Partager via

Notes about a couple of possible issues while using the SubInAcl tool

  • Article

********************************

Important note - if you were referred to this blog post from this knowledge base article and are having trouble running SubInAcl or reset.cmd, please try the steps listed in my other blog post first - https://blogs.msdn.com/b/astebner/archive/2006/09/04/solving-setup-errors-by-using-the-subinacl-tool-to-repair-file-and-registry-permissions.aspx.

********************************

A while back, I posted some instructions for using a tool from the Windows Resource Kit named SubInAcl that can be used to update file, folder and registry permissions.  This tool can help fix some types of access denied errors that can be encountered while trying to install products, hotfixes and service packs on Windows.

Since that original post, I have heard from some people who have run into various types of problems while attempting to install and use the SubInAcl tool.  I wanted to post more details about a few of these scenarios in case other folks run into similar issues in the future.

Issue 1 - Running SubInAcl reports an error on some non-English operating systems

On some non-English operating systems, customers have reported seeing errors like the following when trying to use the command lines listed in my previous blog post:

LookupAccountName : HKEY_CURRENT_USER:administrators 1337 The security ID structure is invalid.

The reason for this error is that on some non-English operating systems, the name of the Administrators group is translated into the OS language.  If you are running SubInAcl on a non-English OS where the name of the Administrators group is translated, you will need to update each of the command lines for SubInAcl to specify the translated name of the Administrators group.

Issue 2 - SubInAcl.msi fails to install

I have heard from a few people who were not able to get the SubInAcl.msi installer to work correctly on their systems, which prevented them from being able to use the tool.  If you run into an error while installing SubInAcl.msi to install this tool, you can get a copy of the tool that does not require a full installation from an alternate location by using the following steps:

  1. Download SubInAcl.zip and save it to your local computer
  2. Extract the contents of the zip file to a local folder on your system
  3. Use the steps in the previous blog post to run SubInAcl from the extracted location with the following modifications:
    1. Skip step 1 - there is no need to download and install subinacl.msi because subinacl.zip contains the same files that would normally be installed by subinacl.msi
    2. Depending on where you extract the zip file to in step 2 above, you may need to edit reset.cmd and change the folder path that it is trying to run subinacl.exe from

Note - you should first attempt to install and run SubInAcl.msi before downloading and extracting this zip file.  This zip file is only intended for cases where for some reason, SubInAcl.msi will not install correctly - which unfortunately can sometimes happen because of one of the same issues that SubInAcl is designed to fix.

Issue 3 - How to get SubInAcl to create a log file

SubInAcl is a console application, which means that the output that it prints will be displayed in the console window by default.  For the command lines listed in my previous blog post, SubInAcl prints a lot of information, and if any errors occur, it will quickly scroll off the screen and you won't be able to see the details of the errors.

For a console application like SubInAcl, running it from a cmd prompt and putting a greater than sign and then the name of a file at the end of the command line (such as > %temp%\subinacl_output.txt) will cause the output to be redirected to a file.  I recently updated the command lines in that post and in the example script I posted on my file server to use this syntax to redirect the output to a file instead of printing it to the console.

Note - creating a log file as described above will not work if you run SubInAcl from the Windows start menu.  It has to be run from a cmd prompt in order to allow the log file to be created.

<update date="3/30/2009"> Fixed broken download links that are contained in this post. </update>

<update date="10/7/2014"> Added a note to the top of this post with alternate instructions for people who were referred to this blog post from this knowledge base article. </update>

<update date="4/14/2015"> Clarified the steps in Issue 2 </update>

Comments

  • Anonymous
    June 17, 2008
    PingBack from http://blogs.msdn.com/astebner/archive/2006/09/04/solving-setup-errors-by-using-the-subinacl-tool-to-repair-file-and-registry-permissions.aspx

  • Anonymous
    March 28, 2009
    Here is the script which worked on Vista Buisness SP1 Spanish Version:cd /d "%programfiles%Windows Resource KitsTools"subinacl /subkeyreg HKEY_CURRENT_USER /grant=administradores=f /grant=system=f /grant=restringido=r /grant=YOURUSERNAME=f /setowner=administradores > %temp%subinacl_output.txtsubinacl /keyreg HKEY_CURRENT_USER /grant=administradores=f /grant=system=f /grant=restringido=r /grant=YOURUSERNAME=f /setowner=administradores >> %temp%subinacl_output.txtsubinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administradores=f /grant=system=f /grant=usuarios=r /grant=todos=r /grant=restringido=r /setowner=administradores >> %temp%subinacl_output.txtsubinacl /keyreg HKEY_LOCAL_MACHINE /grant=administradores=f /grant=system=f /grant=usuarios=r /grant=todos=r /grant=restringido=r /setowner=administradores >> %temp%subinacl_output.txtsubinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administradores=f /grant=system=f /grant=usuarios=r /setowner=administradores >> %temp%subinacl_output.txtsubinacl /keyreg HKEY_CLASSES_ROOT /grant=administradores=f /grant=system=f /grant=usuarios=r /setowner=administradores >> %temp%subinacl_output.txtsubinacl /subdirectories %programfiles% /grant=administradores=f /grant=system=f /grant=usuarios=e >> %temp%subinacl_output.txtsubinacl /subdirectories %windir% /grant=administradores=f /grant=system=f /grant=usuarios=e >> %temp%subinacl_output.txt

  • Anonymous
    April 07, 2012
    I'm not sure which versions of Windows allow CMD files to be run. I'm only familiar with batch files. So many may need to name the batch/command file RESET.BAT, instead.If running the tool on a system that uses a ramdisk for the TEMP/TMP directories, you may need to redirect the log file to another drive. Change the RESET.BAT/CMD file to replace %temp% with C: or something like that. Otherwise the ram disk will store the log file, which could cause problems if the ram drive quickly fills up (and would mean no log file if your system crashes).The author will be pleased to know how annoyed rivals of his Sooners are, that they're (we're) relying on a Sooner to fix our PCs. Noticed the crimson/white in the utility, too. Blech. ಠ_ಠ

  • Anonymous
    March 07, 2013
    Thank you very much, Aaron Stebner and dmendt(spanish version)

  • Anonymous
    September 22, 2013
    The comment has been removed

  • Anonymous
    September 22, 2013
    Hi John - What is the exact text of the error message that you see?  Also, do you see it when you install VS 2012, or when you are trying to use VS 2012 after setup completes?It might help to post a question about your scenario on the VS forum at social.msdn.microsoft.com/.../home.

  • Anonymous
    November 01, 2013
    The comment has been removed

  • Anonymous
    November 01, 2013
    Hi ABEEE - Yes, these steps should work on Windows 7.  This tool doesn't solve all possible setup problems though.  What is the exact error you see when trying to install the applications on your computer, and do you have any log files from the failing installs that I could take a look at to try to figure out the root cause of the failures?

  • Anonymous
    December 31, 2013
    I am having error 1603 installing turbotax. tried full control, msconfig selective startup, fixed .net framework still the error is there. please help i need to install it

  • Anonymous
    December 31, 2013
    Hi Turbotax - Error code 1603 is a generic error that means that setup failed, but it doesn't give any more detailed information about why it failed.  I'd suggest contacting TurboTax technical support to see if they can help you examine the setup log files created by TurboTax setup and narrow down the cause of the failure further.

  • Anonymous
    May 24, 2014
    Hi,Does Subincl work in windows 2008 platform ?I have tried and got a bug. I am unable to fix that.

  • Anonymous
    May 24, 2014
    Hi Das - I don't know of any reason why SubInAcl wouldn't work on Windows Server 2008. What exact error are you seeing when you try it?

  • Anonymous
    May 25, 2014
    Hello Aaron,I tried on windows 2008 enterprise edition. Below is one of the few bugs I'm posting:The system cannot find message text for message number 0x2350 in the message file for Application.The system cannot find message text for message number 0x2334 in the message file for Application.C:Usersuser2>systeminfo |moreServer1234Microsoftr Windows Serverr 2008 Enterprise:Microsoft Corporation:Multiprocessor FreeWindows User:92516-082-2500885-766651/7/2011, 6:14:05 AM5/25/2014, 6:50:58 PMVMware, Inc.VMware Virtual Platformx64-based PCI tried this in command. Also another bug is like the no options come in My Computer>PropertiesIt is blank except it shows the computer name.

  • Anonymous
    May 25, 2014
    Hi Das - The errors about missing message text could mean that the file that contains those messages is missing from your computer, or it could mean that a couple of specific messages do not have valid error text.  In either case, those are not fatal errors and you can probably safely ignore them.I haven't seen a problem before like the one you describe with options missing from My Computer | Properties.  For that issue, I'd suggest posting a question on the Windows Server forums at social.technet.microsoft.com/.../home to see if someone there can help provide a workaround or a fix.

  • Anonymous
    June 08, 2014
    Hey man, I had to get the SubinAcl tool to help fix a problem with my computer. I got this error message and was wondering if you could help?'subinacl' is not recognized as an internal or external command,operable program or hatch file.

  • Anonymous
    June 09, 2014
    Hi Bradyn - That error most likely means that SubInAcl.exe isn't installed at the expected location or you didn't change directories in the command prompt to the directory that SubInAcl is installed to before running reset.cmd.  I'd suggest double-checking both of those issues.

  • Anonymous
    June 12, 2014
    Hi Aaron - I am having the same problem as Bradyn in that when I ran the SubinAcl tool I got the same error message repeated four times"'subinacl' is not recognized as an internal or external command, operable program or hatch file."What is the location the file should have been installed? Could you also clarify what you meant by changing directories in the command prompt before running rest.cmd

  • Anonymous
    June 12, 2014
    Hi Alan and Bradyn - The comment I made about changing directories was based on an older version of reset.cmd.  I updated that script a while back to fix that issue, so you shouldn't need to worry about that anymore.  I just uploaded a new version of reset.cmd.txt with some additional error logging that should help narrow down why you're seeing this error.  Can you please give it a try and see what it reports?SubInAcl should be installed to c:Program Files (x86)Windows Resource KitsToolssubinacl.exe (if your OS is 64-bit) or c:Program FilesWindows Resource KitsToolssubinacl.exe (if your OS is 32-bit).

  • Anonymous
    June 12, 2014
    Hi Aaron,Could you tell me where i can find how is translated user group? My system is in polish. I could find easly that in my system "administratos" translate to "administratorzy" and that works, but I couldn't translate others. Apparently, by looking at spanish version in second post, I have also "users", "everyone", and "restricted". I've tried what I thought should be translated version, but it didn't actually work. I'm sure there is some very easy way to find out.

  • Anonymous
    June 15, 2014
    Hi Garpagan - I don't know a definitive way to find those values on all versions of Windows.  I think some of the strings are left in English in some non-English versions of Windows, so you might want to try that first.  If that doesn't work, then I think you can find the values by going to regedit.exe, right-clicking on a registry value, choosing Permissions and looking at the options that appear there.

  • Anonymous
    July 01, 2014
    SubinAcl reports many failures.

  • Anonymous
    July 01, 2014
    Hi Paul - What kind of failures are you seeing?

  • Anonymous
    July 02, 2014
    In Windows XP SP3 Shadow, that is a mix of english and spanish version, it worked using the english version but changing restricted to restringido and everyone to todos.

  • Anonymous
    July 03, 2014
    Still not working! :(

  • Anonymous
    July 03, 2014
    In answer to earlier question about 'subinacl' is not recognized as an internal or external command, operable program or hatch file. You say "SubInAcl should be installed to c:Program Files (x86)Windows Resource KitsToolssubinacl.exe (if your OS is 64-bit) or c:Program FilesWindows Resource KitsToolssubinacl.exe (if your OS is 32-bit)." However there is no directory of that name on my Windows 7. How do I get it?

  • Anonymous
    July 04, 2014
    Hi Colin - You need to download and install SubInAcl from www.microsoft.com/.../details.aspx in order to get that file.

  • Anonymous
    July 04, 2014
    Hi Trad - I can try to help, but you need to provide more detailed information.  What isn't working for you, and what exact error messages are you seeing on your computer currently?

  • Anonymous
    July 09, 2014
    FWIW - I got the "'subinacl' is not recognized as an internal or external command,operable program or hatch file." error as well.  When I moved my Reset.cmd file into the directory where subinacl was installed & ran it from there, it ran.

  • Anonymous
    July 09, 2014
    Hi Tammy - I'm not sure why you needed to copy reset.cmd to the same directory as subinacl.exe.  Reset.cmd runs correctly for me on my systems regardless of where it is located, assuming that you installed subinacl.exe to the default path when you ran subinacl.msi.  The default location is c:Program Files (x86)Windows Resource KitsToolssubinacl.exe (if your OS is 64-bit) or c:Program FilesWindows Resource KitsToolssubinacl.exe (if your OS is 32-bit).

  • Anonymous
    July 23, 2014
    I'm trying to run this to fix windows update access denied on a pc.  I'm running it under and administrator account (even created a new one to try).  I'm getting that lots of failed entries when it has the red at the time and also "5 Access is denied" when it lists keys in white text.  I'm on win7 home 64 bit. Any ideas?

  • Anonymous
    July 23, 2014
    Hi Luke - Are you running from an elevated cmd prompt too?  To do that, you need to go to c:windowssystem32, find cmd.exe, right-click on it and choose Run as Administrator.

  • Anonymous
    July 23, 2014
    I followed the instructions carefully and installed on my Windows 7 machine.  When I ran the reset.cmd, I got the following message in the DOS window:'subinacl' is not recognized as an internal or external command, operable program or batch file.'subinacl' is not recognized as an internal or external command, operable program or batch file.'subinacl' is not recognized as an internal or external command, operable program or batch file.'subinacl' is not recognized as an internal or external command, operable program or batch file.=========================Finished.=========================Press any key to continue . . .What did I do wrong?

  • Anonymous
    July 23, 2014
    Also, I installed subinacl.msi in the Windowssystem32 folder.  I do not have a c:Program Files (x86)Windows Resource Kits... folder.  When I ran reset.cmd from any location, either the Desktop or system32 folder, I go the "subinacl' is not recognized as an internal or external command, operable program or batch file." error message.

  • Anonymous
    July 23, 2014
    Hi C. D. Harris - If you install subinacl to a non-default location, you will need to update reset.cmd to use the non-default location when it tries to run it.  Alternatively, you can uninstall subinacl and re-install it to the default location and reset.cmd should work as-is.

  • Anonymous
    July 27, 2014
    Seem to have the same problems as C D Harris on 23 July. Been working on this computer for a customer for 3 days now. What's the answer here? I'm getting the error that the program is not recognized as internal or external command. Re-read the instructions again. removed program, re-installed program - same error. SO,,, I read Aaron Stebner above "If you install to a non-default location WHAT Aaron?? Has this truly worked for you and others?

  • Anonymous
    July 27, 2014
    Hi John Corey - I'm sorry for the hassles you're encountering while trying to use subinacl.exe and reset.cmd.  The reset.cmd script that is linked in this blog post works correctly when I run it on my computers.  It expects to find subinacl.exe at c:Program Files (x86)Windows Resource KitsToolssubinacl.exe (if your OS is 64-bit) or c:Program FilesWindows Resource KitsToolssubinacl.exe (if your OS is 32-bit).  If you don't have subinacl.exe at that location on your computer, then you can do one of the following: Copy subinacl.exe to that location  Modify your copy of reset.cmd to use a different location for subinacl.exe  Write your own script to run subinacl.exe instead of using reset.cmd

  • Anonymous
    July 31, 2014
    Hi Aaron. I've been trying to figure this out for quite a while. Although, I can't seem to get it right. Still getting "subinacl' is not recognized as an internal or external command, operable program or batch file." error message. Does it matter if I am running SP1 on my Win7 OS?

  • Anonymous
    August 02, 2014
    Hi Abrham - No, it doesn't matter what version of Windows you are running on.  That error means that reset.cmd cannot find subinacl.exe at the location it expects to find it at.  It expects to find subinacl.exe at c:Program Files (x86)Windows Resource KitsToolssubinacl.exe (if your OS is 64-bit) or c:Program FilesWindows Resource KitsToolssubinacl.exe (if your OS is 32-bit).  If you don't have subinacl.exe at that location on your computer, then you can do one of the following: Copy subinacl.exe to that location  Modify your copy of reset.cmd to use a different location for subinacl.exe  Write your own script to run subinacl.exe instead of using reset.cmd

  • Anonymous
    August 07, 2014
    Hi Aaron, I too have the problem that C.D. Harris shows. I moved reset.cmd to the tools folder and double click, and it runs. If try to run from anywhere else it doesn't. If I try to run as administrator from the tools folder (or anywhere else) it will not run and comes up with the same error. A heads up, the microsoft document that links to this page instructs to install subinacl in the windowssystem32 folder, does not say where to put reset.cmd.

  • Anonymous
    August 08, 2014
    Hi Lee - If you download subinacl.msi from www.microsoft.com/.../details.aspx and install that, it will give you a default install location of c:Program Files (x86)Windows Resource KitsToolssubinacl.exe (if your OS is 64-bit) or c:Program FilesWindows Resource KitsToolssubinacl.exe (if your OS is 32-bit).  I don't know of any reason why you would need to install it to c:windowssystem32.  What exact page do you see instructions that say to install subinacl to c:windowssystem32?Reset.cmd is a script that runs subinacl.exe with several different command lines.  I wrote it as a convenience to try to make it easier to run subinacl.exe, but you don't have to use it if it is causing problems for you.  Instead, you can look at subinacl.htm (which is the help documentation that gets installed when you install subinacl.msi) and run your own subinacl.exe command lines.Reset.cmd does not need to be put in any specific folder in order for you to run it.  However, it does assume that subinacl.exe is installed to the default location of c:Program Files (x86)Windows Resource KitsToolssubinacl.exe (if your OS is 64-bit) or c:Program FilesWindows Resource KitsToolssubinacl.exe (if your OS is 32-bit).  If subinacl.exe is not installed in that location on your PC, you will need to update reset.cmd accordingly or it will not work.

  • Anonymous
    August 08, 2014
    Hi Aaron,This is the page: support.microsoft.com/.../968003. I installed to c:Program Files (x86)Windows Resource KitsTools after first installing to c:windowssystem32. I understand that the reset is calling for subinacl from the tools folder, just that I can't get to run as administrator.  I am having update issues, and the listed page is one that comes up when researching this error code:0x80070005.Thanks,Lee

  • Anonymous
    August 08, 2014
    Hi Lee - Thanks for sending the link.  I'm not sure why that knowledge base article says to install subinacl to the system32 directory.  In general, it isn't recommended to install applications there, and it runs correctly from the default location in Program Files.What I usually do is open an elevated cmd prompt by going to c:windowssystem32, right-clicking on cmd.exe and choosing Run as Administrator.  Then I run reset.cmd and subinacl.exe from the elevated cmd prompt.

  • Anonymous
    August 17, 2014
    The comment has been removed

  • Anonymous
    August 18, 2014
    Hi Neil Lomas - I'm surprised to hear that just choosing Open allowed subinacl.exe to run correctly on your computer.  That tool requires elevated privileges in order to run correctly.  I usually recommend opening an elevated cmd prompt and running reset.cmd or subinacl.exe from there.  You can find steps for how to do that at blogs.msdn.com/.../solving-setup-errors-by-using-the-subinacl-tool-to-repair-file-and-registry-permissions.aspx.

  • Anonymous
    August 23, 2014
    I to had the same problem as many others regarding errors when running the reset.cmd file. Rather than right click and 'run as administrator' try double clicking the reset.cmd file

  • Anonymous
    September 12, 2014
    Many thanks Aaron for your blog - I have found it very useful.  I also saved my SubInAcl to C:/windows/system32 as per the microsoft instructions and my reset.cmd in my C: folder.  It ran well.  My only issues are fails due to not being able to make registry changes in my zonealarm security files, which I would expect, and I need to now go and see how this impacts on correcting my windows update problem I was experiencing.

  • Anonymous
    September 24, 2014
    Thank you for the script.  It ran and it looked like it fixes a bunch of entries but 7 Windows Vista Home Premium SP-2 x64 updates, including .NET, continue to fail to install. I am logged in as administrator, I have disabled Kaspersky (and I disabled auto-run at boot), and even renamed the SoftwareDistribution folder.  Rebooted a couple of times and updates still fail to install. The same 7 files failed to update since August 18, according to the update history. Any other suggestions?

  • Anonymous
    September 25, 2014
    The comment has been removed

  • Anonymous
    October 06, 2014
    Hello. I'm getting Windows Update Error 80070005. From the Windows support (support.microsoft.com/.../968003), it says that I fix the error using Subinacl.I followed the steps : installed Subinacl to default directory, made a reset.cmd using notepad as stated, then ran the the reset.cmd as administrator.Now, my problem is the same as some of the others stated here which was "Subinacl is not recognized as internal or external command, operable program or batch file."I hope you can point out specifically where I went wrong and how I could successfully run the program. I still dont have the idea on how, from reading the previous posts/comments.

  • Anonymous
    October 07, 2014
    Hi Ross - I'm sorry for the hassles that you're running into.  Instead of using the steps listed in that knowledge base article, I'd suggest using the steps in my blog post at blogs.msdn.com/.../solving-setup-errors-by-using-the-subinacl-tool-to-repair-file-and-registry-permissions.aspx.  I don't know why the knowledge base article recommends installing subinacl to the system32 directory, but that is typically not recommended for any software installation, and the steps in my other blog post will walk you through installing subinacl to the default location and creating a reset.cmd script that calls it from there instead.Hopefully this helps.

  • Anonymous
    October 07, 2014
    Hello again. Thanks for the response.Subinacl finally ran for me, all I needed was change the content of reset.cmd as everything else is like what I did beforehand.Just a question because I'm a bit worried, is it normal seeing large numbers (>1000) under "Failed" while in progress of resetting? what do those numbers under Failed mean?

  • Anonymous
    October 07, 2014
    Hi Ross - It is normal to see some failures (because of registry keys in use by other programs on your computer, etc).  I don't think there should be that many failures though.  It is hard to say without seeing the full output though.  Can you create a log file that contains all of the output, upload it to a file server (such as http://onedrive.live.com), upload your log there, and then post a link here so I can download it and take a quick look?

  • Anonymous
    October 07, 2014
    I'm not really sure how to make a log file using cmd so I just did the old copy and paste to a .txt file. Sorry about that. Anyway, here's the link : http://1drv.ms/1vM0g3R

  • Anonymous
    October 08, 2014
    Hi Ross - You can ignore the failures for HKEY_CURRENT_USER.  The large number of failures for HKEY_LOCAL_MACHINE and HKEY_CLASSES_ROOT are worrisome though, especially since the errors that are reported are access denied errors (which is what that subinacl script is specifically designed to fix).  I'd suggest double-checking to make sure that you're running the script with elevated permissions (using the Run as Administrator option described in the knowledge base article).If you're still seeing access denied errors even when running as an administrator, then you might need to try a different technique for changing the registry permissions on your computer instead of using subinacl.exe.  Steps like the ones at www.howtogeek.com/.../take-ownership-of-or-assign-full-permission-for-a-registry-key-in-windows-7 might help you if you need to do this.

  • Anonymous
    October 12, 2014
    All my hassles started when I updated to Windows 8.1  Most of my graphics programs would not function (video editor and such) so I used my OEM partition and sent it back to Windows 8.  All my programs worked fine but when I went to grab a few apps I got the 0x80070005 error or was told my system did not meet the criteria (Intel i5, 16GB ram, 1TB HD)  Tried running this fix and no luck, same errors as the others when it runs:'subinacl' is not recognized as an internal or external command, operable program or batch file.'subinacl' is not recognized as an internal or external command, operable program or batch file.'subinacl' is not recognized as an internal or external command, operable program or batch file.'subinacl' is not recognized as an internal or external command, operable program or batch file.Tried your variations and its just the same old same old error.  I guess I am doomed to never update Windows or get an app from the app store.  I can download programs from the web and they worked just fine.

  • Anonymous
    October 13, 2014
    Hi Jim - If you follow the steps that are posted at blogs.msdn.com/.../solving-setup-errors-by-using-the-subinacl-tool-to-repair-file-and-registry-permissions.aspx, you should not see this error.  Please make sure you're following the steps exactly as they are written there.One important note - if you already installed subinacl to system32 because the knowledge base article said to do that, please uninstall it before trying the steps in my other blog post.  If you don't, you won't be able to install it to the default location like my steps say to do.

  • Anonymous
    October 22, 2014
    Hey guys. In order to recognize subinacl you need to add a path (where subinacl.exe is installed in my case C:Program Files (x86)Windows Resource KitsTools) to Environmental Variables 'Path'. You can find it under Advanced system settings->Advanced-> Environmental Variables->System variables. Find variable Path, then click edit and add C:Program Files (x86)Windows Resource KitsTools;After that run your Reset.cmd.

  • Anonymous
    November 19, 2014
    Internal error 2503

  • Anonymous
    November 19, 2014
    Hi Snehal Danane - I need more information in order to be able to help here.  What exactly were you doing when you saw that error?  Also, do you see any additional explanatory text along with the error number, or is that number all that is displayed?

  • Anonymous
    January 08, 2015
    The comment has been removed

  • Anonymous
    January 09, 2015
    Hi Gordon - You can upload the .jpg to a file server (such as http://onedrive.live.com) and post a link that I can use to download it.

  • Anonymous
    February 13, 2015
    I've tried all of the suggestions outlined above and still got the 'subinacl' is not recognized as an internal or external command, operable program or batch file message. What DID work for me was this method I found.Disable Windows Update a. Click on startb. Click on all programsc. Click on accessoriesd. Click on Rune. Type services.msc and press okf. Right click on "Windows Update"g. Click on stop (Windows Update is now disabled)Rename Software Distribution folder a. Navigate to: C:/Windows/b. Find the folder named: “SoftwareDistribution”c. Rename that folder to something like “SoftwareDistribution.old”d. Create a new folder called “SoftwareDistribution”Enable Windows Update a. Click on startb. Click on all programsc. Click on accessoriesd. Click on Rune. Type services.msc and press okf. Right click on windows updateg. Click on startIf you are unable to find Software Distribution Folder, follow thesesteps before #2 above.From the explorer window press the Alt key to view the file menu.Click Tools Select Folder Options Select the View tab Select “Show hidden files and folders” Remove the selection from “Hide protected operating system files” Click OK Restart your PC and you should be good to go!

  • Anonymous
    February 28, 2015
    I've been having problems installing a display driver for my NVIDIA GT220 video card.  I've tried doing a manual install using the file downloaded from NVIDIA and Windows Update which generates the 80070005 error code. I ran (as Administrator) the subinacl command and it generated so many errors the log file was too large (about 3.6 GB) that I couldn't open it with Notepad or any other Wordprocessor that I have. I rebooted and ran the subinacl again but got the same results. Any suggestions on what to try next?

  • Anonymous
    March 01, 2015
    I forgot to mention I'm using Windows 7 Pro 64 bit with Service Pack 1 installed.

  • Anonymous
    March 02, 2015
    Hi Gabe - You can manually change file/folder permissions by using Windows Explorer and registry permissions by using regedit.exe.  I'd first suggest trying to narrow down exactly what file, folder or registry key is causing the 80070005 error that you're seeing when trying to install this NVIDIA package.  Typically, you can find that information from the setup log file, and most of the time, setup programs create log files in %temp%.Once you narrow down what is causing the access denied error, you can update the permissions by using these steps:If it is a file/folder - support.microsoft.com/.../308419If it is a registry key - support.microsoft.com/.../310426Both of the above links refer to Windows XP, but the instructions are the same for newer versions of Windows too.

  • Anonymous
    March 03, 2015
    My main concern is the amount of failed objects that could not be changed. Any ideas if the failed errors are due to permissions already in place?

  • Anonymous
    March 04, 2015
    Hi Rodrigo - I'm not sure what the root cause of the failed objects is.  I'd need to see the log file to be able to narrow this down further.  One possible cause is the issue described at brianpeek.com/.../weird-vista-registry-issue where all permissions are removed from a registry key + sub-keys.

  • Anonymous
    March 23, 2015
    Hey Aaron,I've ran in to this problem today after trying to install an update. I'm running Windows 8.1 and have followed all your instructions here and downloaded your reset file but I'm still having problems. I've taken a screenshot of what's happening when I run the reset file: drive.google.com/.../viewI'd be very grateful if you can offer any further suggestions :o)

  • Anonymous
    March 23, 2015
    Hi Andy S - In the screenshot you uploaded, the cmd prompt is running from the c:windowssystem32 directory.  The error listed there means that subinacl.exe is not installed to the c:windowssystem32 directory.  You need to use the cd command to change directories to the folder that subinacl.exe is installed to.  If you did a default install, subinacl.exe will be installed to c:Program Files (x86)Windows Resource KitsTools.The example reset.cmd in the blog post at blogs.msdn.com/.../solving-setup-errors-by-using-the-subinacl-tool-to-repair-file-and-registry-permissions.aspx shows how to do this if you're not sure how to do that.

  • Anonymous
    May 12, 2015
    Hello, I'm trying run SubinACL on a Hungarian Windows 8.1 Pro system but when I replace administrators with the hungarian name which would be rendszergazdák returns the error 1337 because of the accent int name. So I tried to save the file UTF-8(no-bom) and also in ANSI but both way I got the error than I tried put the name between quation marks but I got the same error, how can use the Hungarian name of the administrators group?

  • Anonymous
    May 13, 2015
    Hi Laszlo K - I haven't tried it, but I think you should be able to use the SID instead of the group name to work around this issue.  The SID for the Administrators group is S-1-5-32-544, and you can find information about how to use SIDs with subinacl by looking at the help document subinacl.htm that gets installed to the same location as subinacl.exe.

  • Anonymous
    May 13, 2015
    Thank you for your help! It worked like charm. I simply replaced the usergoup name with the SID and than it run, but sadly it didn't solved my problem and now I'm changing permissions one-by-one on some of the keys looking up the correct values on another PC.

  • Anonymous
    June 01, 2015
    The comment has been removed

  • Anonymous
    June 01, 2015
    Hi All Again, Sorry, I should have typed "Reset.cmd" rather than "Restore.cmd" in my prior post, 2 Jun 2015 12:29 AM, above. Also, just to clarify, this addressed the following error when executing the "Reset.cmd" batch file, (and as reported by prior posters).    'subinacl' is not recognized as an internal or external command, operable program or batch file. Best Wishes, David King, :-)

  • Anonymous
    June 09, 2015
    Hi David King - Thanks for your feedback.  I found some people at Microsoft who were able to update the instructions in the KB article at support.microsoft.com/.../968003, and as of today, it no longer says to install SubInAcl to the system32 directory.  Hopefully this will help avoid some of this type of confusion in the future.

  • Anonymous
    July 17, 2015
    Running Windows 10 Enterprsie x64 Build #10130 and having the defender download erro. Running your Script is generating thousands of "Syntax errors" although the script is a 100% copy of that provided at:support.microsoft.com/.../968003 and suggestions would be gratefully recieved? Many thanks, Julian Balmford

  • Anonymous
    July 20, 2015
    Hi Julian Balmford - Just to double-check, did you run the script as an administrator by right-clicking and choosing to run as administrator? If so, then can you send an example of the syntax error that you're seeing and I'll see if I can try to help figure out what is causing them?

  • Anonymous
    July 31, 2015
    Hi Aaron, i belive the script is useable in every language by replacing then names with the SIDs. support.microsoft.com/.../243330 e.g. administrators -> S-1-5-32-544 Thanks a lot, Demian

  • Anonymous
    July 31, 2015
    Hi Demian - I think you're right.  Thank you for posting this information.

  • Anonymous
    July 31, 2015
    I made the script run with the SIDs. Unfortunately it could not fix the Err 80070005 for the windows 10 upgrade.

  • Anonymous
    August 03, 2015
    Hi Demian - I'm sorry to hear that you're still having issues with your Windows 10 upgrade.  Unfortunately, SubInAcl isn't able to fix 100% of the possible access denied errors.  I'd suggest posting a question on the Windows 10 forum at answers.microsoft.com/.../windows_10 to see if someone there can provide some additional troubleshooting suggestions for your scenario.

  • Anonymous
    August 10, 2015
    non-tech newbie here, am also having problems updating to win10 from hp laptop with win8.1 I ran the scannow command and found no problems and then downloaded your  SubinAci and ran the reset as admin as you said. When it completes it just disappears so am wondering how to find the text to see if it has any errs listed? Thnks,maureen

  • Anonymous
    August 10, 2015
    Hi Maureen - Instead of right-clicking on reset.cmd and choosing to run it as administrator, you can run c:windowssystem32cmd.exe as an administrator and then run reset.cmd from there.  That way the cmd window will stay open after reset.cmd finishes.  You can also run reset.cmd > %temp%subinacl_output.txt and it will print all of the output to a text file instead of printing it to the cmd window.

  • Anonymous
    August 10, 2015
    The comment has been removed

  • Anonymous
    September 07, 2015
    After completition of Reset.cmd I got exactly 57506 Failed updates on the HKEY_LOCAL_MACHINE hive and exactly 28463 Failed updates on the HKEY_CLASSES_ROOT hive. On the HKEY_CURRENT_USER and on the C:Windows directory I got exactly 0 Failed updates. In all cases I got exactly 0 Syntax errors. Because the script shows the last failed updates (for the HKEY_LOCAL_MACHINE hive HKEY_LOCAL_MACHINESYSTEMCurrentControlSetservicesxmlprovParametersSchemaGroupsUserwww.microsoft.com/.../mspeapuserpropertiesv1 and for the HKEY_CLASSES_ROOT hive HKEY_CLASSES_ROOT{2C256447-3F0D-4CBB-9D12-575BB20CDA0A}ProgID) I can give the exact reason why at least these updates failed: The owner of these keys is TrustedInstaller, not Administratoren (I have the german version of Windows 7 Professional, that's why Administratoren, not administrators). With this owner it is not possible to grant full access to the Administratoren group. I looked a bit around in other registry keys and saw that many of them also have the owner TrustedInstaller what makes me assume that this owner is the general cause of the 57506+28463 Failures. It is no problem to change the owner of the keys but of course I must ask myself why Reset.cmd did not already do that. After searching Microsoft forums I found the terrible posting of dskrobow on January 22, 2013 (answers.microsoft.com/.../514192d0-697d-4cdb-b2e9-5a0429321a4f): "I also changed the owner of the hive from TrustedInstaller to the Administrator group--BIG MISTAKE ... When I closed regedit, I could no longer start it up again. The 'run as Administrator' option was gone from the context menu. I could no longer open windows explorer, control panel, Internet Explorer, etc." So it seems that it's not a good idea to simply change the owners of registry keys to the Administratoren group. On the other hand I don't want to go on with errors. I assume that you don't get any error when you run Reset.cmd on your computer. Am I right? So you should have in all of your registry keys the owner administrators. I should mention that my computer was infected by malware that installed a couple of software pieces on my computer. That's why it is possible that these keys belong to malware that has been removed in the meantime. But this is only a very rough idea. I don't know that at all! I don't know how to check if these keys belong to my system or not. What should I do now? Should I change the owners of the failed keys? The posting of dskrobow shows me that it is very likely that I will run into problems after that. Should I continue with errors? I assume that you don't get any error on your computer after Reset.cmd has completed. Should I delete the failed keys? I'm afraid that this will cause the biggest problems. Should I do anything else? Please help. Thanks, Uwe

  • Anonymous
    September 09, 2015
    Hi Uwe - Running subinacl will typically result in some errors on all PCs.  I don't think you need to worry about trying to eliminate all of the errors that it reports.  Instead, I would focus on trying to fix the exact problem that led you to try running subinacl in the first place.  For example, was there a specific application you were trying to run that reported access denied?  If so, I'd suggest checking to see if it works after you ran subinacl, and if so, don't make any further permission changes or delete any registry keys unless you have problems running other applications on your PC.

  • Anonymous
    September 12, 2015
    On a multi-year quest (on and off!) to rid myself of 80070005 error code when trying to update Windows 7 on my Lenovo Thinkpad. Have not updated in 3 years ! Wont allow me to update to Windows 10 either. Just ran subinacl, which did not work. Any idea for next step? Would be very grateful! Thanks. Kay

  • Anonymous
    September 12, 2015
    I tried two different scripts of subinacl, but none worked. I still get the same error code 80070005.

  • Anonymous
    September 13, 2015
    Hi Kay - SubInAcl isn't able to fix all possible causes of access denied errors.  I'd suggest trying the Windows Update troubleshooter at windows.microsoft.com/.../troubleshoot-problems-installing-updates. You might also be able to manually update the permissions on the file/folder/registry key that is causing this access denied error if you can determine which exact item is causing the error.  For Windows updates, there will sometimes be more information about the cause of errors in the log files at %windir%winsxslogs or %windir%WindowsUpdate.log.

  • Anonymous
    September 13, 2015
    Hi Taner - You might be able to manually update the permissions on the file/folder/registry key that is causing this access denied error if you can determine which exact item is causing the error.  What are you trying to do when you see this error - install Windows Updates, install an application, run an application, etc?

  • Anonymous
    November 07, 2015
    hi aaron, what a nice script at all. referring to "Issue 1 - Running SubInAcl reports an error on some non-English operating systems" do you know perhaps the correct Translation for "restricted" to german weorking in registry ? all other Translations i did with Google-translator, but in this case no Suggestion/Translation is working. "eingeschränkt","eingeschraenkt","begeschränkt","begeschraenkt" greetings from vienna michi    

  • Anonymous
    November 09, 2015
    Hi Michivie - I don't know the correct translation, but you might want to try using the suggestion in the comment above from Demian and use the account's SID instead of the name.  You can find SID information in this knowledge base article - support.microsoft.com/.../243330.

  • Anonymous
    February 12, 2016
    This works with the German version of Windows 7 32bit Professional... @echo off title Resetting ACLs... setlocal echo. echo Determine whether we are on an 32 or 64 bit machine echo. if "%PROCESSOR_ARCHITECTURE%"=="x86" if "%PROCESSOR_ARCHITEW6432%"=="" goto x86 set ProgramFilesPath=%ProgramFiles(x86)% goto startResetting :x86 set ProgramFilesPath=%ProgramFiles% :startResetting echo. if exist "%ProgramFilesPath%Windows Resource KitsToolssubinacl.exe" goto filesExist echo ERROR - Could not find file %ProgramFilesPath%Windows Resource KitsToolssubinacl.exe. Double-check that SubInAcl is correctly installed and re-run this script. goto END :filesExist pushd "%ProgramFilesPath%Windows Resource KitsTools" echo. echo Resetting ACLs... echo (this may take several minutes to complete) echo. echo IMPORTANT NOTE: For this script to run correctly, you must change echo the values named YOURUSERNAME to be the Windows user account that echo you are logged in with. echo. echo ========================================================================== echo. echo. subinacl.exe /subkeyreg HKEY_CURRENT_USER /grant=Administrator=f /grant=system=f /grant=Gast=r /grant=YOURUSERNAME=f /setowner=Administrator > %temp%subinacl_output.txt echo. echo. subinacl.exe /keyreg HKEY_CURRENT_USER /grant=Administrator=f /grant=system=f /grant=Gast=r /grant=YOURUSERNAME=f /setowner=Administrator >> %temp%subinacl_output.txt echo. echo. subinacl.exe /subkeyreg HKEY_LOCAL_MACHINE /grant=Administrator=f /grant=system=f /grant=benutzer=r /grant=jeder=r /grant=Gast=r /setowner=Administrator >> %temp%subinacl_output.txt echo. echo. subinacl.exe /keyreg HKEY_LOCAL_MACHINE /grant=Administrator=f /grant=system=f /grant=benutzer=r /grant=jeder=r /grant=Gast=r /setowner=Administrator >> %temp%subinacl_output.txt echo. echo. subinacl.exe /subkeyreg HKEY_CLASSES_ROOT /grant=Administrator=f /grant=system=f /grant=benutzer=r /setowner=Administrator >> %temp%subinacl_output.txt echo. echo. subinacl.exe /keyreg HKEY_CLASSES_ROOT /grant=Administrator=f /grant=system=f /grant=benutzer=r /setowner=Administrator >> %temp%subinacl_output.txt echo. echo. echo System Drive... subinacl.exe /subdirectories %ProgramFilesPath% /grant=Administrator=f /grant=system=f /grant=benutzer=e >> %temp%subinacl_output.txt echo. echo. echo Windows Directory... subinacl.exe /subdirectories %windir% /grant=Administrator=f /grant=system=f /grant=benutzer=e >> %temp%subinacl_output.txt echo. echo. echo ========================================================================== echo. echo FINISHED. echo. echo Press any key to exit . . . pause >NUL popd :END endlocal

  • Anonymous
    March 17, 2016
    Copied and ran script from http://cid-27e6a35d1a492af7.skydrive.live.com/self.aspx/Blog%7C_Tools/reset.cmd.txt you listed above. Where exactly will I find this logfile? Sorry, I cannot find it. I am running the reset.cmd because I am having difficulty with the windows update. When I run the update troubleshooter, I get 2 errors. One is "Service registration is missing or corrupt" and the other is windows update error 0x80070005; These are listed as not fixed but if I go to details they are listed as fixed. In trying to clarify, I got to your page. I seemed to get a lot of errors in running subinACL so I ran again with your script to get a log, but have been unable to find this log. Thanks for your help.

    • Anonymous
      March 29, 2016
      Hi Trixie - To generate a log, you need to open an administrator cmd prompt and then run reset.cmd > %temp%\subinacl_log.txt. The > sign will redirect output from the cmd prompt window to the file that you specify afterwards.

  • Anonymous
    March 17, 2016
    PS related to previous post, I am running win7 64 home premium.

  • Anonymous
    April 24, 2016
    Seems I am one of the many who can't fix the 80070005 error code. I have installed countless fixes manually and tried many things. I have tried the process above twice as administrator and still can't fix it. I am simply trying to fix the fact that Windows Update constantly shows as "checking for updates". This only happened after SP1 and some fixes were installed. Shocked that something this simple on Windows 7 has no simple fix.

    • Anonymous
      April 29, 2016
      Hi Steven Zaharakis - For Windows Update issues, I'd suggest posting a question on one of the Windows forums at http://answers.microsoft.com/en-us/windows to see if someone there has any additional suggestions for you to try.

  • Anonymous
    June 21, 2016
    I have downloaded and installed SubInACL tool. It installed in the correct directory, however when I run the reset.cmd script it tells me that it cannot find subinacl.exe in C:\Program Files (x86)\Windows Resource Kits\ToolsI have verified the file is there. Any ideas??

  • Anonymous
    June 25, 2016
    Esto es lo que debería ir en el RUN.CMD en windows 7 SP1 en español:@echo off setlocal echo.echo Determine whether we are on an 32 or 64 bit machineecho. if "%PROCESSOR_ARCHITECTURE%"=="x86" if "%PROCESSOR_ARCHITEW6432%"=="" goto x86 set ProgramFilesPath=%ProgramFiles(x86)% goto startResetting :x86 set ProgramFilesPath=%ProgramFiles% :startResetting echo. if exist "%ProgramFilesPath%\Windows Resource Kits\Tools\subinacl.exe" goto filesExist echo ERROR - Could not find file %ProgramFilesPath%\Windows Resource Kits\Tools\subinacl.exe. Double-check that SubInAcl is correctly installed and re-run this script.goto END :filesExist pushd "%ProgramFilesPath%\Windows Resource Kits\Tools" subinacl.exe /subkeyreg HKEY_LOCAL_MACHINE /grant=administradores=f /grant=system=fsubinacl.exe /subkeyreg HKEY_CURRENT_USER /grant=administradores=f /grant=system=fsubinacl.exe /subkeyreg HKEY_CLASSES_ROOT /grant=administradores=f /grant=system=fsubinacl.exe /subdirectories %windir% /grant=administradores=f /grant=system=f echo FINISHED.echo. echo Press any key to exit . . .pause >NUL popd :END endlocal

    • Anonymous
      June 25, 2016
      oops, en lugar de RUN.CMD quise decir RESET.CMD
    • Anonymous
      June 27, 2016
      Hi Ronny Barrientos - Thank you for posting these instructions for Spanish versions of Windows 7. For other folks reading this in the future, you can also use the account SID instead of the translated names of groups like Administrators. You can find a list of commonly used SID values in the knowledge base article at https://support.microsoft.com/en-us/kb/243330.

  • Anonymous
    June 29, 2016
    I ran the SubInACL Tool for my Windows 7 PC. It ran a while then stopped, giving the message" SetKerne 1ObjectSecurity Error : 5 Access is Denied". I still cannot get Windows Updates and I am still getting the message "Windows Help and Support Can't Start". Any helpful ideas?Thanks,Paul

  • Anonymous
    August 29, 2016
    Hi Aaron,Just wanted to send a comment that I had problems running the reset.cmd. I was getting the following errors as posted on 10/12/14:'subinacl' is not recognized as an internal or external command, operable program or batch file.'subinacl' is not recognized as an internal or external command, operable program or batch file.'subinacl' is not recognized as an internal or external command, operable program or batch file.'subinacl' is not recognized as an internal or external command, operable program or batch file.=========================Finished.=========================After reading David King's comment on 6/2/15, I moved the subinacl files from the resources tool folder to system32 folder; & the command ran with no problems. I was getting the 0x8007005 error when I was trying to run the hide windows 10 update diagnostic. After the command ran successfully, I was able to run the diagnostic & hide the driver updates. Thanks to both David King & you, Aaron for finding the fix to this dreadful error. Dom

  • Anonymous
    August 29, 2016
    je veux ouvrir.un compte administrateur

  • Anonymous
    October 28, 2016
    Just installed a brand new Windows 10 Professional fresh install (not OEM, not an update) and am running into a lot of Access Denied problems. I am using a 500MB SSD (Crucial). Tried the script and... tons of Access Denied. Start of Error Log:Determine whether we are on an 32 or 64 bit machineSeSecurityPrivilege : Access is denied.WARNING :Unable to set SeSecurityPrivilege privilege. This privilege may be required.HKEY_LOCAL_MACHINE - QueryObjectSecurity Error : 1314 A required privilege is not held by the client.HKEY_LOCAL_MACHINE\BCD00000000 : 5 Access is denied.HKEY_LOCAL_MACHINE\BCD00000000: 6 : Unable to enumerate subkeysHKEY_LOCAL_MACHINE\DRIVERS : 5 Access is denied.HKEY_LOCAL_MACHINE\DRIVERS: 6 : Unable to enumerate subkeysHKEY_LOCAL_MACHINE\HARDWARE : 5 Access is denied.HKEY_LOCAL_MACHINE\HARDWARE: 6 : Unable to enumerate subkeysHKEY_LOCAL_MACHINE\SAM : 5 Access is denied.HKEY_LOCAL_MACHINE\SAM: 6 : Unable to enumerate subkeysHKEY_LOCAL_MACHINE\SECURITY : 5 Access is denied.HKEY_LOCAL_MACHINE\SECURITY: 6 : Unable to enumerate subkeysSOFTWARE : delete Perm. ACE 0 builtin\administratorsSOFTWARE : new ace for builtin\administratorsSOFTWARE : delete Perm. ACE 0 nt authority\systemSOFTWARE : new ace for nt authority\systemHKEY_LOCAL_MACHINE\SOFTWARE - RegSetKeySecurity Error : 5 Access is denied.It goes on Ad Nauseum...Suggestions? Thanks.

    • Anonymous
      October 31, 2016
      Hi Byron Smith - Some of the registry sub-keys will be held in use by Windows and subinacl.exe won't be able to update the permissions. However, it should work for most of the sub-keys. If you're seeing access denied errors for all of them, then I'd suggest double-checking that you're running subinacl.exe from an elevated cmd prompt. If you are running from an elevated cmd prompt and still see access denied errors for all sub-keys, then I'm not sure what else to suggest. In that case, you might need to manually update the permissions using regedit.exe instead. You can find instructions for doing that at https://support.microsoft.com/en-us/kb/310426.

  • Anonymous
    November 01, 2016
    installing SubInAcl no problemRunning SubInAcl no problemAfter installing & running windows update searching still gives no result...Any update for this procedure available?system win7 home premium 64bit on Sony Vaio laptop, after reinstall to Sony delivery status (vaio toot)

    • Anonymous
      November 01, 2016
      I used the Vaio tool to return to delivery status of Vaio laptop
      • Anonymous
        November 01, 2016
        After going back to the initial state of the Vaio, I expect to get hundreds of updates. Nope, Windows update screen stays empty.running an NL version of Win7 home Premium.feeling Stuck...

  • Anonymous
    November 04, 2016
    I want to be sure my pc’s Disk Defragmenter is working two months ago to have a notice that it is being sued by another programme and to access it, it must be removed from that programme first. There is no info as to the programme using it. So I restored the pc back to original factory setting and update to windows 7 sp1 (home premium). After there was auto update of Windows Update Agent 7.6.7600.320 the pc start searching for new update, then the pc freeze, inactive internet connection (slow internet connection) and stop and this code come: 0x80070005. What do I do? I need help. Thanks

  • Anonymous
    November 28, 2016
    "the name of the Administrators group is translated into the OS language"What does this mean?We can't imagine which way you translate a group name into American English

    • Anonymous
      November 28, 2016
      Hi Veuillerot Michel - The sample subinacl script that I posted passes in the name "Administrators" as the group name. Some non-English Windows languages use a translated version of that group name (for example, Administrateurs in French), and the name "Administrators" won't work in the sample subinacl script in those scenarios.In those scenarios, I'd recommend using the SID instead of the group name as Demian suggested in a comment a couple of years ago. The list of built-in SIDs is documented here - https://support.microsoft.com/en-us/kb/243330. The Administrators group is represented by the SID S-1-5-32-544 for example.

  • Anonymous
    March 15, 2017
    For Finnish on Windows 7, replace "administrators" with "Järjestelmänvalvojat"

  • Anonymous
    April 18, 2017
    Thanks for the detailed and clear details, I hope they'll help me solve a 'no access' problem.One question: If "administrators" is changed, like in the Portuguese versions of XP and W7, it's "Administradores" which is shown, but also "Usuários" instead of "users"; shouldn't that be changed too, or is that just a 'label' which the GUI shows, and the Win 'innards' continue using the English words? How/where can one verify this?

    • Anonymous
      April 19, 2017
      After posting the above, I read all the posts about using SIDs, which sounds like a great idea -- I tried to find the SIDs for the "Reset.cmd" program on the given link (), but couldn't find the ones for SYSTEM and RESTRICTED. In the PT.BR versions of Windows, it seems that the former isn't translated, but found nothing about the latter except S-1-5-18 -> Local System, wich I assume is the wrong one (and the others, for which I did find SIDs, are translated). Here's what I managed to find (hoping to substitute all names for SIDs:Administrators -> S-1-5-32-544 -> AdministradoresSystem -> S-? -> System? S-1-5-18 -> Local SystemRestricted -> S-? -> Restrito? Restringido?Users -> S-1-5-32-545 -> UsuáriosEveryone -> S-1-1-0 -> TodosWhat am I missing (or am I just on the wrong path)?
      • Anonymous
        April 20, 2017
        Hi Alexander Yudenitsch - This is the knowledge base article that I am aware of that defines well-known SIDs - https://support.microsoft.com/en-us/help/243330/well-known-security-identifiers-in-windows-operating-systems. If you don't find what you're looking for there, I'd suggest posting a question on one of the TechNet forums at https://social.technet.microsoft.com/Forums/en-US/home to see if someone there can help further.
        • Anonymous
          April 22, 2017
          Hi, Aaron!Yes, that's the one you linked to, and which I had read.After reading what you said above, I decided to 'risk it', and substituted the SIDs as follows:Administrators -> S-1-5-32-544 (ptBR: Administradores)System -> S-1-5-18 [Iisted as 'Local System'] (ptBR:System - not translated, AFAIK)Restricted -> S-1-5-12 [Iisted as 'Restricted Code (future use)'] (ptBR: ? Restrito? Restringido?)Users -> S-1-5-32-545 (ptBR: Usuários)Everyone -> S-1-1-0 (ptBR: Todos)The modified script ran (I tried it twice, to be sure -- was that wise?), and it seems it didn't show 'syntax errors', but it 'ran amok' and generated a "subinacl_output.txt" over 800 MB, which I don't think relevant (I can post it somewhere if you'd like); more to the point, I managed to capture (and OCR) most of the cmd window contents, and here's what was on it (a few of the initial lines are missing):Elapsed Time: 00 00:00:01Done: 2592, Modified 2592, Failed 0, Syntax errorsLast Done : HKEY_CURRENT_USER\Volatile Environment\1Elapsed Time: 00 00:00:00Done: 1, Modified 1, Failed 0, Syntax errorsLast Done : HKEY CURRENT USERElapsed Time: 00 00:01:39Done: 157420, Modified 119904, Failed 37516, Syntax errors 0Last Done : HKEY_LOCAL_MACHINE\SVSTEM\CurrentControlSet\services{7F9522A7-5D96-4E16-A8A7-554E5E482C16}\Parameters\TcpipLast Failed: HKEY_LOCAL_MACHINE\SVSTEM\CurrentControlSet\services\xmlprov\Parameters\SchemaGroups\User\http://www.microsoft.com/provisioning/mspeapuserpropertiesv1 - RegSetKeySecurity Error : 5 Acesso negado.Elapsed Time: 00 00:00:00Done: 1, Modified 1, Failed 0, Syntax errorsLast Done : HKEY LOCAL MACHINEElapsed Time: 00 00:00:45Done: 55007, Modified 29526, Failed 25481, Syntax errors 0Last Done : HKEY_CLASSES_ROOT{2C256447-3FOD-4CBB-9D12-575BB20CDAOA}\ProgIDLast Failed: HKEY_CLASSES_ROOT{2C256447-3FOD-4CBB-9D12-575BB20CDAOA}\ProgID - RegSetKeySecurity Error : 5 Acesso negado.Elapsed Time: 00 00:00:00Done: 1, Modified 1, Failed 0, Syntax errorsLast Done : HKEY CLASSES ROOTSystem Drive...Elapsed Time: 00 00:00:49Done: 2, Modified 2, Failed 0, Syntax errors 0Last Done : C:\Program Files\Paragon Software\Partition Manaqer 12 Home\programWindows Directory...Elapsed Time: 00 00:00:59Done: 80609, Modified 80609, FailedLast Done : C:\Windows\winsxs\x86_xnacc.inf_31bf3856ad364e35_6.1.7600.16385_none_b381dfe1d4da7da9\xnacc.sysBut, most to the point, besides the already-indicated above, I'm still getting the same 'access denied' block which motivated me to pursue this: I was trying to install Win XP Mode on a Win7SP1 system, and the XPMode program installed fine, but both KB958559RefreshPkg(WinVirtualPC) and KB977206(XPModeUpdate) didn't, due to 'access denied'.I already had access problems in this Win7 system, when it refused to even allow the installation of any 'local (non-USB) printer', but managed to tweak permissions until that was overcome (and, curiouser: On one previous install of the same Win7, that problem didn't arise, so I suspect it was some parameter during install which led to this).Perhaps you have some pointers more specific to the XPMode install, which would let me install and test it, to see if it will solve some problems with older programs I have?Thanks for your attention, and for such a deep and clear tech site!
          • Anonymous
            April 24, 2017
            Hi Alexander Yudenitsch - I don't have any background installing or using the XPMode application that you're trying to install. Does it create any log files or anything that provides more detailed information about which file, folder or registry key is causing the access denied error that you're currently seeing? If it does, then I'd suggest trying to manually updating the permissions to see if you can unblock that installer. For files/folders, you can manually update permissions using Windows Explorer, and for registry keys you can manually update permissions using regedit.exe.

  • Anonymous
    April 25, 2017
    Hi, Aaron! Thanks again for your attention.Yes, my main intent was installing the Win7 XPMode, but that program installed fine; what didn't were the two other ones, required to create and run a VM (Virtual Machine) for XPMode to run inside them. Maybe there are logs, maybe not... I have no idea, and have went beyond them by finding VirtualBox and VMLite, which together allow that and do work to create a working Win XP 'machine'.Sincerely, I'm quite tired and disgusted with all the permissions/access problems on Win7: I understand that, for a corporate IT situation, many of them may be necessary; but I always feel that there should an out' for a situation where there is (and will be) only one user on a W7 system, so 99% of these permissions are useless -- much worse than useless, because they're the cause of so many mistakes, errors and misunderstandings -- and there could be a "single-user" option in the W7 install process (with a warning that, if you ever want to have another user, you'll have to reinstall the whole thing), which would take us to a much simpler set of options (with so many less chances for problems).When I read you posts (and, afterwards, the literally hundreds of comments) I thought it would help me solve this (IMHO) unreasonable problem, so I did everything I could to actually use it (the use of SIDs was the last 'missing part') and hope to have a solution -- and, when it didn't actually solve the problem, decided to look for an alternate solution (described above), because my willingness to cut a path through the 'permissions jungle' had petered out.I understand that you "don’t have any background installing or using XPMode" (I imagine not many have, since it's a niche app, with a dwindling 'customer base'); but, since I've already had much enlightenment from you, maybe you DO have some idea on the possibility I described earlier:"I already had access problems in this Win7 system, when it refused to even allow the installation of any ‘local (non-USB) printer’, but managed to tweak permissions until that was overcome (and, curiouser: On one previous install of the same Win7, that problem didn’t arise, so I suspect it was some parameter during install which led to this)."Since I will be reinstalling Win 7 soon, perhaps you can offer some concrete and specific pointers on the options to choose during installation, for a 'single user' (as I described it above), since you have to make many choices during it, with no indication of the consequences of each choice 'down the lane', and I feel that some of them are probably what caused the access denial to installation of a local non-USB printer, and would like to avoid the wrong choices next time (in case I haven't made it clear, I'm looking for "recipe" kinds of indications, not general principles or ideas). Of course, if don't have such suggestions, that's fine too, and thanks again for your willingness to help others with you experience and clear writing.

  • Anonymous
    January 06, 2018
    None of this. It suddenly stopped working.

    • Anonymous
      January 07, 2018
      Hi Tanweer Ahmed - Can you please provide more details about your scenario? What exactly are you trying to do that suddenly stopped working, and what exact error message(s) do you see?