Accidentally took ownership of Application Data folder

[AndyTampa]

Help. I had added Take Ownership to my context menu. I was trying to look at the C:\Documents and Settings\All Users\Application Data folder but couldn't get into it. I was looking through my context menu when I accidentally clicked Take Ownership. Now when I look at its properties, it looks a whole lot different than it did before. It had 4 groups in there, but now only has me. The four groups had special permissions, but now they are all gone. Does anyone know how to set them back to what they should be?

 

[tom982]

Hello AndyTampa and welcome to the forums

Could you run this command in Command Prompt please and copy the output into your next post?

ICACLS %USERPROFILE%\AppData

Tom

 

[AndyTampa]

Thanks for responding so quickly Tom. The folder I took owner ship of was "Application Data". Do you still want me to run it for "AppData"? Also it wasn't my profile, but the All Users profile.

C:\Windows\system32>ICACLS %userprofile%\AppData
C:\Users\Andy\AppData NT SERVICE\WMPNetworkSvc: (I)(R)
NT SERVICE\WMPNetworkSvc: (I)(OI)(CI)(IO)(GR)
AndysMain\Andy: (I)(OI)(CI)(F)
NT AUTHORITY\SYSTEM: (I)(OI)(CI)(F)
BUILTIN\Administrators: (I)(OI)(CI)(F)

Successfully processed 1 files; Failed processing 0 files

 

[tom982]

Hi Andy,

Sorry, my mistake, I misread your post.

Let's try again:

ICACLS "C:\Users\All Users\Application Data"

Tom

 

[AndyTampa]

Alright. Here is what you requested.

C:\>icacls "C:\Users\All Users\Application Data"
C:\Users\All Users\Application Data AndysMain\Andy:(OI)(IO)(F)
                                    AndysMain\Andy:(CI)(F)

Successfully processed 1 files; Failed processing 0 files

 

[tom982]

Hi Andy,

Okay, a few things have been deleted from the ACL. It would be easiest if we copy the ACL from another folder and apply it to the Application Data folder.

The following must be done from the same instance of command prompt, if you close the window please start again from the beginning. Can you run this command please:

icacls C:\Users\All Users\Desktop /save desktopACL & notepad desktopACL

This should open a notepad window with something like this in it:

Desktop
D:PAI(D;;CC;;;WD)(A;;0x1200a9;;;WD)(A;;FA;;;SY)(A;;FA;;;BA)

Change the Desktop at the top of the file to Application Data, so the above example would now be:

Application Data
D:PAI(D;;CC;;;WD)(A;;0x1200a9;;;WD)(A;;FA;;;SY)(A;;FA;;;BA)

Then save this file, under the same name, just Ctrl+S.

Then run this command please:

icacls "C:\Users\All Users\Application Data" /restore desktopACL

Then this one:

icacls "C:\Users\All Users\Application Data"

And copy the last output into your next post please.

Tom

 

[AndyTampa]

Before I try this, you should know that my Desktop properties look the same as the current Application Data properties:

C:\Windows\system32>icacls "c:\users\all users\desktop"
c:\users\all users\desktop AndysMain\Andy:(OI)(IO)(F)
                           AndysMain\Andy:(CI)(F)

Successfully processed 1 files; Failed processing 0 files

For clarity, I'm going to step this out and await your approval. I have a question about step 3.

1) Open Elevated Command Prompt
2) ICACLS "C:\Users\All Users\Desktop" /save DesktopACL & notepad DesktopACL
3) This should open a notepad window with something like this in it:

Application Data
D:PAI(D;;CC;;;WD)(A;;0x1200a9;;;WD)(A;;FA;;;SY)(A;;FA;;;BA)

4) Then save this file, under the same name, just Ctrl+S. Do I need to know where this is being saved?

5) ICACLS "C:\Users\All Users\Application Data" /restore DesktopACL
6) ICACLS "C:\Users\All Users\Application Data"
7) Copy the last output into your next post please.

If I'm not mistaken, you are attempting to copy the properties of Desktop as a replacement of the properties of Application Data.

Considering the two are already the same, shall we reconsider?
Did I really muck it up?
Is this something a restore point would fix? I have one from 2:11am today.

 

[tom982]

Hi Andy,

I want to explain a few things before I answer your questions.

The folder that you're trying to access, C:\Documents and Settings\All Users\Application Data isn't actually a folder, it's what's known as a junction point. It's just a compatibility feature of Windows Vista and Windows 7 as it redirect calls to this folder to another location.

There is a junction point for C:\Documents and Settings goes to C:\Users, so the folder you're trying to access is actually:

C:\Users\All Users\Application Data

Well, it would be if this was a folder - there's one more junction point in there.

C:\Users\All Users\Application Data is a junction point redirecting files to C:\ProgramData <-- This is the folder that you have changed the ACL for. You can't double click on junction points to see where they go, instead you have to use a program to view them, of which I would recommend NTFSLinksView (by NirSoft).

So you have effectively taken permission of C:\ProgramData.

==================================================
Name              : Application Data
Full Path         : C:\Users\All Users\Application Data
Type              : Junction
Target Path       : C:\ProgramData
==================================================

==================================================
Name              : Desktop
Full Path         : C:\Users\All Users\Desktop
Type              : Junction
Target Path       : C:\Users\Public\Desktop
==================================================

It's strange that the Desktop folder has the same permissions as Application Data. They're the same on my system, but I haven't changed either of them.

You don't need to specify a location to save the ACL export because it will just save it in the folder that command prompt has been run in. If it displays C:\ with a blinking underscore, it will be saved there. That's why this all had to be done from the same window, so it could grab the export without me having to specify a location.

Considering they're the same, you can ignore my instructions then as it wouldn't do a thing.

Yeah, I was trying to replace the ACL of Application Data with that of Desktop.

You haven't mucked anything up!

If the restore point was made before the command was run, then yes, it should fix this. Give it a shot, and let me know how it goes

Tom

 

[AndyTampa]

Windows will not let me use a restore point because it detected file system corruption. I've been having a problem with CHKDSK consistently deleting orphaned index files and then recovering the same files. NoelDP has been helping me with that in this thread: http://www.vistax64.com/general-discussion/298630-chkdsk-damages-partition-table.html. The dirty bit is set and chkdsk will not reset it no matter how many times chkdsk is run. The MFT appears to be damaged. Is there another way to fix the folder ownership so I can move back on to the other problems I'm having?

 

[AndyTampa]

Tom, it's been 6 days. Do you have any ideas on how to reset the permissions?

Do you know what the permissions are and how to set them?

Have you abandoned me?

 

[NoelDP]

Tom's off Skiing this week (let's hope he doesn't break something!)
I think I'd better leave this to him - I don't want to adjust things only to find out that he wanted to do something else.

 

[tom982]

Tom, it's been 6 days. Do you have any ideas on how to reset the permissions?

Do you know what the permissions are and how to set them?

Have you abandoned me?

Hi Andy,

Nope, don't worry, I'm still here. As Noel kindly pointed out, I was on holiday for the week I know what the permissions are, but I would've preferred not to do it manually, but I'm out of options now.

Right-click > Properties > Security > Edit > Add > Type "CREATOR OWNER" (without the quotes) > Check Names (it should underline the name you typed) > OK

In the box titled Permissions for CREATOR OWNER, tick the Full Control box under Allow then Apply.

Repeat for SYSTEM and Administrators.

Right-click > Properties > Security > Edit > Add > Type "USERS" (without the quotes) > Check Names (it should underline the name you typed) > OK

In the box titled Permissions for CREATOR OWNER, tick the Read and Execute, List folder contents and Read boxes under Allow then Apply.

Tom's off Skiing this week (let's hope he doesn't break something!)
I think I'd better leave this to him - I don't want to adjust things only to find out that he wanted to do something else.

I've sprained both wrists, hurt my back, neck and both knees but it was well worth it It hurts to type, but oh well.

Tom

 

[AndyTampa]

Thanks for coming back in mostly one piece. Based on what you had said about the C:\Documents and Settings\All Users\Application Data being a junction point for C:\Users\All Users\Application Data and that actually being a junction point for C:\ProgramData, I started following your suggestion on C:\ProgramData, but those security settings already have CREATOR OWNER, SYSTEM, Users (AndysMain\Users), and Administrators (AndysMain\Administrators).

In the hope of understanding this, I went back and re-read the thread. I’m still a little lost on the junction point concept, although I do see that the “Application Data” folders have a shortcut icon instead of the normal folder icon.

I found that clicking on Application Data in the ProgramData folder shows an exact duplicate of the ProgramData folder including another Application Data folder. Clicking on that does the same. I can continue creating duplicates ad infinitum.

There was something I remembered that was not in the thread when I re-read it. When I clicked the Take Ownership menu item on the folder, it ran for quite a while taking ownership of all the folders underneath it. I believe I now own all the sub-folders as well. Does your set of instructions fix all the sub-folders or just the one folder?

I’m not sure if you want me to follow your latest instructions in the ProgramData folder or on one of the junction points. What I’ve done to help us both along was to run ICACLS on every instance of Application Data and posted the results here. Maybe one of the others can be used to copy to the right folder.

For brevity I combined the “Documents and Settings” and “Users” groups because they were identical. For each group I’ve noted what happens when I click on the folder in Windows Explorer. Either I’ll get a folder list or “Access Denied”.

[FONT=Fixedsys][SIZE=2]C:\Users\Administrator.AndysMain\Application Data &
[SIZE=2]C[/SIZE]:\Documents and Settings\Administrator.AndysMain\Application Data 

Everyone:(DENY)(S,RD)
AndysMain\Administrator:(I)(F)
AndysMain\Administrator:(I)(OI)(CI)(IO)(F)
AUTHORITY\SYSTEM:(I)(F)
AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
BUILTIN\Administrators:(I)(F)
BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files
  [COLOR=Red]ACCESS DENIED[/COLOR]
  [SIZE=2]
C[/SIZE]:\Users\All Users\Application Data &
[SIZE=2]C[/SIZE]:\Documents and Settings\All Users\Application Data 

AndysMain\Andy:(OI)(IO)(F)
AndysMain\Andy:(CI)(F)

Successfully processed 1 files; Failed processing 0 files
  [COLOR=Red]FOLDER LIST[/COLOR]
  
C:\Users\Andy\Application Data &
C:\Documents and Settings\Andy\Application Data 

Everyone:(S,RD)
NT SERVICE\WMPNetworkSvc:(I)(R)
NT SERVICE\WMPNetworkSvc:(I)(OI)(CI)(IO)(GR)
AndysMain\Andy:(I)(OI)(CI)(F)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
BUILTIN\Administrators:(I)(OI)(CI)(F)

Successfully processed 1 files; Failed processing 0 files
  [COLOR=Red]FOLDER LIST[/COLOR]
  
C:\Users\Default\Application Data &
[SIZE=2]C[/SIZE]:\Documents and Settings\Default\Application Data 

Everyone:(DENY)(S,RD)
NT SERVICE\WMPNetworkSvc:(I)(R)
NT SERVICE\WMPNetworkSvc:(I)(OI)(CI)(IO)(GR)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
BUILTIN\Administrators:(I)(OI)(CI)(F)
BUILTIN\Users:(I)(RX)
BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
Everyone:(I)(RX)
Everyone:(I)(OI)(CI)(IO)(GR,GE)

Successfully processed 1 files; Failed processing 0 files
  [COLOR=Red]ACCESS DENIED[/COLOR]
  
C:\Users\Default User\Application Data &
C:\Documents and Settings\Default User\Application Data 

Everyone:(DENY)(S,RD)
NT SERVICE\WMPNetworkSvc:(I)(R)
NT SERVICE\WMPNetworkSvc:(I)(OI)(CI)(IO)(GR)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
BUILTIN\Administrators:(I)(OI)(CI)(F)
BUILTIN\Users:(I)(RX)
BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
Everyone:(I)(RX)
Everyone:(I)(OI)(CI)(IO)(GR,GE)

Successfully processed 1 files; Failed processing 0 files
  [COLOR=Red]ACCESS DENIED[/COLOR]
  
C:\Users\Guest\Application Data &
C:\Documents and Settings\Guest\Application Data 

Everyone:(DENY)(S,RD)
AndysMain\Guest:(I)(F)
AndysMain\Guest:(I)(OI)(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(I)(F)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
BUILTIN\Administrators:(I)(F)
BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files
  [COLOR=Red]ACCESS DENIED[/COLOR]
  

[COLOR=Red]This doesn't appear to match any of the other folders:[/COLOR] 
C:\ProgramData 

NT AUTHORITY\SYSTEM:(OI)(CI)(F)
BUILTIN\Administrators:(OI)(CI)(F)
CREATOR OWNER:(OI)(CI)(IO)(F)
BUILTIN\Users:(OI)(CI)(RX)
BUILTIN\Users:(CI)(WD,AD,WEA,WA)

Successfully processed 1 files; Failed processing 0 files
  [COLOR=Red]FOLDER LIST[/COLOR]
  
C:\ProgramData\Application Data 

AndysMain\Andy:(OI)(IO)(F)
AndysMain\Andy:(CI)(F)

Successfully processed 1 files; Failed processing 0 files
  [COLOR=Red]FOLDER LIST[/COLOR][/SIZE][/FONT]

You said previously that I didn't muck anything up. Are you implying that even after changing the permissions on the system files, Windows will continue to function normally? Should we even risk changing permissions on so many files?

 

[wither 3]

"I've sprained both wrists, hurt my back, neck and both knees but it was well worth it It hurts to type, but oh well."

I'm wondering what it takes to make him quit. :D

Sorry for interrupting this thread.

 

[tom982]

"I've sprained both wrists, hurt my back, neck and both knees but it was well worth it It hurts to type, but oh well."

I'm wondering what it takes to make him quit. :D

Sorry for interrupting this thread.

It's Christmas tomorrow, so I've just got to persevere through the pain. No need to apologise!

Thanks for coming back in mostly one piece. Based on what you had said about the C:\Documents and Settings\All Users\Application Data being a junction point for C:\Users\All Users\Application Data and that actually being a junction point for C:\ProgramData, I started following your suggestion on C:\ProgramData, but those security settings already have CREATOR OWNER, SYSTEM, Users (AndysMain\Users), and Administrators (AndysMain\Administrators).

In the hope of understanding this, I went back and re-read the thread. I’m still a little lost on the junction point concept, although I do see that the “Application Data” folders have a shortcut icon instead of the normal folder icon.

A junction point just redirects file calls to another location. They exist for compatibility reasons, where software supporting the XP user folder structure (C:\Documents and Settings\UserName\My Documents etc.) can be run on Windows 7 (C:\Users\UserName\Documents). As you correctly noticed, the junctions have a shortcut icon on them

I found that clicking on Application Data in the ProgramData folder shows an exact duplicate of the ProgramData folder including another Application Data folder. Clicking on that does the same. I can continue creating duplicates ad infinitum.

There was something I remembered that was not in the thread when I re-read it. When I clicked the Take Ownership menu item on the folder, it ran for quite a while taking ownership of all the folders underneath it. I believe I now own all the sub-folders as well. Does your set of instructions fix all the sub-folders or just the one folder?

I’m not sure if you want me to follow your latest instructions in the ProgramData folder or on one of the junction points. What I’ve done to help us both along was to run ICACLS on every instance of Application Data and posted the results here. Maybe one of the others can be used to copy to the right folder.

For brevity I combined the “Documents and Settings” and “Users” groups because they were identical. For each group I’ve noted what happens when I click on the folder in Windows Explorer. Either I’ll get a folder list or “Access Denied”.

[FONT=Fixedsys][SIZE=2]C:\Users\Administrator.AndysMain\Application Data &
[SIZE=2]C[/SIZE]:\Documents and Settings\Administrator.AndysMain\Application Data 

Everyone:(DENY)(S,RD)
AndysMain\Administrator:(I)(F)
AndysMain\Administrator:(I)(OI)(CI)(IO)(F)
AUTHORITY\SYSTEM:(I)(F)
AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
BUILTIN\Administrators:(I)(F)
BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files
  [COLOR=Red]ACCESS DENIED[/COLOR]
  [SIZE=2]
C[/SIZE]:\Users\All Users\Application Data &
[SIZE=2]C[/SIZE]:\Documents and Settings\All Users\Application Data 

AndysMain\Andy:(OI)(IO)(F)
AndysMain\Andy:(CI)(F)

Successfully processed 1 files; Failed processing 0 files
  [COLOR=Red]FOLDER LIST[/COLOR]
  
C:\Users\Andy\Application Data &
C:\Documents and Settings\Andy\Application Data 

Everyone:(S,RD)
NT SERVICE\WMPNetworkSvc:(I)(R)
NT SERVICE\WMPNetworkSvc:(I)(OI)(CI)(IO)(GR)
AndysMain\Andy:(I)(OI)(CI)(F)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
BUILTIN\Administrators:(I)(OI)(CI)(F)

Successfully processed 1 files; Failed processing 0 files
  [COLOR=Red]FOLDER LIST[/COLOR]
  
C:\Users\Default\Application Data &
[SIZE=2]C[/SIZE]:\Documents and Settings\Default\Application Data 

Everyone:(DENY)(S,RD)
NT SERVICE\WMPNetworkSvc:(I)(R)
NT SERVICE\WMPNetworkSvc:(I)(OI)(CI)(IO)(GR)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
BUILTIN\Administrators:(I)(OI)(CI)(F)
BUILTIN\Users:(I)(RX)
BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
Everyone:(I)(RX)
Everyone:(I)(OI)(CI)(IO)(GR,GE)

Successfully processed 1 files; Failed processing 0 files
  [COLOR=Red]ACCESS DENIED[/COLOR]
  
C:\Users\Default User\Application Data &
C:\Documents and Settings\Default User\Application Data 

Everyone:(DENY)(S,RD)
NT SERVICE\WMPNetworkSvc:(I)(R)
NT SERVICE\WMPNetworkSvc:(I)(OI)(CI)(IO)(GR)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
BUILTIN\Administrators:(I)(OI)(CI)(F)
BUILTIN\Users:(I)(RX)
BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
Everyone:(I)(RX)
Everyone:(I)(OI)(CI)(IO)(GR,GE)

Successfully processed 1 files; Failed processing 0 files
  [COLOR=Red]ACCESS DENIED[/COLOR]
  
C:\Users\Guest\Application Data &
C:\Documents and Settings\Guest\Application Data 

Everyone:(DENY)(S,RD)
AndysMain\Guest:(I)(F)
AndysMain\Guest:(I)(OI)(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(I)(F)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
BUILTIN\Administrators:(I)(F)
BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files
  [COLOR=Red]ACCESS DENIED[/COLOR]
  

[COLOR=Red]This doesn't appear to match any of the other folders:[/COLOR] 
C:\ProgramData 

NT AUTHORITY\SYSTEM:(OI)(CI)(F)
BUILTIN\Administrators:(OI)(CI)(F)
CREATOR OWNER:(OI)(CI)(IO)(F)
BUILTIN\Users:(OI)(CI)(RX)
BUILTIN\Users:(CI)(WD,AD,WEA,WA)

Successfully processed 1 files; Failed processing 0 files
  [COLOR=Red]FOLDER LIST[/COLOR]
  
C:\ProgramData\Application Data 

AndysMain\Andy:(OI)(IO)(F)
AndysMain\Andy:(CI)(F)

Successfully processed 1 files; Failed processing 0 files
  [COLOR=Red]FOLDER LIST[/COLOR][/SIZE][/FONT]

You said previously that I didn't muck anything up. Are you implying that even after changing the permissions on the system files, Windows will continue to function normally? Should we even risk changing permissions on so many files?

I'm not entirely sure how permissions work on junctions, but I really don't think that leaving the permissions that you currently have be will cause any problems. If you haven't had any problems in this time, then I highly doubt anything will crop up in the future. As long as the system can access the folder, which it looks like it can as you've had no issues, you'll be safe. What I'm proposing is that we leave things as they are for the time being and have another go if any problems develop, which is very unlikely for the reasons above? Let me know your thoughts

Tom

 

[AndyTampa]

I'm cool with the "if it's broken but still working, don't touch it again" approach. I just wish I knew what all those abbreviations in the ICACLS report mean. If I had to take permissions for whatever reason, I could make a log and revert it if necessary. Of course I don't think that would have helped with as many directories as I saw go by. It took about a minute and a half to finish running through them.

Thank you for all your assistance. Have a Merry Christmas, Tom. :D

 

[NoelDP]

run
ICACLS /?

to get the roundup of what they abbreviations mean

Have a good one

 

[AndyTampa]

run
ICACLS /?

to get the roundup of what they abbreviations mean

Have a good one

Good one.