Windows 7 – Restoring ‘TrustedInstaller’ as Owner for Executable

command linepermissionswindows 7

After changing the ownership of executables in the Windows directory (explorer.exe, regedit.exe, etc.), I can't seem to change it back to TrustedInstaller using icacls.exe. Using the GUI method (Properties → Security → Advanced → Owner) works fine though.

Doing the same thing to any other file under Windows, that is not an executable, works fine. Tried the same under safe-mode, no luck.

These are the 2 basic commands I'm using:

takeown /F C:\Windows\explorer.exe /A
icacls C:\Windows\explorer.exe /setowner "NT SERVICE\TrustedInstaller"

Edit: Forgot to mention the error I'm receiving is 'Access denied'.

C:\Windows\System32>takeown /F c:\Windows\explorer.exe /A  
SUCCESS: The file (or folder): "c:\Windows\explorer.exe" now owned by the administrators group.

C:\Windows\System32>icacls c:\Windows\explorer.exe /setowner "NT SERVICE\TrustedInstaller"  
c:\Windows\explorer.exe: Access is denied.  
Successfully processed 0 files; Failed processing 1 files

Best Answer

So the title says restoring TrustedInstaller.

Seems there is a missing part; removing the added Administrators group permissions.

takeown /F "C:\Windows\regedit.exe" /A
/F - file to become owner of
/A - means it will set the users group (ie. Administrators, not userxyz)

icacls "C:\Windows\regedit.exe" /grant Administrators:F
/grant - will add permissions
:F - Full Control

icacls "C:\Windows\regedit.exe" /setowner "NT SERVICE\TrustedInstaller"
/setowner - new owner

icacls "C:\Windows\regedit.exe" /grant:r Administrators:RX
/grant:r - will set permissions (removing higher ones)
:RX - Read and Execute

Reference: https://ss64.com/nt/icacls.html

Related Solutions

Windows 10 – Understanding ‘Access Denied’ and Reverting Permissions with ICACLS and TAKEOWN

How to view permissions of Accessed Denied Folder in Windows 10

I guessed that system would be one user that would have access to this folder, so following after that thought I found a solution for running command prompt as system.

See - SO How do you run CMD.exe under the Local System Account?

Download PStools from SysInternals, Microsoft.

Run CMD as admin, navigate to folder of psexec.exe & psexec64.exe and run the following:

psexec -i -s cmd.exe

or if you want 64 bit...

psexec64 -i -s cmd.exe

Now a command prompt window has opened as system.

Now we can view the permissions of the folder...

icacls C:\ProgramData\Microsoft\Windows\SystemData

C:\ProgramData\Microsoft\Windows\SystemData 
                                            NT SERVICE\TrustedInstaller:(F)
                                            NT AUTHORITY\SYSTEM:(F)

Also an ACL can now be saved and resoted as described here

icacls C:\ProgramData\Microsoft\Windows\SystemData /save "C:\SystemData.acl" /t
icacls C:\ProgramData\Microsoft\Windows /restore "C:\SystemData.acl"

In standard admin Command Prompt, not system, have yet to workout how to restore ownership like this after using takeown. Currently using the above System Command Prompt or ACL solution permissions can be restored. However have discovered that one can just run a batch script through task scheduler as System, then one does not need to change permissions.

Reading:

Best Answer

Related Solutions

Windows 10 – Understanding ‘Access Denied’ and Reverting Permissions with ICACLS and TAKEOWN

Related Question