setup package fails with error code 5 or 0x5 or 0x80070005. All of these error codes mean Access Denied. General solution here (XP/Vista)

[devnullius @ gmail]

Hello

Below a copy-paste of a GREAT tip. Just stumbled upon it, and wanted
to archive the info. It's cool, I might say ; -)

For short reference: here the original script....


cd /d "%programfiles%\Windows Resource Kits\Tools"

subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f /
grant=system=f /grant=restricted=r /grant=YOURUSERNAME=f /
setowner=administrators > %temp%\subinacl_output.txt
subinacl /keyreg HKEY_CURRENT_USER /grant=administrators=f /
grant=system=f /grant=restricted=r /grant=YOURUSERNAME=f /
setowner=administrators >> %temp%\subinacl_output.txt

subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f /
grant=system=f /grant=users=r /grant=everyone=r /grant=restricted=r /
setowner=administrators >> %temp%\subinacl_output.txt
subinacl /keyreg HKEY_LOCAL_MACHINE /grant=administrators=f /
grant=system=f /grant=users=r /grant=everyone=r /grant=restricted=r /
setowner=administrators >> %temp%\subinacl_output.txt

subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f /
grant=system=f /grant=users=r /setowner=administrators >> %temp%
\subinacl_output.txt
subinacl /keyreg HKEY_CLASSES_ROOT /grant=administrators=f /
grant=system=f /grant=users=r /setowner=administrators >> %temp%
\subinacl_output.txt


subinacl /subdirectories %programfiles%\ /grant=administrators=f /
grant=system=f /grant=users=e >> %temp%\subinacl_output.txt

subinacl /subdirectories %windir%\ /grant=administrators=f /
grant=system=f /grant=users=e >> %temp%\subinacl_output.txt


Have fun & Peace!

Devvie


Conare nullius momenti videri fortasse missilibus careant
------
All spelling mistakes are my own and may only be distributed under the
GNU General
Public License! -((c) 1995-2001 by Coredump; 2002-007 by DevNullius)


NOW FOR THE FUN PART: THE ORIGINAL POST IS BELOW ; )

FROM: http://blogs.msdn.com/astebner/archive/2006/09/04/739820.aspx

Aaron Stebner's WebLog
Thoughts about setup and deployment issues, XNA, Windows Media Center,
the .NET Framework and Visual Studio



Solving setup errors by using the SubInACL tool to repair file and
registry permissions
A while back, I wrote a blog post about a .NET Framework 2.0 beta 2
installation problem that was caused by incorrect access control list
(ACL) permissions on some registry hives. In that post, I described
how to use a tool in the Windows Resource Kit named SubInACL to reset
file and registry ACLs to help solve this problem.

Ever since I wrote that post, I have run into installation errors for
several other products that have been solved by using the SubInACL
tool. Therefore, I wanted to write a standalone set of instructions
for how and when to use the SubInACL tool because the previous blog
post is specific to the .NET Framework 2.0 setup and does not always
appear in search results when people run into this kind of a problem
and search the Internet for assistance.

How to download and run SubInACL

Here are some steps that can be used to download and run the SubInACL
tool to repair file and registry permissions that are often needed to
successfully install programs on Windows, particularly for MSI-based
(Windows Installer) setups:

Download the SubInACL tool and install it. By default it will install
to c:\Program Files\Windows Resource Kits\Tools
If you are running Windows Vista, click on the Start menu, choose All
Programs, then Accessories, then right-click on the item named Command
Prompt and choose Run as administrator
If you are running an OS other than Windows Vista, go to the Start
menu, choose Run, type cmd and click OK
Type notepad reset.cmd and click yes to create a new file named
reset.cmd
Copy and paste the following contents into reset.cmd (or download it
from this location on my file server and rename it from reset.cmd.txt
to reset.cmd):

cd /d "%programfiles%\Windows Resource Kits\Tools"

subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f /
grant=system=f /grant=restricted=r /grant=YOURUSERNAME=f /
setowner=administrators > %temp%\subinacl_output.txt
subinacl /keyreg HKEY_CURRENT_USER /grant=administrators=f /
grant=system=f /grant=restricted=r /grant=YOURUSERNAME=f /
setowner=administrators >> %temp%\subinacl_output.txt

subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f /
grant=system=f /grant=users=r /grant=everyone=r /grant=restricted=r /
setowner=administrators >> %temp%\subinacl_output.txt
subinacl /keyreg HKEY_LOCAL_MACHINE /grant=administrators=f /
grant=system=f /grant=users=r /grant=everyone=r /grant=restricted=r /
setowner=administrators >> %temp%\subinacl_output.txt

subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f /
grant=system=f /grant=users=r /setowner=administrators >> %temp%
\subinacl_output.txt
subinacl /keyreg HKEY_CLASSES_ROOT /grant=administrators=f /
grant=system=f /grant=users=r /setowner=administrators >> %temp%
\subinacl_output.txt


subinacl /subdirectories %programfiles%\ /grant=administrators=f /
grant=system=f /grant=users=e >> %temp%\subinacl_output.txt

subinacl /subdirectories %windir%\ /grant=administrators=f /
grant=system=f /grant=users=e >> %temp%\subinacl_output.txt

Change the values named YOURUSERNAME to be the Windows user account
that you are logged in with.
Save and close reset.cmd.
Type reset.cmd and press enter to run the SubInACL tool. This tool
will take several minutes to run, and it requires that the user
account you are using has administrator privileges on the system.
This is why it is necessary to run it from an elevated cmd prompt on
Windows Vista. Step 2 above can be used to start an elevated cmd
prompt on Windows Vista.
After reset.cmd completes, try to install the product that previously
failed to install correctly on your system
Note: There are a couple of scenarios where installing or running
SubInAcl can fail. For example, some non-English versions of Windows
have the name of the Administrators group translated to another
language, and the command lines listed above will fail in that case.
I have posted workarounds for the issues that I know of in this
separate blog post.

Also note: Running the above command lines will cause SubInAcl to
create a log file named %temp%\subinacl_output.txt. If you see any
errors reported in the cmd prompt after running SubInAcl, you can look
in this log file for more detailed information about what file(s),
folder(s) or registry value(s) are causing the errors. To open this
log file, you can click on the Start menu, choose Run, type notepad
%temp%\subinacl_output.txt and click OK.

When is SubInACL useful

I have found that the SubInACL tool is most useful when a setup
package fails with error code 5 or 0x5 or 0x80070005. All of these
error codes mean Access Denied, and this type of error code is often
caused by missing ACLs for the Administrators group or the built-in
System account. The Windows Installer service runs with System
account permissions in most cases. If the System account does not
have sufficient permissions to access the file system or parts of the
registry, an MSI-based setup package will fail with an Access Denied
error.

SubInACL can also help resolve Internet Explorer script errors caused
by incorrect access control permissions for specific user accounts on
the system.

Example of a setup failure that was fixed by SubInACL

A customer contacted me with a problem installing Visual Studio 2005.
I looked at the main Visual Studio log file located at %temp%
\dd_vsinstall80.txt, and I found that Windows Installer 3.1 setup was
failing. Then, I looked at the Windows Installer 3.1 setup log file
located at %windir%\KB893803v2.log. It showed the following error:

30.844: DoRegistryUpdates:UpdSpInstallFromInfSection Failed for
MSI.Reg.Install: 0x5
30.844: DoInstallation:DoRegistryUpdates failed
30.875: Access is denied.

I had the customer run the above steps to use the SubInACL tool to
update the file and registry ACLs on their system, and then they were
able to install Windows Installer 3.1 and Visual Studio 2005 with no
further problems.

<update date="11/15/2006"> Updated subinacl command lines to include
recursive ACL updating for folders and files under %windir% </update>

<update date="3/22/2007"> Updated the steps to make them easier to
follow by moving the directory change into the batch file. </update>

<update date="9/25/2007"> Updated the notes to indicate that some
Internet Explorer script errors can be resolved with this tool as
well. </update>

<update date="5/30/2008"> Updated command lines based on customer
feedback regarding their experiences on Windows Vista. </update>

<update date="6/16/2008"> Updated command lines to cause SubInAcl to
create a log file in the %temp% directory in case it is needed for
troubleshooting afterwards. </update>

<update date="6/17/2008"> Added a link to a blog post where I describe
a couple of workarounds for problems that can occur while trying to
install and/or run SubInAcl. </update>

<update date="6/20/2008"> Updated command line to include a backslash
after %SystemDrive% in the 2nd to last command. </update>

<update date="6/24/2008"> Updated wording of link to the post for
troubleshooting SubInAcl errors to try to make it more visible. </
update>

<update date="7/29/2008"> Updated directory ACL command lines to not
affect the Documents and Settings sub-folders. </update>

<update date="3/12/2009"> Fixed broken link to reset.cmd. </update>



Published Monday, September 04, 2006 10:17 AM by astebner
Filed under: Setup Issues, Visual Studio and .NET Framework,
Essentials for setup troubleshooting
Comments

Saturday, December 02, 2006 1:37 PM by ALF1328
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
I can't thank you enough for writing this quide. I was having
installation problems which I spent a few days constantly trying to
solve. I finally found information telling me to use the SubInACL tool
but wasn't told how to create the file named Reset.cmd.

I have now sorted my problem thanks to your EXTREMELY HELPFUL
instructions.

Thankyou so much!

Monday, January 15, 2007 4:42 AM by racecarfl
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Thanks for your help with this. I too had been days trying to get
either dotnet 2 or dotnet 3 to install and they kept stopping on
permission errors and I was admin and reset file permissions on the
one file with no luck. I used the cleaner and it helped with other
problems but this got dotnet 3 working finally !! Great Job...

Tuesday, February 20, 2007 10:24 AM by danlanier
# This post is a gift for techs battling this issue
Aaron, Thank you so much for this posting. On the campus I work we
have encountered a host of issues. All while I kept think that the
issue wasn't this "program" or this "update" or install. You excellent
work here has validated what my gut has been telling me.

Your solution goes to the very root a problem that may plauge more
users than I'd care to think about.

As an analyst in the field, THANK YOU!!

Thursday, March 22, 2007 6:44 AM by FuzzyBS
# Contributing my (slightly) enhanced version of the Reset.cmd script
Add me to the ranks above lauding your efforts. I wish I had found
this information at least 3 or 4 years ago. Ever since Visual
studio .NET, I've had problems opening websites on my local IIS using
FrontPage extensions which I recently found out is caused by registry
permissions in HKCR (thanks to researching my IE7 installation
problems). I hope this will either get me straightened out
permanently or at least give me a quicker resolution when it happens.

To give something back, I've enhanced the Cmd batch script above so
it's capable of being run without going into a shell or changing
directories, so it's easier to give to novice users needing help. I'm
not sure the best way to post this, so I'll paste it here and perhaps
Aaron can make it into a link. (By the way, I called my file
ResetACLs.cmd.) If this gets munged, email me for a copy of the file.

@echo off

title Resetting ACLs...

cd /d "%ProgramFiles%\Windows Resource Kits\Tools"

echo.

echo Resetting ACLs...

echo (this may take several minutes to complete)

echo.

echo
==========================================================================

echo.

echo.

subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f /
grant=system=f

echo.

echo.

subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f /
grant=system=f

echo.

echo.

subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f /
grant=system=f

echo.

echo.

echo System Drive...

subinacl /subdirectories %SystemDrive% /grant=administrators=f /
grant=system=f

echo.

echo.

echo Windows Directory...

subinacl /subdirectories %windir%\*.* /grant=administrators=f /
grant=system=f

echo.

echo.

echo
==========================================================================

echo.

echo FINISHED.

echo.

echo Press any key to exit . . .

pause >NUL

Thursday, March 22, 2007 3:46 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi FuzzyBS - Thank you for contributing this updated version of
reset.cmd. I've updated the version on my file share to contain these
contents so it will be easier to use in the future.

Tuesday, April 03, 2007 1:46 PM by Mattie
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Do you have any guidance on a 64-bit version of SubInAcl?

It's been over a year, but I seem to recall that it didn't work
properly on x64 (at least for registry usage) because it couldn't
access the 64-bit registry hive. I asked for a 64-bit version of the
tool at the time, and the response was that none were planned. I
thought I'd check to see if there was anyone else running into this,
or thought towards an x64 version.

Wednesday, April 04, 2007 11:31 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Mattie - I've never tried SubInAcl on 64-bit systems, but it
wouldn't surprise me if it didn't work on that processor architecture.

On a 64-bit system, you might need to use one of the built-in Windows
tools such as cacls to reset ACLs on your system. You can click on
the Start menu, choose run, type cmd and click OK, and then run
cacls /? to list usage information for this tool. Hopefully this will
help in your scenario.

Thursday, August 09, 2007 1:10 AM by larz65
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
As an admitted hack (Step 1 of the 12), I am compelled to address you
as Mr. Stebner.

I've been puzzled by the persistant registry errors I received while
trying to install IE7. The directions in your post finally fixed the
problem. I'm adding my IE7.log with the error string for others that
might be encountering the same problem. Thanks again for the excellent
advice!

0.265:
================================================================================

0.265: 2007/08/08 21:49:11.328 (local)

0.265: c:\b7a15deb6e2d1a90b811b9a464769875\update\update.exe (version
6.2.29.0)

0.281: Hotfix started with following command line: /quiet /norestart /
er /log:C:\WINDOWS

2.187: IECUSTOM: Scanning for proper registry permissions...

2.969: IECUSTOM: Scanning for proper registry permissions...

3.156: IECUSTOM: Scanning for proper registry permissions...

3.469: IECUSTOM: Unwriteable key HKLM\SOFTWARE\Classes\Interface
\{3B7C8862-D78F-101B-B9B5-04021C009402}

3.469: IECUSTOM: Unwriteable key HKLM\SOFTWARE\Classes\Interface
\{859321D0-3FD1-11CF-8981-00AA00688B10}

3.484: IECUSTOM: Unwriteable key HKLM\SOFTWARE\Classes\Interface\
{E9A5593C-CAB0-11D1-8C0B-0000F8754DA1}

3.484: IECUSTOM: Unwriteable key HKLM\SOFTWARE\Classes\Interface\
{ED117630-4090-11CF-8981-00AA00688B10}

3.500: IECUSTOM: Backing up registry permissions...

3.500: IECUSTOM: Unable to backup DACLs HKLM\SOFTWARE\Classes\Interface
\{ED117630-4090-11CF-8981-00AA00688B10}

3.500: IECUSTOM: Finished backing up registry permissions...

3.500: IECUSTOM: An error occured verifying registry permissions.
ERROR: 0x80070005

3.500: DoInstallation: CustomizeCall Failed: 0x3f5

3.500: IECUSTOM: Restoring registry permissions...

3.500: IECUSTOM: Unable to restore DACLs HKLM\SOFTWARE\Classes
\Interface\{ED117630-4090-11CF-8981-00AA00688B10}

3.500: IECUSTOM: Unable to restore DACLs HKLM\SOFTWARE\Classes
\Interface\{E9A5593C-CAB0-11D1-8C0B-0000F8754DA1}

3.500: IECUSTOM: Unable to restore DACLs HKLM\SOFTWARE\Classes
\Interface\{859321D0-3FD1-11CF-8981-00AA00688B10}

3.500: IECUSTOM: Unable to restore DACLs HKLM\SOFTWARE\Classes
\Interface\{3B7C8862-D78F-101B-B9B5-04021C009402}

3.500: IECUSTOM: Finished restoring registry permissions...

3.500: The configuration registry key could not be written.

3.500: Internet Explorer 7 installation did not complete.

3.500: Update.exe extended error code = 0x3f5

0.375:
================================================================================

Tuesday, October 23, 2007 2:58 AM by d.cochran
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
I'm going to go ahead and preemptively thank you for this - I've been
getting this error (with installer 3.1, curiously enough) for *ages*
now and until I found this site, no one really had any functional
ideas on how to fix it.

When/if this works, if I ever meetcha in real life, I'm buyin you a
pizza and/or beer, whichever you prefer ;)

Tuesday, October 23, 2007 12:41 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi D.cochran - Hopefully these steps will end up working for you. As
my wife can attest - I'm always up for pizza :-)

Tuesday, November 06, 2007 2:59 PM by psale
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
There is but a single account on my Win XP Pro SP2 notebook, an
Administrator account, so of course I am the Administrator. Prior to
installing any new software on this notebook I like to temporarily
disable all Startup programs by running MSCONFIG, un-checking "Load
Startup Items" and clicking OK. I then re-boot and continue with the
installation of my new software. Very recently, while this procedure
seems to continue to work, it also displays an ominous message, "An
Access Denied error was returned while attempting to change a service.
You may need to log on using an Administrator account to make the
specified changes." A Google search revealed Aaron Stebner’s Weblog
for “Solving setup errors by using the SubInACL tool to repair file
and registry permissions” as a possible solution to this vexing
problem.

The good news is that Mr. Stebner’s cmd file runs correctly, and
breaks nothing. The bad news is that I continue to get that ominous
message even though the change I make inside MSCONFIG seems to “take”
just fine. That is, I can successfully disable and later re-enable all
“Load Startup Items”.

-

Peter Sale

Santa Monica CA USA

Tuesday, November 06, 2007 5:28 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Psale - I'm sorry for the hassle this is causing for you. Each
object in the OS has specific ACLs assigned to it, including files,
registry keys, services, etc. Even if you're running as an
administrator, if your administrator group doesn't have correct ACLs,
you won't be able to modify an object. The SubInAcl tool adds
administrator and system permissions for files and registry entries,
but it doesn't modify other objects like services. It is possible
that there is a service that you have to manually go and change the
ACLs for in order to fix this issue. You can use a tool like Process
Monitor (http://www.microsoft.com/technet/sysinternals/
ProcessesAndThreads/processmonitor.mspx) to narrow down what object is
causing the access denied error. From there, you should be able to
use Windows Explorer or the Services control panel to right-click on
the object, choose the Security tab and add the missing ACLs.

Tuesday, December 11, 2007 11:20 AM by jcmeyrignac
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
I encountered a similar problem during the installation of VS2008 on
Vista (more exactly, it crashed during the installation of Document
Explorer 2008).

I fixed the problem myself, by writing a small tool that was similar
to SubInACL.

After spending more than one day on fixing the problem, I discovered
this nice page. Argh !

Anyway, here is a way to reproduce the bug, since it appears to be a
bug from Vista:

1) Install Vista on a computer

2) Create a temporary admin account

3) Install Visual Studio 2005 or Office with this account (I disabled
UAC, but it may be possible to reproduce the problem by running the
installer as Administrator).

4) Use another account, or simply log into a domain

5) Delete the temporary admin account.

Now, Vista's registry is completely broken, with a ton of registries
giving access denied, even if you are admin.

In my case, I had 729 broken registries, and it was impossible to
manually repair.

Friday, December 14, 2007 6:05 PM by michaelflinn
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Beautiful article. Now to see if it will solve my problems....

I reproduced JC's scenario above inadvertently - perhaps by trying the
easy way to do things - which should work.

Had Vista RC1 installed and Office 2007 Beta. Office Beta expired.
Needed quick edits in a web page, Installed Front Page 2003.

Everything - IE 7, Search, Cntrl Panel -- working. RC1 Expired.

Installed RTM Vista Ultimate. As an upgrade, which succeeded without
complaint. Installed Office 2007. Left FP 2003 on there. Ran a
little .reg file that turned of the completely inappropriate control
over directory appearance in Explorer.

Now, IE7 wouldn't start. Search from the start menu wouldn't start.
Control panel would not show any entries on the so called "Control
Panel Home" (but would work in classic view). Running ProcMon while
starting IE7 showed an "Access Denied" followed by a thread exit and
then a few thousand more events as it shut down without opening. I
changed the permissions on the questionable key (had to take ownership
as others have noted -as admin, not dev, knew this) and now it would
start, that is the window would open. But it was absolutely dead.
Nothing in the window would work.

Looked at the reg again - now, a couple subkeys had appeared, and
behold, they lacked the proper permissions.

Same sort of thing happened when monitoring the attempted start of
Search. 10 access denieds. Monitored a boot sequence: 423 access
denieds. Gave up and started searching for something like this. Two
days of failure - using search on MSFTs site - Live lost the search
battle, because Google, not Live, found this blog the fourth entry
down.

Thanks for the article!

Whether it works or not....:)

Friday, December 14, 2007 7:33 PM by michaelflinn
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Double plus good beautiful!

Reported that it took about 2.6 minutes, but took closer to 10.
Changed several hundred thousand entries. Good lord, no wonder vista
needs horsepower- a wonder it works at all.

It solved the three problems noted above and also fixed the inability
to copy files and directories from another (XP) machine. AND the
failure to find a file when Excel started. And Access's refusal to
start because there was no license on the machine.

You the man, you the reg man!

PS:

Note to other msft devs: please learn to think. Not to code, to
think.

Also learn to write halfway intelligent error messages. "Access can
not start because there is no license on this machine." That's your
error message and it is to stupidly wrong there are no words to
describe it. How about: "this program failed to start because it
could not access the following registry key[s]....xxxxx...." How hard
is that? Jeeez.

PPs

Thx again for the article.

Sunday, December 30, 2007 7:49 AM by JayAh
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
You Sir, are a genius. I had problems installing Quicktime - was
getting a 'you don't have sufficient permissions' nonsense whenever I
installed it...I tried everything but nothing worked. Apple told me to
re-install Windows but that's their answer to everything when they
can't figure out what to do. I followed your tips, and everything
installed beautifully. Well done, sir, well done!

Sunday, December 30, 2007 9:02 AM by GaryE
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Dear Aaron,

I am somewhat computer "illiterate" but I found your posts via a
search on Windows XP advice site.

I have the same problem trying to open any program files, Windows
Updates, "run", etc...same message continually appears:

Windows cannot access the specified file, program or device. You may
not have the appropriate permissions to access..."

My system is Windows XP Home Edition.

I followed the instructions you gave but when I attempt to "run" the
downloaded file SubInACL.exe, I get the following error message:

"Windows Installer - The feature you are trying to use is on a network
resource that is unavailable. Click OK to try again, or enter an
alternate path to a folder containing the installation package
"subinacl.msi" in the

box below:"

The "box below" shows Desktop as the only location. When I browse the
Windows files I do not see a folder called "Windows Resource Kits
\Tools" anywhere on my system.

I saved the downloaded file to the folder "Downloaded Installations"
in any event, but when I click the file to run it, I get the same
exact message as

above.

When I click OK, the following message appears:

"The installation source for this product is not available. Verify
that the source exists and that you can access it."

I am frustrated beyond measure and would greatly appreciate any and
all pertinent advice.

I am the Administrator and the only person using the laptop.

In "Safe Mode" I gave myself permissions for all program files,
Windows files, etc...

Kind regards,

Gary English

Abu Dhabi, UAE

Monday, December 31, 2007 1:36 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi GaryE - It sounds like something went wrong with the installation
of the SubInAcl tool on your system. I'd suggest trying to do the
following:

1. Use the steps listed at http://blogs.msdn.com/astebner/archive/2005/10/30/487096.aspx
to manually remove the SubInAcl product from your system.

2. Re-download it and re-install it from
http://www.microsoft.com/downloads/details.aspx?FamilyId=E8BA3E56-D8FE-4A91-93CF-ED6985E3927B

3. Try again to use the steps listed above in this blog post.

Also, in general, it is not sufficient to just grant your user account
permissions. Usually you have to also grant the local system account
and the Administrators group access as well (which is essentially what
the instructions above will achieve).

Hopefully this will help.

Tuesday, January 01, 2008 2:41 AM by GaryE
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Thanks Aaron - I deleted Windows Installer and dowloaded a newer
version, the was able to install SubInAcl. I followed your
instructions to the letter...but I still receive the message:

"Windows cannot access the specified device, path or file. You may not
have the appropriate permissions to..."

A colleague here suggested it might be caused by a "worm" which has
taken control of registry files..? Scans do not show any viruses or
worms but he said they can be hidden, or "removed" but still cause
havoc.

Many thanks and Happy New Year to everyone,

Gary

Tuesday, January 01, 2008 5:25 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi GaryE - If SubInAcl didn't help resolve the permission problem,
then there are a few other things I typically suggest. First, you can
try to disable some services to see if there is something else
preventing you from accessing those resources (such as an anti-virus
program or anti-spyware program). You can use the steps listed at
http://blogs.msdn.com/astebner/archive/2006/11/25/disabling-services-with-msconfig-to-work-around-setup-failures.aspx
to try this out.

If that doesn't help, you can try to use a tool like Process Monitor
(http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx) to try
to manually narrow down which file/folder/registry key is causing the
access denied error and then try to fix the permissions directly.

I've also heard of cases where this type of error has been caused by a
virus, but typically in those cases, the virus is discovered by
running a scan on the system.

Hopefully one of the above suggestions helps.

Thursday, January 03, 2008 3:11 PM by BobbyL
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Yep..I have the same problem with script errors on wife's account only
when she opens Adobe Photoshop Elements (not an install problem just
opening existing app). The SubIn ACL fix looks very promising, but
like Gary E, I have XP Home SP2, not Pro as the MS descriptin at the
SubInACL download site says. That is pretty clear that it will not
work with XP Home. Has anyone been successful with this tool with XP
Home? I'm pretty reluctant to try it for fear of screwing things up a
lot worse.

BobbyL

Thursday, January 03, 2008 4:31 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi BobbyL - The web site doesn't specify this, but SubInAcl will run
fine on Windows XP Home just like on XP Professional. I'd suggest
giving the steps a try to see if they help at all on your system. If
they don't work, you may need to try the additional suggestions I
posted in my most recent reply above to GaryE.

Hopefully this helps!

Friday, January 04, 2008 10:00 PM by BobbyL
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Aaron,

The URL you provided right in the beginning of your blog to the MS
site for SubInACL tool does indeed in the System Requirements section
explicity say XP Pro...no mention of XP Home. The problems that GaryE
had may be traced to the fact that he is using XP Home, as he said in
his very first comment above on 12.30.07.

I was hoping that someone might have successfully used the SubInACL
fix under XP Home. I am willing to try it if I had some confidence
that I would not further hose up my system. You think I might be safe
to proceed if I had a Ghost image to restore the system to if things
went south?

BobbyL

Saturday, January 05, 2008 12:21 AM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi BobbyL - I understand that the wording on the SubInAcl download
page seems to indicate that it supports XP Pro but not XP Home, but
from what I can tell and what I know about the tool, that is just an
oversight in the wording on the page and not an indication that this
tool won't work on XP Home. Nearly all of the operating system code
for Windows XP is identical between the Home, Pro, Tablet and Media
Center versions, including this type of security permissions
management code that SubInAcl interacts with. As a result, I don't
believe you run any risk of further damage to your system by trying it
out.

The issues that GaryE has run into simply mean that for some reason
SubInAcl didn't help resolve the issue he was encountering. The
SubInAcl steps listed in this blog post do not work for 100% of the
possible cases where an access denied error can occur. These steps
have been tailored to help in the majority of cases I've seen in the
past though, so they tend to work most of the time. GaryE's system
had some other missing permissions that these command lines didn't
help fix, so additional troubleshooting steps are needed to narrow
down the cause further. These issues weren't caused by trying to run
SubInAcl though - they existed before the tool was even attempted on
his system.

Saturday, January 05, 2008 10:32 AM by BobbyL
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Aaron,

I took the plunge and tried your fix...and it did the job!! No
problem with running XP Home. Thanks so much for sharing your
knowledge and encouragement on this...you are the man!

BobbyL

Saturday, January 05, 2008 11:15 AM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi BobbyL - I'm really glad to hear that these steps helped solve this
issue on your system. I'm sorry for the hassle it caused for you
along the way, and I'm also sorry for the confusion caused by the
documentation on the SubInAcl download page. Please let me know if
you run into any additional problems on your system.

Monday, January 07, 2008 1:35 AM by clockman
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
I found this post on Google. 2 years and no SP2 because of permission
errors on my XP Home OS. I followed BobbyL's bravery and tried the
SubINAcl install too. I am happy to report SP2 now is installed on my
XP Home Edition with now problems. - except for the install of 61 -
SP2 MS updates that took awhile to complete. :-)

Tuesday, January 08, 2008 2:54 AM by GaryE
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi again,

Sorry for the delay in getting back to you but I was down with what is
known as "Abu Dhabi Flu" which is going around this time of year.

I did download and install Process Monitor but to be honest, I have no
idea at all what I am looking at when it is running...or what I should
be looking for.

I ran the codes you listed above once again and when it completed, I
had the following messages (some of my spacing my not be correct as I
copied it quickly):

C:\Program Files\Windows Resource Kits\Tools>subinacl /subdirectories
C: /grant=administrators=f /grant=system=f Access is Denied

Also another >subainacl with the following:

/subdirectories C:\Windows\*.* /grant=administrators=f /grant=system=f
Access is Denied

Any thoughts about this?

Kind regards,

Gary

Tuesday, January 08, 2008 4:11 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi GaryE - I'm sorry that you ended up getting sick. I've been
fighting something similar to that myself :-(

It can be difficult to narrow down exactly what to look for in Process
Monitor. What I usually do is start by adding a filter based on the
process name - typically that is the name of the setup program you are
trying to install, or if the setup is an MSI then it will be
msiexec.exe.

Then, I run the setup and reproduce the failure, and start looking for
errors listed in the output. From the errors, you can see the cause
of the error in one of the columns in Process Monitor - they should be
listed as access denied in this type of scenario.

I've never heard of a case where running SubInAcl itself gave an
access denied error though. Are you running it when logged in as an
administrator on your system? You may need to go and manually try to
do what each of those failing SubInAcl steps are doing. You can
manually change the permissions for a folder or registry key using
Windows Explorer or regedit.exe. You will want to add the
Administrators group and grant that group full control and also add
the SYSTEM account and give it full control. You can do this for the
root of your C drive, the c:\windows directory, and the roots of the
HKEY_LOCAL_MACHINE, HKEY_CLASSES_ROOT and HKEY_CURRENT_USER registry
hives and hopefully that will help.

Saturday, February 02, 2008 11:18 AM by ke...@greatriverdesign.com
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
I found a copy of this fix on another blog that mentioned they had
used it on Vista to fix it so that the latest beta of Safari would
run. I backed up my system, created a system restore point, and ran
the script.

Upon restarting, most of my services failed to start. I could not run
any properties boxes, nor run most system programs without getting a
message that "The system does not have enough memory to complete this
task (0x8007000e).

Even using the Vista DVD and trying to do a system restore would not
work correctly. It was completely crazy.

Finally I stumbled on another page where someone else had used this
tool with a slightly different command. Since I was on the verge of
re-installing everything anyway I figured it was worth a try, and it
fixed EVERYTHING.

cd /d "%programfiles%\Windows Resource Kits\Tools"

subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f /
grant=system=f /grant=restricted=r /grant=USERNAME=f /
grant=restricted=r /setowner=administrators

subinacl /keyreg HKEY_CURRENT_USER /grant=administrators=f /
grant=system=f /grant=restricted=r /grant=USERNAME=f /
grant=restricted=r /setowner=administrators

subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f /
grant=system=f /grant=users=r /grant=everyone=r /
setowner=administrators

subinacl /keyreg HKEY_LOCAL_MACHINE /grant=administrators=f /
grant=system=f /grant=users=r /grant=everyone=r /
setowner=administrators

subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f /
grant=system=f /grant=users=r /setowner=administrators

subinacl /keyreg HKEY_CLASSES_ROOT /grant=administrators=f /
grant=system=f /grant=users=r /setowner=administrators

I wouldn't use this fix at all unless you are desperate!!

Sunday, February 03, 2008 6:21 PM by KenBanks
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Using the subinacl tool has solved this similar problem on my HP
Pavillion Media Center running Vista Home Premium which I first ran
into after installing Pinnacle software for use with a Pinnacle Show
Center ( and this was with UAC enabled). It has recurred a few more
times all related to installing other sorts of media server related
software. I still cannot get beyond the Media Center receiver
Service (ehRecvr.exe) form continuosly crashing and the Hauppauge
tuner card can no longer be found in the MS Media Center, even though
it works perfectly with WinTV.

BUT these issues are not what I want to call attention to here (I just
mentioned them in case other see similar problems or can suggest
anything)

What I really want to point out are some of the side effects of
running the above script using subinacl.exe on a Vista system which
has more than one user login. If you have several family members and
multiple logins on your initial login screen, these logins (except for
your Administrator member Accounts) will disappear after running the
above script.

I was completely stumped when I saw mine had vanished, but yet I could
still see all of them in the Control Panel under User Accounts. I
found a simple solution to bring them back by simply running 'net
localgroup User /ADD username' for each. HOWEVER, I still run into
all kinds of permissions issues with various applications and service,
like printing, etc. which require their own varied security settings.

I have added this to the script to help out on some of this, but
there is still something missing

for %%i in (TYPE YOUR USERNAMES HERE) DO (

echo Fix USER: %%i

net localgroup Users /ADD %%i

subinacl /subdirectories c:\Users\%%i /grant=administrators=f /
grant=system=f /grant=%%i=f /grant=Users=r

)

I don't know if grant=r is enough for regular Users or what other
permissions need to be reinstated to get things completely back to
normally.

So what I'm saying here is that you may think everything is great
again after running these subinalc commands, but I guarantee something
will turn up somewhere, and things become a lot more complicated when
you have multiple user accounts.

What I really wish we had was some sort of permissions map which
states what permissions should be assigned for what and whom by
default on a vanilla install. Trying to figure this out by tweaking
this and that (which is what I have been doing) is much too
dangerous. This seems to be a half-baked permissions scheme which
breaks and falls apart with little effort and there has been provided
no patch to correct it. This horrible experience has caused me to
discourage anyone who asks from moving to Vista. It is unreliable and
I wouldn't be able to help them, if they ran into his problem, with
much confidence.

Ken Banks

Sunday, February 03, 2008 6:42 PM by KenBanks
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
MY BAD.

this command is the culprit for disabling my user accoutns...

secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /
verbose

and it is not referenced in the above script of subinacl commands.

However, the permissions issues that I pointed out still apply when
you have multiple logins on Vista.

Ken banks

Monday, February 04, 2008 10:55 AM by Allan1
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Recently had a similar issue and am unable to resolve it. I'm taking
the liberty of pasting a full description of the issue as posted on my
forum. As stated in the text, the SubInACL tool did not help (btw,
when I ran it I noticed severl "error" messages, the the utility did
run to completion. Here's the issue - any assistance will be greatly
appreciated:

Over the weekend I tried to upgrade my setpoint software to the latest
release. After installation I opened setpoint to find there were no
tabs - either for the mouse or the keyboard. Spoke with Logitech and
they asked me to do a selective startup. When I tried to do so I
received the following message from msconfig:

"An Access Denied error was returned while attempting to change a
service. You may need to log on using an Administrator account to make
the specified changes."

Logitech says that's the problem - setpoint will only install when
logged into an Admin account. I am the only user and am logged on with
full admin rights. I then went to my office system and got the exact
same message when I tried to do a selective startup. My first thought
was that it might be some services I disabled - so I changed them all
to default XP Pro settings - didn't help. Other things I've tried:

Ran the SubInACL tool to repair file and registry permissions

Per a suggestion on the web I changed an HP registry setting

Tried making the changes from Safe Mode

Ran full scans with AV, AdAware & SpyBot

BTW, I do not use ZA

Bottom line, I still get the same error message in msconfig on both
systems and still cannot install the latest setpoint sw. I have a
current Acronis image of my system partition and have been reverting
to that after each unsuccessful attempt

Monday, February 04, 2008 11:43 AM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Allan1 - The SubInAcl commands that I list above in this blog post
are not guaranteed to fix all possible access denied errors on a
system. Specifically, it only changes the permissions on some files/
folders and some parts of the registry. It does not make any changes
to service permissions. You may need to try to manually correct any
remaining permission issues on your system.

One other thing I should note here - if you get an access denied
error, it does not necessarily mean that the account you're logging in
with is not a member of the Administrators group on your system (as
its seems to be implied by the Logitech error message above). It
means that whatever account you're logged in with doesn't have
sufficient permissions to whatever resource the system is trying to
access. Not all resources on a system are accessible even by
administrators, plus permissions can be changed by other software or
by the user.

Also, selective startup mode does not cause the logged in user to no
longer be a member of the Administrators group.

I'd suggest trying to contact Logitech again to find out exactly what
files, registry and/or services are being accessed when you tryt o
start your software and see if they can walk you through steps to fix
the permissions manually.

Tuesday, February 05, 2008 11:38 AM by zArchASMPgmr
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
I have some good news, and some so-so news.

Always starting off with good news: SubInACL works on Vista x64 (in
this case, Ultimate).

So-so news: I think I also discovered a bug related to depth.

My HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID branch is
huge. (Well, so is Classes.) At some point, the path name printed
during the progress message starts to be inaccurate; the Wow6432Node
starts repeating in the display, but it does work (based on the last
messages after a ^C). But eventually SubInACL crashed. I was able to
specify just Classes and it eventually worked (after about 4 million
updates). I manually updated the other Wow6432Node branches.

I'm happy to report that this has cleared up the 80070005 and 8020
(something or other) errors that I've been having with Automatic
Update.

Wednesday, February 06, 2008 8:14 AM by Allan1
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Okay, here's an update.

First, after some trial and error (and several hours on the phone with
Logitech) I was able to install Setpoint 4.00 (not the latest version,
but close enough). Turns out it had nothing to do with permissions or
rights.

Second, a couple of us have done some trial and error and we think the
message in msconfig may be related to systems that have .Net Framework
2.0 (SP1) or higher installed.

Last, when all is said and done it appears that the system will indeed
still boot to diagnostic mode even though that message is displayed.

Thanks so much for taking the time to respond and for this superb
thread and tutorial :)

Wednesday, February 06, 2008 12:11 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Allan1 - I'm glad you were able to get this software to work, but
I'm sorry for all of the hassles you had to go through. What was the
underlying issue in this scenario?

One comment - I don't know of any dependencies between MsConfig and
the .NET Framework. MsConfig should work fine regardless of whether
or not you have any versions of the .NET Framework installed on your
system.

Thursday, February 07, 2008 7:48 AM by Allan1
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
There were a couple of things. First, Logitech support told me that
Setpoint versions newer than 4.00 and had me download that version
from their FTP site. Second, I had to rename a specific file in
\windows\system32\drivers (wdf01000.sys) to a non-usable name
(ie, .bak) and then plug in the dongle for the new mouse (XP would not
install the HW if that file existed). I still got a "could not
complete HW install) at this point, but upon reboot XP did report
finishing the hw installation(it recognized the new mouse and
installed the new wdf01000.sys driver file - same version as the old
one). Then I installed the setpoint sw and it did recognize both the
new mouse and my old keyboard. Logitech acknowledges the problem I had
(no tabs after upgrading to Setpoint 4.x) is not uncommon and they can
generally get it to install with some known work-arounds, but they say
my problem was a little more sever than most. They did make note of
the steps I had to take to get it to work and entered the "fix" in the
DB.

As for .Net Framework and msconfig I agree - there should be no issue.
But we've found the problem exists on those systems where we have ver.
2 (sp1) installed and does not appear on other systems. Could be
coincidence I suppose.

Friday, February 08, 2008 9:57 AM by firecop1
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
I followed the instructions to setup and run SubInACL but I am unsure
that what I am seeing is success.

When I run it, and the window is open there is a red bar across the
top showing "Done:, Modified and Failed. It seems that the same number
that were modified also failed. Is this what I should be seeing or did
I do something wrong?

Friday, February 08, 2008 1:10 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Firecop1 - I haven't heard of SubInAcl displaying this type of
information in the past. Would it be possible for you to post a
screen shot of what you're seeing?

Also, did you try to run SubInAcl because you received an "access
denied" error while trying to install a product on your system? If
so, did you try to re-run that product setup after running SubInAcl to
see if it helped?

Monday, February 18, 2008 6:03 PM by hairball
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hey Aaron, i had the same type of display that firecop1 talks about,
but out of all of the registry entries shown, it only threw up 3
errors. I believe you may get this "red bar" screen when it is
actually modifying registry entries, as i had a lot of those. Anyway,
I do have a screenshot of what it looks like, but don't know how to
post it here, but I'll gladly send it if you'd like.

SubInACL did fix my problem, which was a failing Windows Update for
KB885836 that has stumped me for the last 6 months. I noticed a lot of
other folks have this same type of problem with other Windows Updates,
so I downloaded and tried to manually install KB885836 which is when
it gave me the registry permission denied error code 5, that led me to
your awesome article/application!

Thanks a bunch, my machine is fully patched again.

Saturday, March 01, 2008 5:36 PM by pdotnet
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
ke...@greatriverdesign.com... thank you so much for that comment! The
original reset.cmd in the blog post totally killed my Vista install.
Not even System Restore would work. Thankfully I took an image of my
entire drive using a 3rd party tool before running it!

After restoring my drive, I ran your version of the script and
everything works brilliantly now! No more access denied registry
warnings when trying to install and run certain software. Thanks!!

Wednesday, March 12, 2008 5:45 AM by Grzyb
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
re: Solving setup errors by using the SubInACL tool to repair file and
registry permissions

I have some good news, and some so-so news.

Always starting off with good news: SubInACL works on Vista x64 (in
this case, Ultimate).

So-so news: I think I also discovered a bug related to depth.

My HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID branch is
huge. (Well, so is Classes.) At some point, the path name printed
during the progress message starts to be inaccurate; the Wow6432Node
starts repeating in the display, but it does work (based on the last
messages after a ^C). But eventually SubInACL crashed. I was able to
specify just Classes and it eventually worked (after about 4 million
updates). I manually updated the other Wow6432Node branches.

I'm happy to report that this has cleared up the 80070005 and 8020
(something or other) errors that I've been having with Automatic
Update.

I am running Vista Ultimatex64 & I am having the same issues. Could
someone please tell me how to "specify" Just Classes & Manually Update
all the Other Now6432Node Branches???

Regards

Grzyb

Wednesday, March 12, 2008 12:41 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Grzyb - When you install the SubInAcl tool, it also installs a
readme file to the location C:\Program Files\Windows Resource Kits
\Tools\subinacl.htm. That readme provides detailed usage information,
including how you can specify exact sub-keys to update. Hopefully
this will help in your scenario.

Thursday, March 13, 2008 10:05 AM by Thomas1981
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hello at all,

i have the 80070005 Update Problem at Vista, so i tryid this,
installed SubInAcl successfully, but when i run the reset.cmd, i get
syntx errors for every line, like this:

Error when checking arguments - HKEY_Local_Machine

any solutions to this?

Thursday, March 13, 2008 12:33 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Thomas1981 - You need to make sure to run subinacl.exe from an
elevated cmd prompt on Windows Vista. To open an elevated cmd prompt,
you can click on the Start menu, choose All Programs, then
Accessories, then right-click on the item named Command Prompt and
choose Run as administrator.

I'm not sure that will solve this error though - I haven't heard of
this exact issue while running subinacl before. You may want to
review the readme at C:\Program Files\Windows Resource Kits\Tools
\subinacl.htm to see if you can figure out possible causes of this
error. You may also want to review the other comments on this blog -
there are some specific notes posted by others who have tried running
subinacl on Vista and run into issues, and they have posted other
suggested workarounds that may be useful to you as well.

Thursday, March 13, 2008 5:32 PM by Thomas1981
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
I've solved the problem, i deleted the

/grant=administrators=f

argument and it works fine. Vista Update is working too!

Thanks alot

Sunday, March 23, 2008 3:36 PM by olamoree
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
XP Pro SP2 Media Center, Toshiba Satellite A105

Hi Aaron,

Since July 15th of 2007, altho WGA always reports Genuine, all Updates
FAIL to install, even individual installs, reporting Error Code
0x80070005. Looked around, modified a couple of Registry Permissions
with no luck and FINALLY found your blog, DLed and INS SubInACL tool
and ran your script. Report:

Elapsed Time: 00 00:04:26

Done: 28654, Modified 28654, Failed 0

Last Done: C:\WINDOWS\wt\wtupdates\wtwebdriver\update_info\data.wts

C:\Program Files\Windows Resource Kits\Tools_

Now, I am going to Restart and pray... Back to MS Update, 9 Hi-
priority updates listed, A-V, malware and Firewall stopped, Install
Updates, a long pause (20 minutes), "Installation started...done!,
then Installing".... the rest following suit, taking 45 minutes and
Toshy restarted! and 10 optional updates selected, A-V, malware and
Firewall stopped and Installed without problems.

I am wondering, with what SubInACL repairs and your script resolves,
does any of that have to be returned to its original state? Has a
"hole" been left anywhere that could cause problems?

At any rate, I want to compliment you on your diligence, knowledge and
craft as well as sharing it with those who will listen. I have no
choice, I am subscribing to your Blog... and will sit at the feet of
the guru... just tell me what to think!

Ali

Monday, March 24, 2008 2:13 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Olamoree - The steps listed in this blog post use SubInAcl to add
full control permissions to the Administrators group and the local
system account to the following parts of your system:

1. The HKEY_LOCAL_MACHINE registry key and any sub-keys.

2. The HKEY_CLASSES_ROOT registry key and any sub-keys.

3. The HKEY_CURRENT_USER registry key and any sub-keys.

4. The %windir% folder and any sub-folders and files.

5. The %systemdrive% folder and any sub-folders and files.

Most installers for applications and OS hotfixes require this type of
permission to be able to install successfully. You shouldn't need to
reverse any of these things later on.

Thanks for the compliment on my blog. Please let me know if you run
into any issues in the future.

Tuesday, April 01, 2008 11:11 PM by aoshrin
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Thank you !! I am running an old machine with the world loaded on it,
running under Windows XP Home SP2. After recently installing Norton
360, some problems on my wife's (administrator account) got worse. I
saw the apparently classic unending Script error windows in IE7,
Control Panel/User Accounts, etc. Though I was somewhat concerned
about using your fix under XP Home, I saw that you addressed this
issue, and said it would work. I took more than a few minutes to run
(our registries have grown huge over the years), but it worked.
Control panel works, IE7 works, Flash 9 works. I didn't even have to
reboot or uninstall any software.

It's hard to express how appreciative I am.

Thursday, April 03, 2008 3:41 AM by staura
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Aaron

Thanks for your info, I have a problem with my registry and I think
your solution regarding SubInACL may well work, however I am rather
concerned that it could also make the situation worse? I have had
issues with iTunes so I decided to uninstall and reinstall iTunes,
uninstalling went fine however half way through reinstalling, the
following error msg came up

"Could not open key:

HKEY_LOCAL_MACHINE/software/Classes/Interface/
(915DA835-02FA-624BDF5D85AB)/ProxyStubClsid.

Verfiy that you have sufficient access to that key. or contact your
support personnel"

after this I was unable to install iTunes. In desperation I restored
the pc back to before I uninstalled iTunes at which point iTunes was
back on the system however now it won't run, and I can't uninstall
it. I tried to roll back the restore point and iTunes is still there
and still won't work... HELP!!! It’s driving me crazy! I have
contacted, iTunes, Microsoft, Acer and the closet I they have come to
helping me is to advise I restore the factory settings.

I am confident that if I can gain access/permission to the HKEY
mentioned it would resolve the problem. I was going to try the
SubInACL idea you suggested, however I am running Vista and the
reviews other people have left across the net have been very mixed
where Vista is involved. Do you think this registry fix would be the
solution to my iTunes problem or have I misinterpreted the use of the
SubInACL tool and I am likely to cause more problems with my already
problematic Vista laptop???

For the record, I have AVG 8.0 always running and I have no viruses,
rootkits, etc!

Any suggestions would be greatly appreciated

Thanks

Thursday, April 03, 2008 11:18 AM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Staura - It sounds like you have a permission problem for this
registry key, which is typically something that SubInAcl will allow
you to solve. However, before running the tool, you could attempt to
manually fix the permissions for just this one registry key and see if
it helps resolve your iTunes installation issue. To do that, you can
launch regedit.exe, then find this registry key, right-click on it and
choose Permissions. From there, you can add the SYSTEM account and
the Administrators group, and grant them Full Control permissions.

Hopefully this helps!

Friday, April 04, 2008 7:13 PM by staura
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Aaron

Thanks for the feed back, I have just tried and the key says

"ProxyStudClsid32 cannot be opened. An eror is preventing this key
from being opened. Details: Access is denied"

It then allows me access to the Permissions but I can't save any
chages or add any admistration groups. I think I will try your
SubInACL soloution and if it doesn't work, I will restore the factory
settings and start again! To be honest we are having so many problems
with Vista anyway; recyling files is now taking a good minute
regardless of size (Microsoft have been no help on this), Windows
media player won't work either despite installing all kinds of codecs
to resolve the issue (we are now running classic version as it is the
only one that will work), I think a complete system restart really
could only improve the situation.

Thanks for you help, its really appreciated

Monday, May 05, 2008 10:31 AM by bfrederi
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Aaron:

Thank you. Thank you. Thank you.

Sunday, May 18, 2008 8:57 AM by dbd7
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi,

I've been having problems with Office 2003 updates since I upgraded to
XP SP3. When I start MS Expression Web, Windows Installer would start
and try to reinstall Office 2003 and then it would fail due to a
registry key permission issue (which I tried to fix manually in the
registry, but it didn't help). Also, I couldn't install Office updates
I received from Windows Automatic Updates. I found reference to your
blog on the Windows XP Microsoft Discussion board. I followed your
directions above using the SublnACL tool and it worked! I no longer
get the Window Installer popping up all the time and I was able to
install the Office 2003 automatic updates. Thank you for posting these
instructions! I will amend my post to the discussion board where I
sought help for this issue, and state that I found the answer here on
your blog. Thanks again! Great job!

Wednesday, May 28, 2008 9:08 PM by ex19
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
ok, blackberry works now... but now all my sound is not working and
the network monitor and updates are disabled. Ummm, not like I knew
what I was doing running this but I was desperate last night. How now
to re-enable those other devices.

Thanks

Thursday, May 29, 2008 11:53 AM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Ex19 - I'm sorry for the hassles this is causing for you. I'm not
sure what to suggest to fix your sound and network monitor. What kind
of specific errors do you get for those things? It might help to try
to update drivers for your sound card to fix your sound issue.

Friday, May 30, 2008 12:56 AM by speedytina
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi;

Just discovered this great thread and am reading it with great
interest. I am having a terrible time getting Adobe Flash to install
with Windows XP Home. I,m just a Joe average PC user and have tried
everything I could find to solve the problem but nothing has worked.
My question is this. When you state that "you will need to have
adminstrator privileges for this to run correctly", what exactly do
you mean? Can I accomplish everything in you instruction by logging
into windows "Safe Mode"? If so, how? It's a whole other issue (admin
pw problem)but the only way I can log into Windows as an administrator
is while in Safe Mode.

Will I still be able to solve my flash installation problem using
SubInACL while logged-in in safe mode. I hope I'm making sense.

Thanks

speedytina

Friday, May 30, 2008 3:32 AM by ex19
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Thanks for answering. Well here's the deal. Audio Service is not
running, connection status unknown not enough storage is available to
complete this operation, windows installer service could not be
accessed, security center can not change your automatic updating
settings (tried manual, failed) Like EVERYTHING in the system is
pretty much flipping out.

I ran the blackberry no media after this subinacl and everything from
then on was all downhill. I have no idea what I'm doing but it seems
that lots of stuff in my computer has fried. Tried to reinstall the
drivers for audio, no help. Now I'm going to try running vista update
to hope it will go through and figure out what is wrong and fix it.
Prob. wishful thinking. I'm not sure but I have a feeling it's
acutally the blackberry software, but now I can't uninstall it. I'll
keep you up to date, but if you see some theme in here I'd really
appreciate a hand.:)

Friday, May 30, 2008 12:07 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Speedytina - Without knowing exactly what errors you're getting
while trying to get Adobe Flash to install, it is difficult to say
whether or not SubInAcl will be useful for you. SubInAcl generally
helps when the error is 5 or 0x5 or "access denied" during
installation.

Administrator privileges means that you need to log on to your
computer with an account that is a member of the Administrators group
because SubInAcl needs a certain set of privileges in order to be able
to change the file and registry permissions on the system.

You may also want to look on the Adobe web site to see if they have
any troubleshooting guides or FAQ lists for installation problems
related to the Flash player.

Friday, May 30, 2008 12:29 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Ex19 - I'm not sure how to explain these additional errors that
you're seeing. Since you mentioned that you're running Windows Vista,
you may be running into some of the complications that other folks who
have posted comments on this blog post have mentioned. Specifically,
I'd suggest looking at the comment at
http://blogs.msdn.com/astebner/archive/2006/09/04/solving-setup-errors-by-using-the-subinacl-tool-to-repair-file-and-registry-permissions.aspx#7394609
to see if these modified steps help at all.

Friday, May 30, 2008 3:26 PM by ex19
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Yes Aaron, the above comment absolutely solved my issue! It was scary,
I have to say, but in the end it completely restored all those things
that were not working under Vista. Thanks so much for your help.

Friday, May 30, 2008 5:33 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Ex19 - I'm glad to hear that this fixed things for you. I've gone
back and updated the list of commands to run in the main blog post and
in the cmd file linked in this blog so that others will hopefully not
run into this type of error in the future.

Tuesday, June 10, 2008 5:33 PM by grb1
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Dear Aaron,

I am trying to solve issues with updating windows SP3 and a many other
updates that I cannot get ever since May 14. (My case is similar to
GaryE) and I am a mere and humble pc home user.

I am getting additional error messages when i dowloand & install
subinacl.exe even if i tried to ignore and kept going - Internal error
2350.

Then I followed the thread of issues with subInAcl (739820) and now I
am getting - unexpected error 1605 () - at the cmd [prompt.

I am feeling desperate and I do not know what to do. Can anybody guide
me please?

Grb1

Tuesday, June 10, 2008 9:08 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Grb1 - I'm not sure I understand the exact problem you're currently
facing. Are you seeing errors while trying to install SubInAcl.msi,
or while trying to run the command lines listed in this blog post to
update permissions? Can you please list the exact steps you have
tried and the exact error messages that you received while doing so?

Friday, June 13, 2008 1:36 PM by Cathy C
# Permissions Issue (also posted on MS Vista Security newsgroup)
I've been using Vista Ultimate with all current updates for over a
year

without any installation issues, but for the past month I've been
having

problems with program updates not installing due to access being
denied.

Specifically: Error 1310. Error writing to file: c:\Config.Msi
\... .rfb.

Verify that you have access to that directory. Also encountered
similar

problems with QuickBooks and iTunes+QuickTime updates. I started
having

problems with searching in Outlook 2007 last week and tried a repair.
That's

when I narrowed down what was going on (or not). I've remedied that by

reindexing, but now get an error about Custom UI Runtime Error in MS
Access

Outlook Add-in for Data Collection and Publishing ... An error
occurred

while calling the callback: "Ribbon_GetDCVisible." I've consulted with
a

Dell tech and another Vista-savvy tech. I've tried logging on as

Administrator (which I am also), creating a new administrator profile,
Aaron

Stebner's SubInACL recommendation:

http://blogs.msdn.com/astebner/archive/2006/09/04/739820.aspx . After
this I

was able to install the QuickBooks update, but not iTunes, nor can I

accomplish a repair to MSO 2007 Pro. I've installed the latest
versions of

Windows Installer and .NET Framework. UAC is disabled. Does anyone
have any

suggestions for further action? And information on why this started

happening?

Thanks,

Cathy

Friday, June 13, 2008 7:52 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Cathy C - I'm not sure how to explain all of these errors. Do you
have any idea what specific changes were made to your system
immediately before these errors started happening? If you could
narrow it down to a specific Windows Update or something like that, it
could be really helpful.

Also, if you haven't already, I'd suggest trying to install Windows
Vista SP1 on this system to see if that resets any of the permissions
on your system and helps fix any of these errors.

Tuesday, June 17, 2008 11:43 PM by Aaron Stebner's WebLog
# Notes about a couple of possible issues while using the SubInAcl
tool
A while back, I posted some instructions for using a tool from the
Windows Resource Kit named SubInAcl

Friday, June 20, 2008 4:29 PM by bm55b
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
I think you have a type-o in the script missing a backslash after
%SystemDrive%.

Somehow my Windows XP Home Ed. got its permissions on "C:\Program
Files" corrupted and this script skipped over it. Running this
command got my file system perms fixed up...

subinacl /subdirectories c:\ /grant=administrators=f /grant=system=f

What a relief....

Friday, June 20, 2008 4:42 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Bm55b - Thanks for letting me know about this missing back-slash.
I'm going to update the main blog post text and the downloadable
script to address this.

Sunday, July 13, 2008 11:26 AM by sandman88
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
I had vista x64 and was trying to get SubInACL to work. For some
reason I was defaulting the install to C:\Program Files\Windows
Resource Kits. Anytime i tried to run subinACL it would give me an
error about not being recognized. I removed the program, reinstalled
and made sure to allow it to default to C:\Program Files (x86)\Windows
Resource Kits

Once complete I was then able to run SubInACL and fix my registry
issue quickly.

Not sure if this has been posted, but I saw people having issues with
Vista Ultimate X64 and would like to say that it does indeed work in
vista x64

Thanks for the help!

Saturday, July 19, 2008 4:46 AM by Datajack
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
I did this procedure and not I am having trouble with access
permissions, some things I can do before I can't anymore, getting
access permission errors (ex: saving a color management profile in the
windows/system director which worked before not gives me access
denied).

I tried what one of the posts suggested but can't figure out where to
type the command subinacl /subdirectories c:\ /grant=administrators=f /
grant=system=f)

Please, please can someone tell me how to fix this, or how to undo the
entire operation to post did? I don't want to continue years wondering
at every bug if it is caused by what this blog suggested...

I am really not hardcore tech, please can someone help?

Monday, July 21, 2008 11:58 AM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Datajack - There isn't a way to undo all of the changes made by
running SubInAcl. It sounds like you still do not have enough
permissions for all operations on your system, such as saving files to
the system32 folder. The command lines in the script I posted at
http://astebner.sts.winisp.net/Tools/reset.cmd.txt already contain a
command line to grant administrators and the system account full
control to the sub-directories under the Windows directory though, so
you should not need to run it again as long as you already ran all of
the steps listed above in this blog post. I'd suggest double-checking
that you ran all of the commands listed above and not just the
registry commands, and see if that helps. If not, you can manually
update permissions for folders by right-clicking on them in Windows
Explorer and choosing Properties, then going to the Security tab and
adding the permissions that you need.

Hopefully this helps.

Friday, July 25, 2008 7:41 PM by toby77jo
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi,

I was desperate as i got a access denied message when trying to update
my 2 windows 2003 x64 domain controllers to sp2 from r2. So I thought
the problems were related to permissions either in the registry or on
the filesystem. After running your reset.cmd, I only have blank
desktops, no taskbar, some services are not running, for example IIS,
i am lost, what can I do??

Friday, July 25, 2008 11:32 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Toby77jo - I'm sorry for the hassles that this issue is causing for
you. I haven't heard of the SubInAcl command lines listed above
causing this kind of trouble on the system, so I'm not sure how to
explain why this is happening. The commands listed above should only
be adding permissions to the registry and file system on your computer
- they shouldn't be removing anything that existed previously.

I'd suggest using a system restore point to roll back to a point
before you ran SubInAcl if possible, and then you can try to manually
update permissions to try to fix the access denied errors you are
encountering. For files/folders, you can update permissions by right-
clicking on them in Windows Explorer. For the registry, you can
update permissions by opening regedit and right-clicking on keys.

Saturday, July 26, 2008 6:50 AM by toby77jo
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi,

but windows 2003 does not have system restore by default, am i wrong?

I will try a full system restore from an image, hope it will work. All
this might not be the reset.cmd fault but also due to the failed sp2
installation...

Saturday, July 26, 2008 12:26 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Toby77jo - Yes, I think you will need to do a restore from an image
in this case. It is possible that the failed SP2 install caused these
issues, but I'm not sure. I'm not sure how the SubInAcl commands
would cause services that previously worked to stop working though.

Tuesday, July 29, 2008 9:40 AM by ZAB
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Did you even know what are you doing???

This command grant access to every folder for every user:

subinacl /subdirectories %SystemDrive%\ /grant=administrators=f /
grant=system=f /grant=users=e >> %temp%\subinacl_output.txt

How could you explain this???

Tuesday, July 29, 2008 11:26 AM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi ZAB - That command line grants read and execute permissions to all
users, not full control. When I look at the computers that I have in
my office, read and execute appears to be the default for the users
group for all folders on the system. If you don't want this
permission applied on your system, you can modify the command line to
remove the /grant=users=e switch.

Tuesday, July 29, 2008 11:36 AM by ZAB
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Of course not! You grant access to folder c:\documents and settings\
too, and every subfolders like "my documents" every profile settings
all stored passwords for outlook and so on... and it will be
transparent to everyone. If you dont know what are you doing at least
not recommend this to others.

Tuesday, July 29, 2008 11:49 AM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi ZAB - You're right - I missed the Documents and Settings (or Users
on Vista) sub-directories. The systems I have been looking at are
only single user systems, and are not shared by multiple users. I've
updated the command line above and in the linked script to refer to
the %ProgramFiles% folder and %windir% folder instead. Thanks for
letting me know about this.

Tuesday, July 29, 2008 1:41 PM by celtc
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi people, I have a little problem over here when trying to use
SubInACL to solve my problem. I've tried everything I've found on the
web but no matters what I do I just can't find out a solution. I get
this when I type reset.cmd on my command prompt:

D:\WINDOWS>reset.cmd

Determine whether we are on an 32 or 64 bit machine

Resetting ACLs...

(this may take several minutes to complete)

==========================================================================

Elapsed Time: 00 00:00:00

Done: 0, Modified 0, Failed 0, Syntax
errors 1

Last Syntax Error:WARNING : /grant=administrators=f : Error when
checking argume

nts - HKEY_CURRENT_USER

Elapsed Time: 00 00:00:00

Done: 0, Modified 0, Failed 0, Syntax
errors 1

Last Syntax Error:WARNING : /grant=administrators=f : Error when
checking argume

nts - HKEY_CURRENT_USER

Elapsed Time: 00 00:00:00

Done: 0, Modified 0, Failed 0, Syntax
errors 1

Last Syntax Error:WARNING : /grant=administrators=f : Error when
checking argume

nts - HKEY_LOCAL_MACHINE

Elapsed Time: 00 00:00:00

Done: 0, Modified 0, Failed 0, Syntax
errors 1

Last Syntax Error:WARNING : /grant=administrators=f : Error when
checking argume

nts - HKEY_LOCAL_MACHINE

Elapsed Time: 00 00:00:00

Done: 0, Modified 0, Failed 0, Syntax
errors 1

Last Syntax Error:WARNING : /grant=administrators=f : Error when
checking argume

nts - HKEY_CLASSES_ROOT

Elapsed Time: 00 00:00:00

Done: 0, Modified 0, Failed 0, Syntax
errors 1

Last Syntax Error:WARNING : /grant=administrators=f : Error when
checking argume

nts - HKEY_CLASSES_ROOT

System Drive...

Elapsed Time: 00 00:00:00

Done: 0, Modified 0, Failed 0, Syntax
errors 1

Last Syntax Error:WARNING : /grant=administrators=f : Error when
checking argume

nts - D:\Archivos

Windows Directory...

Elapsed Time: 00 00:00:00

Done: 0, Modified 0, Failed 0, Syntax
errors 1

Last Syntax Error:WARNING : /grant=administrators=f : Error when
checking argume

nts - D:\WINDOWS\

==========================================================================

FINISHED.

Press any key to exit . . .

By the way here is some extra information you may need to help, I'm
using XP SP2 as OS, and my windows installation is in the drive D:,...
the language of my OS is spanish - that is the reason for which I have
a bad quality of english, I am an argentinean :P-

I've already try lots of things such as running as administrator or
use a different reset.cmd.txt I've found on google. The problem
that I've by which I've to SubInACL is that when I try to install
Natural Color Pro I get an error saying:

Self-Registration Error

The following files din not self-register or unregister:

1. D:\WINDOWS\system32\Flash.ocx

Error al tener acceso al Registro OLE

So I can't isntall it because of that problem with accessing OLE
registry.

Any suggestions would be greatly appreciated.

Thx for reading all this ;D

Wednesday, July 30, 2008 5:42 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi CeltC - I haven't seen any errors like this before. SubInAcl seems
to think that the names of the registry keys are invalid in those
command lines or something like that. Can you run individual SubInAcl
command lines outside of reset.cmd and see if they work? Or could you
try running subinacl.exe /? or subinacl.htm (which is in the same
directory as subinacl.exe) and look at the syntax and try to create a
command line that works on this system?

Hopefully this helps.

Sunday, August 03, 2008 1:39 AM by celtc
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Thanks Aaron - I've followed your instructions. I run subinacl.exe /
help and /help syntax and it seems to be everything ok, however when I
individually run the command lines of reset.cmd I still get that
annoying "syntax error":

D:\Archivos de programa\Windows Resource Kits\Tools>subinacl /
subkeyreg HKEY_CUR

RENT_USER /grant=administrators=f /grant=system=f /grant=restricted=r /
grant=Ezc

urra\Usuario=f /setowner=administrators > %temp%\subinacl_output.txt

Elapsed Time: 00 00:00:00

Done: 0, Modified 0, Failed 0, Syntax
errors 1

Last Syntax Error:WARNING : /grant=administrators=f : Error when
checking argume

nts - HKEY_CURRENT_USER

I tried to find out what was wrong, and I realized then that some
command lines such as: (...)subinacl /keyreg HKEY_LOCAL_MACHINE\ /
display works perfectly. Even when I tried to run (...)subinacl /
file D:\TESTACCESS.TXT /grant=Ezcurra\Usuario=o for verifying if it
works everything just is perfect. So I took the previous command line
from the oringal reset.cmd and erased every action except for the one
that gives full control of the HKEY_CURRENT_USER regkeys and
subregkeys to the current user and I got this:

D:\Archivos de programa\Windows Resource Kits\Tools>subinacl /
subkeyreg HKEY_CUR

RENT_USER /grant=Ezcurra\Usuario=f > %temp%\subinacl_output.txt

Elapsed Time: 00 00:00:19

Done: 10391, Modified 10385, Failed 6, Syntax
errors 0

Last Done : HKEY_CURRENT_USER\Volatile Environment

Last Failed: HKEY_CURRENT_USER\Software\ALWIL Software\Avast
\4.0\ashSimpl\Settin

gs - RegSetKeySecurity Error : 5 Acceso denegado.

It seems that it worked fine but I do not know if this command in fact
is of some utility. At this point I think I can't do much more and I
don't want to do anything risky. So instead of doing something
harmful I would like to have an opinion of someone who really knows
about this.

Thx again for your aid and I apologised for any writing error that I
may have had since in fact I am still learning English.

Celtc

Sunday, August 03, 2008 9:48 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Celtc - I haven't seen this kind of error before, so I can't tell
for sure what is going on and I'm not sure what to suggest to resolve
it. It sounds like the SubInAcl tool is working on your system, but
that there is something wrong with the exact command lines being
used. I'd suggest trying different combinations of the command line
switches listed in this blog post in order to narrow down exactly what
part of the command line is causing these errors.

Tuesday, August 05, 2008 4:20 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi CeltC - One thing I forgot to mention here - if you are using a non-
English version of Windows and any of the user or group names are
translated on your system, then you will need to adjust these SubInAcl
command lines to use the translated names. This is described in more
detail in issue #1 in the blog post at http://blogs.msdn.com/astebner/archive/2008/06/17/8613982.aspx.

Wednesday, August 20, 2008 1:38 PM by DaddySam
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
In the file "reset.cmd" you are supposed to replace "username' with
your name.

Assuming your name is "John Doe", would you replace with:

John Doe

or

"John Doe"

With thanks

Wednesday, August 20, 2008 1:45 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi DaddySam - That is correct - there is a step listed above that says
"Change the values named YOURUSERNAME to be the Windows user account
that you are logged in with." However, it is easy to miss that, so
I'll add a comment to the copy of reset.cmd on my file server as well
to hopefully help people find that in the future.

Wednesday, August 20, 2008 4:21 PM by DaddySam
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Windows Update for SP3 gave me the following error message:

Service Pack 3 setup could not backup Registry Key HKLM\Software
\Microsoft\Windows\CurrentVersion\Uninstall\KB873339 to file C:\Windows
\$NtServicePackUninstall$\reg02315. 5: Access denied

Should I run the SubInACL tool or would there be a simpler solution to
that problem ?

This is the first time that I am encountering an installation problem

With thanks

Wednesday, August 20, 2008 4:46 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi DaddySam - The SubInAcl command lines listed above will update the
permissions for several locations on your file system and in your
registry. For this particular error, it lists an exact location that
it is having trouble accessing. It might be possible to just go in
and manually update the permissions for that specific folder location
and see if that solves this error. You can update permissions
manually by doing the following:

1. Opening Windows Explorer

2. Right-click on the folder and choose Properties

3. Click on the Security tab

4. Add the necessary permissions (typically, you need to make sure
that the SYSTEM account and the Administrators group both are listed
there and have Full Control permissions granted to them

Hopefully this helps.

Saturday, September 06, 2008 11:32 AM by fredjones
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Running the script at the top of this page on a Vista 32 machine I get
several 'Failed' and a 1.8Gb subinacl_output.txt file generated. Is
this normal? I have tried running in normal windows mode as well as
safe mode with similar results. Should I be able to get to a point
where there are no failures or should there always be a few?

Thanks for any help.

The summary output from running the script is:

Determine whether we are on an 32 or 64 bit machine

Resetting ACLs...

(this may take several minutes to complete)

IMPORTANT NOTE: For this script to run correctly, you must change

the values named bob to be the Windows user account that

you are logged in with.

==========================================================================

Elapsed Time: 00 00:00:23

Done: 19122, Modified 19122, Failed 0, Syntax
errors 0

Last Done : HKEY_CURRENT_USER\Volatile Environment\1

Elapsed Time: 00 00:00:00

Done: 1, Modified 1, Failed 0, Syntax
errors 0

Last Done : HKEY_CURRENT_USER

Elapsed Time: 00 00:10:31

Done: 377633, Modified 377618, Failed 15, Syntax
errors 0

Last Done : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
\a9hqrxfr\Param

eters\PnpInterface

Last Failed: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd
\Cfg : 5 A

ccess is denied.

Elapsed Time: 00 00:00:00

Done: 1, Modified 1, Failed 0, Syntax
errors 0

Last Done : HKEY_LOCAL_MACHINE

Elapsed Time: 00 00:08:49

Done: 128238, Modified 128226, Failed 12, Syntax
errors 0

Last Done : HKEY_CLASSES_ROOT\{FEDC2E25-975DFD53-6981D376}

Last Failed: HKEY_CLASSES_ROOT\CLSID\{FEE45DE2-A467-4bf9-
BF2D-1411304BCD84}\Inpr

ocServer32 : 2 The system cannot find the file specified.

Elapsed Time: 00 00:00:00

Done: 1, Modified 1, Failed 0, Syntax
errors 0

Last Done : HKEY_CLASSES_ROOT

System Drive...

Elapsed Time: 00 00:12:26

Done: 0, Modified 0, Failed 0, Syntax
errors 0

Windows Directory...

Elapsed Time: 00 00:04:20

Done: 92977, Modified 92972, Failed 5, Syntax
errors 0

Last Done : C:\Windows\winsxs
\x86_xrxscan.inf.resources_31bf3856ad364e35_6.0.60

00.16386_en-us_ed393488b2a7196c\xrxscan.inf_loc

Last Failed: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-
System.etl

- CreateFile Error : 5 Access is denied.

==========================================================================

FINISHED.

Monday, September 08, 2008 2:23 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi FredJones - In my past experience using SubInAcl, I found that
there are typically always some registry values held in use by the OS
that can cause errors/warnings when trying to update the permissions.
It is usually OK to ignore that type of error/warning unless it is
causing some specific error while trying to install or use a specific
application on your system.

Saturday, September 27, 2008 3:32 PM by tmc1961
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Thanks a lot for this routine.

I'm running XP, and tried to install DeLorme Topo USA 7.0. Tried
about ten other things before I found your blog. Ran the reset.cmd
from here and it worked like a champ.

http://astebner.sts.winisp.net/Tools/reset.cmd.txt

Again. Thanks a million!!!

Sunday, September 28, 2008 6:11 AM by oscarmat
# error instaling .net framework 3.0 SOLVED
I was not able to install .net framework 3.0 nor Visual Basic express
2008, and this post solved the problem. Thanks!.

This are some of the error messages. A little help for google :)

WIC Installer: [2] Error code 1603 for this component means "Fatal
error during installation.

...

ProductInstall.GlobalRegistryChanges.Install error: 0x5

...

Access is denied.

...

WIC installation did not complete.

Saturday, October 04, 2008 9:00 PM by MHalladay
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Is this an ignorant question? I'm installing SP1 on VISTA and it goes
into a loop on stage 3 - no matter if it's SAFE mode or not. The
solution is to do a restore. I've tried restore from WinRE, and the
original DVD and I get 0x80070005 - access denied. Since I don't have
a system - only WinRE (a basic DOS) system can SubInACL run in that
environment? I just want to do a restore and somehow get by the
'access denied' problem. Thanks ... Michael

Sunday, October 05, 2008 3:05 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi MHalladay - I don't know for sure if SubInAcl can be run from this
type of environment. For this type of Vista SP1 install error, I'd
suggest trying one of the free Vista SP1 support options listed at
http://support.microsoft.com/oas/default.aspx?ln=en-us&prid=11274.

Sunday, October 05, 2008 9:47 PM by MHalladay
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
I started with notes to Microsoft last Tuesday - took 72 hours for the
1st 24hr (advertised) response. The 2nd response was within the 24
hours. They asked me to do a CHKDSK /R (which anyone knows takes about
12 hours - needless to say a brush off) I told them I'd aready done
that it was clean) Took another 24 hours for them to ask me to do a
RESTORE. Since I'd already told them in my 1st note that I'd tried
that - it was another brush off. Anyway it's been about 6 days and so
far nothing in the last 36 hours. I suspect they'll either tell me to
re-install VISTA (Clean of course) or to do another CHKDSK. Needless
to say MS is a write-off which is why I'm looking everywhere else for
an answer.

You'd think my original question to them - I'm in a loop on stage 3
installing SP1 and restore gives me a 0x80070005 - access denied -
would be for them a simple look in their database for an answer and
tell me what it is. Instead it's the same old run around. Luckily only
one of my systems is VISTA, but it's an important system. I'm still
looking for answers.

Wednesday, October 22, 2008 4:41 PM by Rajan SP
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Dear Aaron,

I have a Lenovo laptop which has Vista O/s in it. It's a Pre-
Installed Version. Recently i noticed that i'm facing a strange
problem,

that i'm unable to delete/move files inside a folder in D Drive.

I have two folders in D Drive.

1. Program Files

2. Others

I'm able to create/delete/move/copy files or folders into "Others"
folder. Were as i don't have permission to

delete/move/add new file or folders to the "Program Files" folder in D
Drive.

I found your blog discussing about similar issue(s). I tried even
installing "SubInACL tool" but that hasn't helped me.

Is there any specific method/way to get rid of this problem. I'm
facing this for more than 2 months.

Thanks for any help.

Regards,

Rajan.SP

Wednesday, October 22, 2008 6:12 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Rajan SP - The SubInAcl command lines listed in this blog post only
change permissions on the system drive (the drive letter that you have
Windows installed to). If you don't have Windows installed to your D
drive, then those command lines will not help.

You can try one of the following to see if they help in this scenario:

1. Update the command lines listed above to cause SubInAcl to modify
permissions on your D drive instead of %programfiles% and %windir%

2. Manually change the permissions for the folder that you're having
trouble with by right-clicking on the folder and choosing Properties,
then Security, then clicking the Edit button and adding the users/
groups that you want to have permission to this folder

Wednesday, October 22, 2008 9:24 PM by Rajan SP
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Aaron,

Thanks for your reply.

But i'm unable to get rid of the problem.

I tried changing the Command line to "D:\Programfiles" but i am
getting the following error

SetKernelObjectSecurity Error for the folder.

When i tried to run the command for other folders

ie. "D:\Others", i am not getting this error.

Also i tried changing the security setting by right clicking, but that
doesn't helped me either.

Please help me solve this problem.

Regards,

Rajan.S.P

Wednesday, October 22, 2008 11:41 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Rajan SP - If you are getting an error message like the
SetKernelObjectSecurity error you describe, it likely means that the
command line you're passing to SubInAcl isn't exactly correct. When
you install the SubInAcl tool, it also installs a readme HTML file in
the same directory as the tool. I'd suggest reviewing the contents of
that readme to see the exact syntax you need to use for updating the
security permissions on this folder.

If you are unable to get SubInAcl to work and also are unable to get
the security permissions to change by using Windows Explorer, then I'm
not sure what else to suggest. You may want to post a question to one
of the Windows Vista newsgroups or contact your computer manufacturer
for more in-depth troubleshooting assistance.

I'm sorry I haven't been able to be more helpful in this scenario.

Monday, October 27, 2008 1:12 AM by balaji7u
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Aron,

I'm facing the same problem of update error 80070005 (I'm using vista
ultimate).

I've tried as per above instruction.

First downloaded the Subinacl, then installed in c:\Program Files
\Windows Resource Kits\Tools

then copied the commands as reset.cmd then i run this file as
adminiatrator.

An dos window prompted and started resetting the ACL. This has started
y'day evening 8pm still it's going on, nearly 45 million registries
have been modified and aroung 36 registries failed.

I want to know how long it'll take to complete the resetting and
regarding failed registries what i've to do.

Kinldly advice.

Thanks/Balaji

Monday, October 27, 2008 11:42 AM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Balaji7u - The time it takes to run the SubInAcl tool depends on
how many files, folders and registry values it needs to process (which
is specified by the command lines you pass in when you run it). If
you are getting that many errors, it doesn't sound like it is running
correctly though. I'd suggest trying to run it from an elevated cmd
prompt instead of right-clicking and trying to run it as administrator
that way. Step 2 in this blog post will allow you to launch an
elevated cmd prompt.

Also, if your issue is happening while installing OS updates on
Windows Vista, there are a couple of other things I'd suggest trying
before resorting to using SubInAcl:

1. Try to install Windows Vista SP1 if you haven't already. It
contains many fixes for the OS update installation engine on Vista,
but it may not install correctly either if you're already having
trouble installing OS updates.

2. Try the System Update Readiness Tool described at
http://support.microsoft.com/kb/947821.

Monday, October 27, 2008 1:34 PM by balaji7u
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Aron,

Thank you for your reply.

In continue to my above post, it took totally 17 hours to modify the
registries. finally it shown as

done:5536543, modified:5536500, failed: 42, syntx error: 0.

and a pop up window appeared saying as 'subinacl stopped working'

Pls advice what i've to do now.

I've installed vista SP1 one month back. after that i've changed my
anti virus from Norton to Mcafee. After this only the updates are not
getting installed.

Pls help to resolve this.

Thanks / Balaji

Monday, October 27, 2008 1:44 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Balaji7u - If SubInAcl crashed, it probably did not complete the
actions in the command lines that you ran. There are a couple of
things I'd suggest trying next:

1. Manually update the permissions for the files/registry that are
currently giving you the 0x80070005 error messages. Usually, there
will be log file entries or event log entries that specify exactly
what files/registry you are getting access denied from.

2. Try the Windows Vista SP1 support site for more in-depth
troubleshooting assistance. You can find contact information for this
at http://support.microsoft.com/oas/default.aspx?ln=en-us&prid=11274.

Tuesday, December 02, 2008 12:34 AM by andreboy
# Itunes won't install would this program work?
Hi,

I've bought a new laptop last year and haven't been able to download
itunes because I get the following error-

The installer has insufficient privileges to modify this file: C:
\programFiles\Itunes\Itunes.Resources\zh_TW.lproj\YahooLicense.rtf.

I was using the Itunes message boards for help and was directed to
your tool. I tried to run it but I got the following message-

subinacl' is not recognized as an internal or external command,
operable program or batch file

Would this tool help fix my problem? If so, could you help me use
your tool correctly?

Thanks

Tuesday, December 02, 2008 12:56 PM by lrios80
# Problems after running Subinacl
Hi Aaron,

Sorry if this is the wrong place for this, but it seemed related.

I was having problems getting a program running on 64 bit Vista due to
an issue that I've seen where the registry has no users listed as
having access to the registry. (The issue is described here:
http://www.brianpeek.com/blog/archive/2007/11/29/weird-vista-registry-issue.aspx)

I know someone else who had this same issue and was told by a
Microsoft rep to install subinacl to c:\Windows\sysWow64 and to save
the batch file to the same location. This was the content of the file:

@echo off

subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f

subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f

subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f

subinacl /subdirectories %SystemDrive% /grant=administrators=f

subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=system=f

subinacl /subkeyreg HKEY_CURRENT_USER /grant=system=f

subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=system=f

subinacl /subdirectories %SystemDrive% /grant=system=f

@Echo =========================

@Echo Finished.

@Echo =========================

@pause

When ran it, it started to work correctly, until I got an error
stating that "subinacl.exe has stopped working", then the command
prompt closed.

Now, after rebooting, the program will start up fine, but the system
audio, GoToMeeting, and Windows Mobile Device Center do not work.
Also, Windows Explorer does not see the workgroup machines. I checked
system restore, but it says that "System restore is not functioning
correctly on this system"

Sorry for the long post. I'd appreciate any help.

Tuesday, December 02, 2008 3:21 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Andreboy - SubInAcl might be able to help for this type of
installation error. To run SubInAcl, you first have to download and
install it, then you need to follow the exact steps listed in this
blog post. I've tried to make those steps as simple to follow as
possible, and I'm not sure how else to explain them.

Can you describe exactly what you tried when you ran it and got this
error? From the error, it sounds like either you didn't yet install
the tool, or it did not install to the expected location of c:\Program
Files\Windows Resource Kits\Tools.

Tuesday, December 02, 2008 3:37 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Lrios80 - If you're having the same issue as described at
http://www.brianpeek.com/blog/archive/2007/11/29/weird-vista-registry-issue.aspx,
then I'd suggest using the SubInAcl command lines listed in that blog
post instead of the set that you listed. If you had no users listed
for permissions in these registry keys, then the commands you list
will only grant the system account and Administrators group access to
those keys, but they will not grant your user account access. That
can end up causing a lot of problems getting software to run correctly
unless you run it as an administrator. The command lines in that
other blog post include steps to grant your user account permissions
as well.

Hopefully this will help in your scenario.

Saturday, December 13, 2008 2:32 PM by herolegendmyth
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
I tired using the SubInACl and all it did was restart my computer and
cause all my files have the share icon on them, did I do something
wrong? And how can get rid of all the share icon on all my folders?

Tuesday, December 16, 2008 6:49 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Herolegendmyth - I've never heard of SubInAcl causing your system
to reboot on its own. I'm also not sure what you mean by a share
icon. You may want to try to restore back to an earlier system
restore checkpoint to revert any changes that SubInAcl made to your
system.

Saturday, December 20, 2008 12:42 PM by CindyC
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi Aaron,

Not sure if a non-techie should give this fix a whirl, but I'm pretty
desperate. (Background - I'm working from the VISTA O/S - I am the
administrator, but my kids also have accounts). I followed your
instructions, (I had to download the zipped version). After creating
the reset command file, I get this when I type reset.cmd on my command
prompt:

C:\Windows\system32>reset.cmd

C:\Windows\system32>cd /d "C:\Program Files\Windows Resource Kits
\Tools"subinacl

/subkeyreg HKEY_CURRENT_USER /grant=administrators=f /grant=system=f /
grant=res

tricted=r /grant=Cindy=f /setowner=administrators /keyreg
HKEY_CURRENT_USER /gr

ant=administrators=f /grant=system=f /grant=restricted=r /
grant=Cindy=f /setowne

r=administrators /subkeyreg HKEY_LOCAL_MACHINE /
grant=administrators=f /grant=s

ystem=f /grant=users=r /grant=everyone=r /grant=restricted=r /
setowner=administr

ators /keyreg HKEY_LOCAL_MACHINE /grant=administrators=f /
grant=system=f /grant

=users=r /grant=everyone=r /grant=restricted=r /
setowner=administrators /subkey

reg HKEY_CLASSES_ROOT /grant=administrators=f /grant=system=f /
grant=users=r /se

towner=administrators /keyreg HKEY_CLASSES_ROOT /
grant=administrators=f /grant=

system=f /grant=users=r /setowner=administrators 1>>C:\Users\Cindy
\AppData\Loca

l\Temp\subinacl_output.txt

The filename or extension is too long.

C:\Windows\system32>subinacl /subdirectories C:\Program Files\ /
grant=administra

tors=f /grant=system=f /grant=users=e 1>>C:\Users\Cindy\AppData\Local
\Temp\subi

nacl_output.txt

'subinacl' is not recognized as an internal or external command,

operable program or batch file.

C:\Windows\system32>subinacl /subdirectories C:\Windows\ /
grant=administrators=f

/grant=system=f /grant=users=e 1>>C:\Users\Cindy\AppData\Local\Temp
\subinacl_o

utput.txt

'subinacl' is not recognized as an internal or external command,

operable program or batch file.

C:\Windows\system32>

I'ver read through this blog and didn't see anyone else post this kind
of problem (although it's a pretty long blog).

If you can offer any suggestions, I'd really appreciate it. I'm sorry
if I'm wasting your time with this...

Cindy

Saturday, December 20, 2008 8:20 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi CindyC - From the output that you listed, it looks like the
commands are all being listed on a single line instead of on separate
lines. That is causing the cmd prompt to run all of them at once,
which will give errors. Can you open your reset.cmd in notepad and
make sure that each command is on a separate line by pressing enter at
the end of each of them, then try running the reset.cmd script again?

Tuesday, December 30, 2008 12:08 AM by DFradeneck
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Just wanted to pop in and say thanks for the great fix. My parents
(and my resulting sanity at not hearing "Come over and fix our
computer!") thank you!

Saturday, February 28, 2009 9:00 PM by Susan052
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Thank you so much for this SubInACL fix. I have a MS Vista Home
Premium operating system and I was getting the 80070005 error and the
automatic updates just stopped. I downloaded the SubInACL and
followed the directions explicitly, retried updates and it worked
perfectly. It feels risky entering code without understanding, but
I'll just add that to the list of everything else I just have to
trust! I've bookmarked your blog and am going to pass it on to my
kids who will be thrilled that I didn't call them to solve my
problem. Thank you Aaron.

Monday, March 09, 2009 6:28 AM by AbZu
# reg key creation permissions unresolved by the SubInACL tool
OS XP Pro SP2

DotNet VersionCheck Utility confirms that no version of .NET Framework
is installed. Attempting to install any version of .NET including .NET
1.0 fails always for basically the same reason. Failure to access a
registry key in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup
\Installed\Components\. Logged in as Administrator, permissions have
been given full control as Admin and even as Everyone fo that specific
tree starting from HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft. Running the
Subinacl cmd as mentioned in this blog unfortunately fails to solve
the issue.

Attempting to install .NET 1.0 after have set Full Control returns the
following error:

Error 1402. Could not write value Locale to key \SOFTWARE\Microsoft
\Active Setup\Installed\Components\{78705f0d-
e8db-4b2d-8193-982bdda15ecd}.

Verfiy that you have sufficient access to that key

Attempting to install .NET 1.1 after have set Full Control returns the
following error:

Error 1406. Could not write value Locale to key \SOFTWARE\Microsoft
\Active Setup\Installed\Components\
{CB2F7EDD-9D1F-43C1-90FC-4F52EAE17A1}.

Verfiy that you have sufficient access to that key, or contact your
support personnel

The mentioned keys do not exsist and I assume are being created during
the installation process.

All installed security programs that have been closed or disabled
prior to installation of .NET.

ESET NOD32 Antivirus

Greatis RegRun

Comodo Firewall

Comodo BOClean

installed security programs active but not disabled:

Spybot

Spyware Blaster

Malwarebytes Anti-Malware

I don't know if attempting to install .NET 1.0 in Safe mode would
solve the problem, but would like to get some feedback on that process
before proceeding. Any other ideas would be most welcome. TIA

Monday, March 09, 2009 12:20 PM by astebner
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Hi AbZu - When Windows Installer creates registry values, it is
running with the permissions of the local system account. It is not
enough to just add the Administrators group to the permissions list
for this registry key to solve this 1402 or 1406 error. I would
suggest adding both the Administrators group and the local system
account, granting them full control, and making sure to allow these
permissions to be inherited by sub-keys to see if that will solve this
issue.

Some of the command lines for SubInAcl listed above in this blog post
will accomplish that for you if you'd prefer to use that tool instead
of trying to set these permissions manually.

Thursday, March 12, 2009 7:48 PM by mcooksb
# re: Solving setup errors by using the SubInACL tool to repair file
and registry permissions
Many thanks.

"How to download and run SubInACL" worked for me with an installation
error message.

The msconfig startup suggestion did not work.

Your mitzvah for the day.

M.