I had inadvertently (thru quite a comedy of errors) revoked access by the Administrators group, all Administrator users, all other users with the exception of the Everyone group to the C: drive via the Security tab of the properties of the HDD. I had also revoked Full Control permissions from the Everyone group. This didn't remove any accounts from the system but it severely limited access by any user (including all Admin users, new or pre-existing since they now fall into the 'Everyone' group) to the C: drive (which was the only physical partition on the computer).
When applying a file permissions change such as this, Windows applies it to all subfolders. But subfolders or not, limited "admin" access to the C: drive is entirely unacceptable.
To restore the permissions to the C: drive I used the secedit tool as described above by Calvin on 4/6/2009. BTW, those instructions are summarized straight from the Microsoft Support pages (usage instructions for secedit). I used the command he specified for Vista which didn't solve my problem, directly, but worked with a little modification. My problem revised the security settings of the file system on the C: drive. Looking through the Microsoft template .inf file shipped with Vista, there are very few changes that are applied from the template to the file system permissions. In the end, the only reason I was able to restore the system was because Microsoft refuses to alter permissions in the system directories (including the directory where the secedit tool is stored). This allows the Administrator to run the tool truly as the administrator - regardless of what file permissions may have been set by the user in neighboring areas.
Since it didn't solve my problem (this was still the correct tool for the job), but probably fixes other, less serious problems, I had to copy the template .inf file mentioned in the command line (to the same directory with a slightly different filename), and add 2 entries in the [File Security] section (an entry in an INF section appears as a single line below the section header, prior to the next section header. sections are declared with square brackets [, ]). The added entries are as follows:
Code:
"\",0,"D:P(A;CIOI;GRGX;;;BU)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
"C:",0,"D:P(A;CIOI;GRGX;;;BU)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"
This applies the same security file permissions found on the \Windows directory to the entire hard drive (excluding protected system folders as mentioned above). This granted Full Control back to the Administrators group as well as other Administrative user accounts.
This solution worked quite well and gave a 'default' appearance of the hard drive permissions for Windows "out of the box". At the very least, it restored Administrative access back to C:. It appears that Vista deletes this modified template file (foreign item), as I've been unable to find it again.
Hope this is helpful.
Bookmarks