nasty oops

I was setting up other user accounts on my vista laptop to share with family
members. Because I am the administrator/owner, I set security rights for C:
Drive to actively deny [DENY] everyone in users group, but not for admin
group. However, it turns out that my account is ALSO a member of users, not
just admin. So now I can't access C: Drive either. I've tried restoring to
earlier settings, but it doesn't make a difference. I can't even access the
secpol.msc file on the hard drive to change settings. I've tried to activate
the built-in admin account to rectify this, but I can't even get the account
to activate. I need some good advice besides just reseting HD to original
factory settings.

Thanks,
~Jason

Jason;434988 Wrote:
> I was setting up other user accounts on my vista laptop to share with
> family
> members. Because I am the administrator/owner, I set security rights
> for C:
> Drive to actively deny [DENY] everyone in users group, but not for
> admin
> group. However, it turns out that my account is ALSO a member of users,
> not
> just admin. So now I can't access C: Drive either. I've tried restoring
> to
> earlier settings, but it doesn't make a difference. I can't even access
> the
> secpol.msc file on the hard drive to change settings. I've tried to
> activate
> the built-in admin account to rectify this, but I can't even get the
> account
> to activate. I need some good advice besides just reseting HD to
> original
> factory settings.
>
> Thanks,
> ~Jason

Hi Jason,

Have you tried booting into safe mode to see if you can make the
changes there?

http://www.vistax64.com/tutorials/88009-safe-mode.html

Shawn


--
brink

*There are no dumb questions, just the people that do not ask them.*
_http://www.Vistax64.com (\"http://www.Vistax64.com\")_
*Please post feedback to help others.*

Jason

Follow Shawn's advice to boot into Safe Mode. If there are no other
administrator accounts on the system, you will see the Built-in
administrator account (Named: Administrator) on the login screen. There
should not be a password assign3ed to this account.

Log on with this built-in account, go to Control Panel/User Accounts. Select
Manage another account, click the account you use and then select the Change
account type option. Select Administrator and click the Change account type
button.

Reboot and log in with the account you changed. You should now have your
admin privileges.

--

Ronnie Vernon
Microsoft MVP
Windows Shell/User


"Jason" <> wrote in message
news:36804588-53B2-4DEC-B8BC-...
>I was setting up other user accounts on my vista laptop to share with
>family
> members. Because I am the administrator/owner, I set security rights for
> C:
> Drive to actively deny [DENY] everyone in users group, but not for admin
> group. However, it turns out that my account is ALSO a member of users,
> not
> just admin. So now I can't access C: Drive either. I've tried restoring
> to
> earlier settings, but it doesn't make a difference. I can't even access
> the
> secpol.msc file on the hard drive to change settings. I've tried to
> activate
> the built-in admin account to rectify this, but I can't even get the
> account
> to activate. I need some good advice besides just reseting HD to original
> factory settings.
>
> Thanks,
> ~Jason
>

I've booted into safe mode, and while there (in command prompt) I used the
"net users administrator /access:yes" command to activate the admin account.
But when I logged into that account, it still had no higher priviledges. The
admin level priveleges are locked out of the C: drive because it is set to
DENY members of USERS Group. The problem with the admin account, and my
other admin account, I think, is that they are members of both the admin
group AND the users group. According to MS, if the permissions is set to
DENY a group, and access is attempted by an account who is a member of more
than one group, then the security feature favors the deny function if one of
the account's group membership is in a DENY category. The problem was that
when I set this, I didn't realize that my original ADMIN account (of the
Administrators group) was also a member of the Users group. As such, I can't
access CMD as admin, I can't access secpol.msc at all. I tried to TAKEOWN
command under safe mode as built-in administrator account, but the system
still said access denied. What I need is a utility that will allow me to
reset the C: drive permissions without working under vista's security
feature. I know this is next to impossible in NTFS, but there must be
something out there...

So, from one screwed IT Tech Support guy to another,

HELP PLEASE!!!

~Jason



"Ronnie Vernon MVP" wrote:

> Jason
>
> Follow Shawn's advice to boot into Safe Mode. If there are no other
> administrator accounts on the system, you will see the Built-in
> administrator account (Named: Administrator) on the login screen. There
> should not be a password assign3ed to this account.
>
> Log on with this built-in account, go to Control Panel/User Accounts. Select
> Manage another account, click the account you use and then select the Change
> account type option. Select Administrator and click the Change account type
> button.
>
> Reboot and log in with the account you changed. You should now have your
> admin privileges.
>
> --
>
> Ronnie Vernon
> Microsoft MVP
> Windows Shell/User
>
>
> "Jason" <> wrote in message
> news:36804588-53B2-4DEC-B8BC-...
> >I was setting up other user accounts on my vista laptop to share with
> >family
> > members. Because I am the administrator/owner, I set security rights for
> > C:
> > Drive to actively deny [DENY] everyone in users group, but not for admin
> > group. However, it turns out that my account is ALSO a member of users,
> > not
> > just admin. So now I can't access C: Drive either. I've tried restoring
> > to
> > earlier settings, but it doesn't make a difference. I can't even access
> > the
> > secpol.msc file on the hard drive to change settings. I've tried to
> > activate
> > the built-in admin account to rectify this, but I can't even get the
> > account
> > to activate. I need some good advice besides just reseting HD to original
> > factory settings.
> >
> > Thanks,
> > ~Jason
> >
>

Hello Jason,

Can you confirm exactly which of the following you set to 'Deny' for Users
via permissions?

Full control
Modify
Read & execute
List folder contents
Read
Write


--
Jane, not plain 64 bit enabled :-)
Batteries not included. Braincell on vacation ;-)
MVP - Windows Shell/User

"Jason" <> wrote in message
news:6836AC7C-66E3-4430-A1F2-...
> I've booted into safe mode, and while there (in command prompt) I used the
> "net users administrator /access:yes" command to activate the admin
> account.
> But when I logged into that account, it still had no higher priviledges.
> The
> admin level priveleges are locked out of the C: drive because it is set to
> DENY members of USERS Group. The problem with the admin account, and my
> other admin account, I think, is that they are members of both the admin
> group AND the users group. According to MS, if the permissions is set to
> DENY a group, and access is attempted by an account who is a member of
> more
> than one group, then the security feature favors the deny function if one
> of
> the account's group membership is in a DENY category. The problem was
> that
> when I set this, I didn't realize that my original ADMIN account (of the
> Administrators group) was also a member of the Users group. As such, I
> can't
> access CMD as admin, I can't access secpol.msc at all. I tried to TAKEOWN
> command under safe mode as built-in administrator account, but the system
> still said access denied. What I need is a utility that will allow me to
> reset the C: drive permissions without working under vista's security
> feature. I know this is next to impossible in NTFS, but there must be
> something out there...
>
> So, from one screwed IT Tech Support guy to another,
>
> HELP PLEASE!!!
>
> ~Jason
>
>

The full access, this automatically selected the others with it.



"Jane C" wrote:

> Hello Jason,
>
> Can you confirm exactly which of the following you set to 'Deny' for Users
> via permissions?
>
> Full control
> Modify
> Read & execute
> List folder contents
> Read
> Write
>
>
> --
> Jane, not plain 64 bit enabled :-)
> Batteries not included. Braincell on vacation ;-)
> MVP - Windows Shell/User
>
> "Jason" <> wrote in message
> news:6836AC7C-66E3-4430-A1F2-...
> > I've booted into safe mode, and while there (in command prompt) I used the
> > "net users administrator /access:yes" command to activate the admin
> > account.
> > But when I logged into that account, it still had no higher priviledges.
> > The
> > admin level priveleges are locked out of the C: drive because it is set to
> > DENY members of USERS Group. The problem with the admin account, and my
> > other admin account, I think, is that they are members of both the admin
> > group AND the users group. According to MS, if the permissions is set to
> > DENY a group, and access is attempted by an account who is a member of
> > more
> > than one group, then the security feature favors the deny function if one
> > of
> > the account's group membership is in a DENY category. The problem was
> > that
> > when I set this, I didn't realize that my original ADMIN account (of the
> > Administrators group) was also a member of the Users group. As such, I
> > can't
> > access CMD as admin, I can't access secpol.msc at all. I tried to TAKEOWN
> > command under safe mode as built-in administrator account, but the system
> > still said access denied. What I need is a utility that will allow me to
> > reset the C: drive permissions without working under vista's security
> > feature. I know this is next to impossible in NTFS, but there must be
> > something out there...
> >
> > So, from one screwed IT Tech Support guy to another,
> >
> > HELP PLEASE!!!
> >
> > ~Jason
> >
> >
>
>

Hi Jason, I am facing the same issue. Was your issue resolved. If so, could
you pl. help me out here..

Thanks
K

"Jason" wrote:

> The full access, this automatically selected the others with it.
>
>
>
> "Jane C" wrote:
>
> > Hello Jason,
> >
> > Can you confirm exactly which of the following you set to 'Deny' for Users
> > via permissions?
> >
> > Full control
> > Modify
> > Read & execute
> > List folder contents
> > Read
> > Write
> >
> >
> > --
> > Jane, not plain 64 bit enabled :-)
> > Batteries not included. Braincell on vacation ;-)
> > MVP - Windows Shell/User
> >
> > "Jason" <> wrote in message
> > news:6836AC7C-66E3-4430-A1F2-...
> > > I've booted into safe mode, and while there (in command prompt) I used the
> > > "net users administrator /access:yes" command to activate the admin
> > > account.
> > > But when I logged into that account, it still had no higher priviledges.
> > > The
> > > admin level priveleges are locked out of the C: drive because it is set to
> > > DENY members of USERS Group. The problem with the admin account, and my
> > > other admin account, I think, is that they are members of both the admin
> > > group AND the users group. According to MS, if the permissions is set to
> > > DENY a group, and access is attempted by an account who is a member of
> > > more
> > > than one group, then the security feature favors the deny function if one
> > > of
> > > the account's group membership is in a DENY category. The problem was
> > > that
> > > when I set this, I didn't realize that my original ADMIN account (of the
> > > Administrators group) was also a member of the Users group. As such, I
> > > can't
> > > access CMD as admin, I can't access secpol.msc at all. I tried to TAKEOWN
> > > command under safe mode as built-in administrator account, but the system
> > > still said access denied. What I need is a utility that will allow me to
> > > reset the C: drive permissions without working under vista's security
> > > feature. I know this is next to impossible in NTFS, but there must be
> > > something out there...
> > >
> > > So, from one screwed IT Tech Support guy to another,
> > >
> > > HELP PLEASE!!!
> > >
> > > ~Jason
> > >
> > >
> >
> >

Jason;435758 Wrote:
> I've booted into safe mode, and while there (in command prompt) I used
> the
> "net users administrator /access:yes" command to activate the admin
> account.
> But when I logged into that account, it still had no higher
> priviledges. The
> admin level priveleges are locked out of the C: drive because it is set
> to
> DENY members of USERS Group. The problem with the admin account, and my
> other admin account, I think, is that they are members of both the
> admin
> group AND the users group. According to MS, if the permissions is set
> to
> DENY a group, and access is attempted by an account who is a member of
> more
> than one group, then the security feature favors the deny function if
> one of
> the account's group membership is in a DENY category. The problem was
> that
> when I set this, I didn't realize that my original ADMIN account (of
> the
> Administrators group) was also a member of the Users group. As such, I
> can't
> access CMD as admin, I can't access secpol.msc at all. I tried to
> TAKEOWN
> command under safe mode as built-in administrator account, but the
> system
> still said access denied. What I need is a utility that will allow me
> to
> reset the C: drive permissions without working under vista's security
> feature. I know this is next to impossible in NTFS, but there must be
> something out there...
>
> So, from one screwed IT Tech Support guy to another,
>
> HELP PLEASE!!!
>
> ~Jason
>

Jason,

Are you still able to boot into "Safe Mode" and make changes? See this
link as a reference so we will be on the same page.

http://www.vistax64.com/tutorials/88009-safe-mode.html

Once in safe mode, if you are able to make these changes, go back to
the properties of your C:\ drive and click the Security tab.

Check and make sure that these are set to:

Group: ---------------- Allowed Permissions:
Authenticated Users --- Special Permissions
System --------------- Full Control
Administrators --------- Full Control
Users ----------------- Read & execute, List folder contents, Read

Hope this helps,
Shawn


--
brink

*There are no dumb questions, just the people that do not ask them.*
_http://www.Vistax64.com (\"http://www.Vistax64.com\")_
*Please post feedback to help others.*

Found this on one of vista forums.....It worked for me
Hope it helps !!!!

> Success! I can't believe it but I was able to take back full ownership of my
> C: drive and got all 37gb of my stuff back. I thank those that tried to help
> me and gave me clues to fix the problem. Below are the steps as to how I made
> It work for my retail version of Vista Ultimate.
>
>
> These steps might help some else with a similar UAC/ACL complete root
> "Access Denied" issues to the point where even if you are logged into your
> Admin account it still doesn't let you create accounts or modify any
> important settings/permissions etc.
>
>
> Step 1:
> Clicked: Start Menu
> Click: Run
> Type: net user administrator /active:yes
> Close All Other Applications And Reboot Your System.
>
> Step 2:
> Click/Login To The Administrator Account.
> Clicked: Start Menu
> Click: Run
> Type: Regedit
> Go to: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
> CurrentVersion\Policies\System
> Right Click On: EnableLUA
> Click: Modify
> Change: Value Data To A 0
> Click: OK
>
> Step 3:
> Go Back To The Root Folders In The Registry Editor.
> Right Click On: HKEY_CLASSES_ROOT
> Click: Permissions
> Click: CREATOR OWNER
> Check: All Allow Boxes
> Click: Apply
> Click: SYSTEM
> Check: All Allow Boxes
> Click: Apply
> Click: Administrators
> Check: All Allow Boxes
> Click: Apply
> Click On Users
> Click: Remove
> Click: Your Account Name If It Shows
> Click: Remove
> Click: OK
>
> Step 4:
> Right Click On: HKEY_CURRENT_USER
> Click: Permissions
> Click: SYSTEM
> Check: All Allow Boxes
> Click: Apply
> Click: Administrators
> Check: All Allow Boxes
> Click: Apply
> Click: OK
>
> Step 5:
> Right Click On: HKEY_LOCAL_MACHINE
> Click: Permissions
> Click: Everyone
> Check: All Allow Boxes
> Click: Apply
> Click: RESTRICTED
> Check: All Allow Boxes
> Click: Apply
> Click: SYSTEM
> Check: All Allow Boxes
> Click: Apply
> Click: Administrators
> Check: All Allow Boxes
> Click: Apply
> Click: OK
>
> Step 6:
> Right Click On: HKEY_USERS
> Click: Permissions
> Click: Everyone
> Check: All Allow Boxes
> Click: Apply
> Click: RESTRICTED
> Check: All Allow Boxes
> Click: Apply
> Click: SYSTEM
> Check: All Allow Boxes
> Click: Apply
> Click: Administrators
> Check: All Allow Boxes
> Click: Apply
> Click On Users If It Shows
> Click: Remove
> Click: Your Account Name If It Shows
> Click: Remove
> Click: OK
>
> Step 7:
> Right Click On: HKEY_CURRENT_CONFIG
> Click: Permissions
> Click: CREATOR OWNER
> Check: All Allow Boxes
> Click: Apply
> Click: Administrators
> Check: All Allow Boxes
> Click: Apply
> Click: OK
> Close Registry Editor And All Other Applications And Reboot Your System.
>
> Step 8:
> Click/Login To The Available Regular/Owner Account.
> Clicked: Start Menu
> Click: Control Panel
> Click: Add Or Remove User Acounts
> Create A New User Account And Logoff.
> Close Registry Editor And All Other Applications And Reboot Your System.
>
> Step 9:
> Click/Login To Your New Created Account.
> Right Click On The Drive Or Directory You Lost Access To.
> Click: Properties
> Click: Security
> Click: Advance
> At The Permissions Tab.
> Click: Edit
> Click: Add
> Type The Name Of The Recently New Created Account.
> Click: Check Names
> Your New Account Name Should Fully Show Up.
> Click: OK
> A Permission Screen Should Show Up.
> Click On The Allow Box Where It Says Full Control.
> Where It Says "Apply To:" Choose The "This Folder, Subfolders And Files"
> Option.
> Click: OK
> Again At The Permissions Tab Click On Your New Created Account.
> Click: Apply
> Click Yes On The Security Popup To Change Your Allow Permissions.
> If An Errors Occur Just Click Continue.
> Once The Process Finishes, Reboot Your System And Login To Your New Account.
> You Should Now Have Access Back Into Your Hard Drive Or Directory.
>
>
> Note: There Maybe Better/Shorter Ways Out There To Do This But In My
> Situation They Were Not Working. The Above Steps Are What Worked For Me But
> May Not Work For You. Please Make Sure You Are Having Similar Issues To Mine
> Before Trying The Above Steps...
>

"i had my admin account activated but my pc crashed. i had to install vista
again and tried to activate the admin account again. it doesnt work. i tried
everything possible but nothing. i nedd some serious help here. PLEASE!!!