Re: Unknown Entry - S-1-5-21-2533013469-2641548184-613786714-1000
So if I understand you correctly, you have removed the permission on all
files except for some system files, which have returned an access denied
error.
It sounds like Windows Resource Protection is blocking the changes to the
protected system files.
You will need to take ownership of the files left in order to be able to
edit their permissions. To do that, click advanced on the security
properties page, click the owner tab, click edit, select administrators, (do
NOT check the box next to replace owner on subcontainers and objects if it
is there), and then keep clicking ok until all the properties windows are
gone. Re-open the security properties screen, and you should now be able to
remove the permission.
Ideally, you should change the ownership back to the owner that was there
before, once you are done changing permissions (unless of course the owner
was the unknown account). To reference the trustedinstaller user, you must
use "nt service\trustedinstaller" for the user name.
I would point out too that this extra permission is harmless, it sounds like
it's just a side effect of the way they imaged the recovery CD, though
there's nothing wrong with removing the permission, as long as you keep the
rest of the security settings intact (including the inheritance structure).
--
- JB
Microsoft MVP Windows Shell/User
"Ben Ramsay" <benramsay97@optusnet.com.au> wrote in message
news:5CAAE8D8-6D7C-4E9B-A745-F413B3F5BDD2@microsoft.com...
>I have tried to remove is as perscribed in windows help, however when the
>files, as described before, are encountered windows returns a access denied
>error but it soes allow me to continue. Widows warns me at the end of the
>procedure that the permission may not be set correctly for some files and
>windows basically dosen't like this.
>
> As far as I can see it is a standalone with not inherited attachments.
> Even if I change it to my security setting that wass setup when i
> configured windows after using the recovery disks, windows will allow it
> but some files still remain on this setting.
>
> I have also checked on my other computer and found that this setting does
> not exist in it, so I am thinking that it must be somthing to do with the
> Recovery disks as my laptop has a fresh install on it and the origginal
> installation disk was used not a recovery disk.
>
> Hope this helps
> --------------------------------------------------------------------------------------------
> "Jimmy Brush" <jb@mvps.org> wrote in message
> news:BC87F466-9BFA-4B12-97A7-4C0BEE06255B@microsoft.com...
>> Please explain how it does not let you remove the permission. List what
>> actions you take, and any errors you get. You should be working with the
>> security properties for drive c, it sounds like it is inheriting this
>> permission from it.
>>
>> - JB
>>
>> "Ben Ramsay" <benramsay97@optusnet.com.au> wrote in message
>> news:5E520A26-F4D2-4F6A-8684-01DEA006A29D@microsoft.com...
>>> It seems to only apply to the drive that windows is installed on. Have
>>> Tried to remove it and Boot files and a few system files won't let me
>>> delete the account. It appears to start at the root folder, in this case
>>> C:\. It hase a special permission attached to it. I have sent an email
>>> of to NEC because, if I remember correctly it was already active when I
>>> used the Recovery Disks.
>>>
>>> I am still seeking help form all here as well as NEC.
>>> ----------------------------------------------------------------------------------------
>>> "Jimmy Brush" <jb@mvps.org> wrote in message
>>> news:FA3B0E59-16A2-4805-AB4C-DF5452152251@microsoft.com...
>>>>
>>>> "Ben Ramsay" <benramsay97@optusnet.com.au> wrote in message
>>>> news:436FB21C-54C9-4AD8-BEF5-04E39B19B74C@microsoft.com...
>>>> <snip>
>>>>>...it may be osed to access my system without me knowing.
>>>>
>>>> Not really.
>>>>
>>>> Do you know where the permission originates at? What I mean is, you see
>>>> this permission on a folder. Go up to the parent folder, and check to
>>>> see if it is there as well, and keep doing that until you either find a
>>>> folder that doesn't have that permission or you hit your hard drive.
>>>>
>>>> Once you find out where the permission originates at, you should be
>>>> able to remove it from that location's permission list by going to the
>>>> security tab, clicking the edit button, clicking the permission, and
>>>> clicking remove.
>>>>
>>>>
>>>> --
>>>> - JB
>>>> Microsoft MVP Windows Shell/User
>>>
>>
>