To all MVP's here

Please go to the thread that I initiated here on 11/1. (The one whose header
contains an obscenity.) Ignore the header and my original posting. Go to the
posting that I put up on 11/2. This describes how I fixed a problem that has
been the topic of a lot of conversation in this forum. I don't really
understand what it was that I did and would like someone to tell me. I think
the program I used somehow fixed a problem with permissions to modify
registry keys. As I describe in the posting, the program was recommended to
someone else by a Microsoft technician but is apparently not a Microsoft
program since I can't locate it on any official Microsoft site. It would seem
that it might be the solution to a lot of installation failures.

SubInACL (SubInACL.exe)
http://www.microsoft.com/downloads/d...displaylang=en

" SubInACL is a command-line tool that enables administrators to obtain
security information about files, registry keys, and services, and
transfer this information from user to user, from local or global group
to group, and from domain to domain. For example, if a user has moved
from one domain (DomainA) to another (DomainB), the administrator can
replace DomainA\User with DomainB\User in the security information for
the user's files. This gives the user access to the same files from the
new domain.

SubInACL enables administrators to do the following:

* Display security information associated with files, registry
keys, or services. This information includes owner, group, permission
access control list (ACL), discretionary ACL (DACL), and system ACL (SACL).
* Change the owner of an object.
* Replace the security information for one identifier (account,
group, well-known security identifier (SID)) with that of another
identifier.
* Migrate security information about objects. This is useful if you
have reorganized a network's domains and need to migrate the security
information for files from one domain to another. "

And - http://blogs.msdn.com/astebner/archi...04/739820.aspx

" When is SubInACL useful

I have found that the SubInACL tool is most useful when a setup package
fails with error code 5 or 0x5 or 0x80070005. All of these error codes
mean Access Denied, and this type of error code is often caused by
missing ACLs for the Administrators group or the built-in System
account. The Windows Installer service runs with System account
permissions in most cases. If the System account does not have
sufficient permissions to access the file system or parts of the
registry, an MSI-based setup package will fail with an Access Denied error.

Example of a setup failure that was fixed by SubInACL

A customer contacted me with a problem installing Visual Studio 2005. I
looked at the main Visual Studio log file located at
%temp%\dd_vsinstall80.txt, and I found that Windows Installer 3.1 setup
was failing. Then, I looked at the Windows Installer 3.1 setup log file
located at %windir%\KB893803v2.log. It showed the following error:

30.844: DoRegistryUpdates:UpdSpInstallFromInfSection Failed for
MSI.Reg.Install: 0x5
30.844: DoInstallationoRegistryUpdates failed
30.875: Access is denied.

I had the customer run the above steps to use the SubInACL tool to
update the file and registry ACLs on their system, and then they were
able to install Windows Installer 3.1 and Visual Studio 2005 with no
further problems. "


MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============




Colvalava wrote:

> Please go to the thread that I initiated here on 11/1. (The one whose header
> contains an obscenity.) Ignore the header and my original posting. Go to the
> posting that I put up on 11/2. This describes how I fixed a problem that has
> been the topic of a lot of conversation in this forum. I don't really
> understand what it was that I did and would like someone to tell me. I think
> the program I used somehow fixed a problem with permissions to modify
> registry keys. As I describe in the posting, the program was recommended to
> someone else by a Microsoft technician but is apparently not a Microsoft
> program since I can't locate it on any official Microsoft site. It would seem
> that it might be the solution to a lot of installation failures.

The Microsoft site where the subinacl.exe file can be obtained indicates that
it applies to XP Professional but not XP Home Edition. My computer has the
latter.

The program that I used appears perhaps to have been been written to
automate the process described in the blog that you referenced. (?)

Thanks for your reply.

> As I describe in the posting, the program was recommended to
> someone else by a Microsoft technician but is apparently not a Microsoft
> program since I can't locate it on any official Microsoft site.

It *is* an MS app and is publicly available, contrary to what you
posted. And although it states XP Pro, it will work on XP HE.
What you downloaded includes the reset.cmd registry Permissions that
are not present with SubInACL.exe, but must be entered when running it.
Clear ?


MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============


Colvalava wrote:

> The Microsoft site where the subinacl.exe file can be obtained indicates that
> it applies to XP Professional but not XP Home Edition. My computer has the
> latter.
>
> The program that I used appears perhaps to have been been written to
> automate the process described in the blog that you referenced. (?)
>
> Thanks for your reply.

"MowGreen [MVP]" wrote:

> > As I describe in the posting, the program was recommended to
> > someone else by a Microsoft technician but is apparently not a Microsoft
> > program since I can't locate it on any official Microsoft site.
>
> It *is* an MS app and is publicly available, contrary to what you
> posted. And although it states XP Pro, it will work on XP HE.
> What you downloaded includes the reset.cmd registry Permissions that
> are not present with SubInACL.exe, but must be entered when running it.
> Clear ?
>
I think I understand things as well as I have any desire to, particularly
since my own problem is now fixed. It was the reset_subinacl.zip file that I
was referring to as not being a MS app. I now realize that the two files that
are extracted from it are the subinacl.exe file (which is clearly a MS app)
and a script written by someone else that contains whatever is necessary to
correct the registry permission information that somehow became corrupted on
my computer.

As I indicated before, this (or something like it) would seem to be the
simple solution that I was crying out for when my frustration got the best of
me and led me to post the offending message (and for which I apologize
again). I just wonder why something like this can't be made easier to find.

> I just wonder why something like this can't be made easier to find.

Good question. Perhaps you should submit this feedback to MS ?
Go here - http://support.microsoft.com/contactus/?WS=communities
Under " Product Help and Support " click the Send questions link
For " Select a Microsoft product " select Other
For " If your product was not found, enter your product name here: ",
enter Windows Updates.
Provide details of what you experienced and ask why it was so hard to
find info to resolve the issue.

Even a better question " Why are so many Users having Permissions issues
when attempting to install Critical updates ? "
That's the question I'd like answered


MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============


Colvalava wrote:

>
> "MowGreen [MVP]" wrote:
>
>
>>>As I describe in the posting, the program was recommended to
>>>someone else by a Microsoft technician but is apparently not a Microsoft
>>>program since I can't locate it on any official Microsoft site.
>>
>>It *is* an MS app and is publicly available, contrary to what you
>>posted. And although it states XP Pro, it will work on XP HE.
>>What you downloaded includes the reset.cmd registry Permissions that
>>are not present with SubInACL.exe, but must be entered when running it.
>>Clear ?
>>
>
> I think I understand things as well as I have any desire to, particularly
> since my own problem is now fixed. It was the reset_subinacl.zip file that I
> was referring to as not being a MS app. I now realize that the two files that
> are extracted from it are the subinacl.exe file (which is clearly a MS app)
> and a script written by someone else that contains whatever is necessary to
> correct the registry permission information that somehow became corrupted on
> my computer.
>
> As I indicated before, this (or something like it) would seem to be the
> simple solution that I was crying out for when my frustration got the best of
> me and led me to post the offending message (and for which I apologize
> again). I just wonder why something like this can't be made easier to find.

I just sent a note to Microsoft asking both my question and yours.

"MowGreen [MVP]" wrote:

> > I just wonder why something like this can't be made easier to find.
>
> Good question. Perhaps you should submit this feedback to MS ?
> Go here - http://support.microsoft.com/contactus/?WS=communities
> Under " Product Help and Support " click the Send questions link
> For " Select a Microsoft product " select Other
> For " If your product was not found, enter your product name here: ",
> enter Windows Updates.
> Provide details of what you experienced and ask why it was so hard to
> find info to resolve the issue.
>
> Even a better question " Why are so many Users having Permissions issues
> when attempting to install Critical updates ? "
> That's the question I'd like answered