Re: Cannot install new printer drivers

Martin,

That's weird that I missed your posts. I am using a newsreader (NNTP).

The w32x86 permissions are exactly the same as mine and look appropriate, so
I think they are correct.

There are some things I do not understand about the access to the 3 folder.
I will post to microsoft.public.windowsxp.print_fax, if you are interested
in following up on that.

In order to reset permissions correctly, I would recommend doing the
following:
- Right-click on C:\windows\system\spool\drivers and click Properties (be
careful to get exactly the right path).
- On the Security page, choose Advanced.
- Check the 'Replace permission entries on all child objects with entries
shown here that apply to child objects' check box and click OK.

To answer your question about how the 2 folder lost its DACL, I suppose you
would have to follow the same steps again one by one to see which one caused
it. After each step, you can use CACLS to check the DACL. For finer control,
you can use Process Monitor. Too bad you cannot use auditing, as you have
Home not Professional. I do think it might be worthwhile doing this, as an
understanding of what caused it will help ensure it does not happen
unexpectedly again to you or to anyone else who might write this. If we can
pinpoint the error, we may even be able to complain to the software vendor
so their shoddy software development can be exposed. I am a software
developer myself, and I cannot stand shoddy work that software vendors get
away with simply because they can.

Paul


I was installing and removing printers. I installed a local shared
printer, I installed an additional driver for Win9x on that printer, I
connected to it from another computer on my home network, and then I
removed the printer. Then I could not install any more printers. What
part of this deleted the ACL?
"Martin B. Brilliant" <mbrilliant@xxxxxxxxxxxx> wrote in message
news:46d61447.3119859@xxxxxxxxxxxxxxxxxxxxxxxxx
Paul,

You missed my last three posts. I was posting on the Microsoft
communities newsgroups website, and they showed up there. But I just
looked in the newsgroup (microsoft.public.windowsxp.print_fax) with a
real newsreader (Free Agent), and they aren't there. Your message
(shown below) appeared in both the website and the newsgroup.

So there's a lot of catching up to do. In brief, I solved the printer
problem, and then got myself in worse trouble.

On 8/26/2007 9:46 AM PST I posted:

---------------------------------------
Sorry about the delay. For some reason I did not get email notice of
your reply.

I just tried CACLS. The results are interesting. Could you please
explain how this works? How I can write in a directory but the System,
impersonating me, can't?

For the ...\3 folder I got just the name of the directory, nothing
else:

C:\windows\system32\spool\drivers\w32x86\3

That's all she wrote!

For the parent directory I got a lot more:

C:\windows\system32\spool\drivers\w32x86 Everyone:R
Everyone:(OI)(CI)(IO)(special access:)

GENERIC_READ
GENERIC_EXECUTE

BUILTIN\Users:R
BUILTIN\Users:(OI)(CI)(IO)(special access:)


GENERIC_READ

GENERIC_EXECUTE

BUILTIN\Administrators:F
BUILTIN\Administrators:(OI)(CI)(IO)F
NT AUTHORITY\SYSTEM:F
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F
CREATOR OWNER:(OI)(CI)(IO)F

So, in C:\WINDOWS\system32\spool\drivers\w32x86, I entered

cacls 3 /e /p BUILTIN\Administrators:F

and now I can install printers just the way I used to!

I have no fax, but I hope removing fax and reinstalling it in
Add/Remove Windows Components will work now (it didn't work before).
----------------------------------

I did, in fact, get the fax working again.

On 8/28/2007 12:51 AM PST I posted:

---------------------------------------
I found the answer to the question I just asked.

Subfolder "3" must have had a NULL ACL, that is, no ACL, which means
access is granted to everybody. When subfolder "New" was created in
"3" it first got an empty ACL, and then it inherited all its parent's
ACEs, that is, none. An empty ACL, unlike a NULL ACL, denies access to
everybody. Therefore an attempt to create a file in "New" resulted in
ACCESS DENIED.

I could delete printers because subfolder "3" had a NULL ACL. I could
not install printers because that required creating files in a
subfolder of "3", snf all subfolders of "3" had empty ACLs. That
answers my previous question about "what kind of access control is
this?"

The next question is, how did subfolder "3" lose its ACL?

I was installing and removing printers. I installed a local shared
printer, I installed an additional driver for Win9x on that printer, I
connected to it from another computer on my home network, and then I
removed the printer. Then I could not install any more printers. What
part of this deleted the ACL?

By the way, I went into Safe Mode and arranged for "3" (and all its
siblings) to inherit permissions from its parent, instead of the
stopgap ACE I originally put in.
-------------------------------------------

Then on 8/28/2007 6:15 PM PST I was once again frantic:

Help! I can't boot Windows. I can't start anything except Recovery
Console. I must have done something wrong in ACLview. I did notice
that there were no permissions one way or the other for the Windows
folder. Now any attempt at a normal boot stops with a cyan screen with
nothing but a working mouse cursor on it. No response to
CTRL-ALT-DELETE either.

I know this is the wrong discussion group for this problem. What's the
right one?
-------------------------

I later posted a query on microsoft.public.windowsxp.help_and_support
on 8/29/2007 5:59 PM (that must be EDT) with the title "Win XP Home
boots to the wrong copy - change systemroot?" That post tells where I
stand now.

On Wed, 29 Aug 2007 13:54:46 -0400, "Paul Baker [MVP, Windows - SDK]"
<paulb@xxxxxxxxxxxxxxxxxxxxxxx> wrote:

Martin,

It's been almost a week since I wrote this, and you seemed pretty
desparate
now that I persuaded you to delete all your third party print spooler
components, so I am suprised that I did not yet see a reply. Is
everything
okay over there?

Paul


Marty
Martin B. Brilliant at home in Holmdel, NJ


.

Relevant Pages

  • Re: Cannot install new printer drivers
    ... using the subject "NULL DACL versis Empty DACL and Owner implcit ... Then I could not install any more printers. ... Subfolder "3" must have had a NULL ACL, that is, no ACL, which means ...
    (microsoft.public.windowsxp.print_fax)
  • Re: Cannot install new printer drivers
    ... appeared in both the website and the newsgroup. ... and now I can install printers just the way I used to! ... Subfolder "3" must have had a NULL ACL, that is, no ACL, which means ... I could delete printers because subfolder "3" had a NULL ACL. ...
    (microsoft.public.windowsxp.print_fax)
  • Re: Error Printing
    ... On the SBS server, Printers and Faxes folder, right-click on the printer> ... properties> security tab> adjust the permissions on the ACL of to give ...
    (microsoft.public.windows.server.general)
  • Strange ACL Permissions
    ... When I pressed the install button. ... I opened up the disk utility and tried to repair permissions. ... ACL found but not expected on "Applications". ...
    (comp.sys.mac.system)
  • Re: Allowing installation of local printers
    ... What permissions are required to allow a user to install local ... To install Printers I deployed a "inst_printer.cmd" to their desktops ...
    (microsoft.public.win2000.group_policy)