security tab, click "Tools" -> "Folder options" ->
tab
"View" -> deselect the simple file sharing (recommended) tab.

In the same security tab, although it's not a recommended method, you
can
deny members of the "users" group access to the program files folder.
A
better method is to create a local group, deny it permissions, add just
the
users that you want to deny acces to.

For more info search support.microsoft.com for NTFS.

Hope it helped, good luck!

Rutger H.

"kenwood" wrote:


Recently I was asked to look at a Windows XP PC that had locked all
users but one out of the â??Program Filesâ?? directory so they could
not
run any programs. If you try to look at the directory contents with
â??Windows Explorerâ?? as one of those locked out users, you receive
an
â??Access Deniedâ?? message. All the accounts have administrative
privileges.

The one exception is the first user account that was created on the
PC.
It can see the contents of the â??Program Filesâ?? directory, and it
can
also run programs located there. That account also has
administrative
rights, but if you use that account to create a new user account
with
administrative rights, that new user account also cannot access the
â??Program Filesâ??. An examination of the new account after the
fact
confirms that administrative rights were granted during the creation
process.

In safe mode two accounts appear as possible logins. The user
account
that works correctly and the â??Administratorâ?? account. If you
login
under â??Administratorâ?? you find that it also cannot access the
â??Program
Filesâ?? directory. Only that one user can access the â??Program
Filesâ??
directory for both safe and normal modes.

Scanning software that was run while the PC was in safe mode showed
no
indication of any malware.

Any ideas short of a complete reinstall? Would the â??Repairâ??
option on
the XP install CD be of any use?





.

Relevant Pages

  • Re: Need to filter domain admin from GPO
    ... But think always about the part that a deny is the highest blocking you set and if you forget that you have set a deny or you are not in and someone else have to search for errors, it will be really heavy to find it. ... It's best practice to use a 2nd administrator account as your ... Block inheritance (I would have to move the domain admin from ... particular GPO using ACL deny. ...
    (microsoft.public.windows.group_policy)
  • Re: Web Server 2003 File Sharing
    ... > I've tried removing Deny Everyone, but this doesn't seem to help. ... > Administrator account name. ... > the new administrator credentials ... >>Can anyone give me any pointers as to what Local Security Policy ...
    (microsoft.public.windows.server.general)
  • Re: Wierd permissions on user accounts
    ... That said, as I mentioned earlier, your permissions are bad. ... *nobody* will be able to change password on the account. ... I have the following deny rules.. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Exchange 2003 full mailbox permissions
    ... to check for inherited deny permissions on the organization object. ... However, since my account is not a member of Administrators, Domain ... Admins or Enterprise Admins I am not inheriting any Deny permissions ... "Note In Microsoft Windows 2000 Server and Microsoft Windows Server ...
    (microsoft.public.exchange.admin)
  • Re: Exmerge problem / No Objects in RootDSE
    ... The problem is likely that the account you are using has Domain Admin ... Domain admins will by default have a Deny placed on Send As/Receive ... It's normally recommended to create a dedicated account for running Exmerge ... If you go to the properties of the mailbox store and go to the security tab, ...
    (microsoft.public.exchange.admin)
Loading