Windows Explorer: Folder Options 'Restricted'

balthazor · Mar 6, 2009

Hello,

I have a computer where I can't access the Explorer Folder Options (specifically the Folder and Search options under the Organize submenu.)

It is visible.

When I select it, I get an error message labeled 'Restricted.' The text reads "This option has been cancelled due to restrictions... See your administrator."

However, I should point out that I DO still have admin priveleges. I can access any other menu or option. I can edit the registry, change the internet explorer options, use the group policy editor, whatever.

Most of the potential solutions I found relate to either a program changing the restrictions for Explorer folder options; but the associated registry entries where those restrictions would normally be 'keyed' are not present.

Editing the group policy (which by default is 'not configured') to 'disable' the 'Remove Folder Options' policy has no effect whatsoever. Editing the registry, adding keys, and then disabling them, also has no effect.

Using NOD32 and scanning in safe mode results in no infection found, and I'm not seeing the telltale signs of an infection (such as limiting my admin priveleges in other areas, like registry editing or using the control panel applets.)

Hijack this does not provide any clues; it all looks clean (with the exception of some leftover services from TuneUp Utilities, which I ended up cleaning out manually.) Cleaning this did not change the problem at hand.

Using a restore point from several days ago did not fix the problem. I could go further back... but I don't even know when this problem began. Maybe as long as a month ago.

Any suggestions on how to diagnose this and fix?

Thank you!

H2SO4 · Mar 6, 2009

Is that machine a domain member? If so, there may be (domain) policy settings which you're not aware of.

The text of the error certainly makes it sound like a policy issue. Try running RSOP (resultant set of policies) if you want to dig deeper into the policy settings currently applied.

balthazor · Mar 7, 2009

Here are the results of the RSOP command line:

Code:

Microsoft (R) Windows (R) Operating System Group Policy Result tool v2.0
Copyright (C) Microsoft Corp. 1981-2001

Created On 3/7/2009 at 3:47:47 AM



RSOP data for Coffee\Anesa on COFFEE : Logging Mode
----------------------------------------------------

OS Configuration:            Standalone Workstation
OS Version:                  6.0.6001
Site Name:                   N/A
Roaming Profile:             N/A
Local Profile:               C:\Users\Anesa
Connected over a slow link?: No


COMPUTER SETTINGS
------------------
    
    Last time Group Policy was applied: 3/7/2009 at 3:36:00 AM
    Group Policy was applied from:      N/A
    Group Policy slow link threshold:   500 kbps
    Domain Name:                        COFFEE
    Domain Type:                        <Local Computer>

    Applied Group Policy Objects
    -----------------------------
        Local Group Policy

    The computer is a part of the following security groups
    -------------------------------------------------------
        BUILTIN\Administrators
        Everyone
        NT AUTHORITY\Authenticated Users
        System Mandatory Level
        

USER SETTINGS
--------------
    
    Last time Group Policy was applied: 3/7/2009 at 3:36:44 AM
    Group Policy was applied from:      N/A
    Group Policy slow link threshold:   500 kbps
    Domain Name:                        Coffee
    Domain Type:                        <Local Computer>
    
    Applied Group Policy Objects
    -----------------------------
        Local Group Policy

    The user is a part of the following security groups
    ---------------------------------------------------
        None
        Everyone
        BUILTIN\Users
        BUILTIN\Administrators
        NT AUTHORITY\INTERACTIVE
        NT AUTHORITY\Authenticated Users
        This Organization
        LOCAL
        NTLM Authentication
        High Mandatory Level

Everything appears to be normal...

Digging into the group policy doesn't reveal anything. Digging into the event viewer did show me a few curious audit failures that may or may not be related:

Code:

An account failed to log on.

Subject:
	Security ID:		Coffee\Anesa
	Account Name:		Anesa
	Account Domain:		Coffee
	Logon ID:		0x14072ea8

Logon Type:			2

Account For Which Logon Failed:
	Security ID:		NULL SID
	Account Name:		Anesa
	Account Domain:		

Failure Information:
	Failure Reason:		Unknown user name or bad password.
	Status:			0xc000006d
	Sub Status:		0xc000006a

Process Information:
	Caller Process ID:	0xb78
	Caller Process Name:	C:\Windows\explorer.exe

Network Information:
	Workstation Name:	COFFEE
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0

Code:

An account failed to log on.

Subject:
	Security ID:		Coffee\Anesa
	Account Name:		Anesa
	Account Domain:		Coffee
	Logon ID:		0xba72a

Logon Type:			2

Account For Which Logon Failed:
	Security ID:		NULL SID
	Account Name:		Anesa
	Account Domain:		

Failure Information:
	Failure Reason:		Unknown user name or bad password.
	Status:			0xc000006d
	Sub Status:		0xc000006a

Process Information:
	Caller Process ID:	0xbdc
	Caller Process Name:	C:\Windows\System32\dllhost.exe

Network Information:
	Workstation Name:	COFFEE
	Source Network Address:	-
	Source Port:		-

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

These audit failures do not show up every time I attempt to access Explorer's Folder and Search Options; I'm not sure what is triggering the audit failures because I can't correlate the times with logons, either.

H2SO4 · Mar 7, 2009

Odd situation. I find it difficult to avoid the conclusion that policy is applying somewhere, simply because the "restrictions..." message that you're seeing is associated with UI lockdown policies.

If you run GPRESULT /Z (that's super-verbose mode), does that also fail to show any policies being applied?

Does the same behaviour occur in safe mode?

If you log on as another user, even if you have to temporarily create one, does the same thing happen in that context?

balthazor · Mar 11, 2009

Thank you for your continued assistance.

Logging into another user results in the same behavior.

In safe mode, if I attempt to access folder options, no window opens at all (the option isn't present under file explorer (is that normal for safe mode?) but it still exists under Control Panel.)

Here are the results from the verbose gpresult (I'm still not seeing anything, but maybe I'm missing something?):

Code:

Microsoft (R) Windows (R) Operating System Group Policy Result tool v2.0
Copyright (C) Microsoft Corp. 1981-2001

Created On 3/10/2009 at 12:39:24 PM



RSOP data for Coffee\Anesa on COFFEE : Logging Mode
----------------------------------------------------

OS Configuration:            Standalone Workstation
OS Version:                  6.0.6001
Site Name:                   N/A
Roaming Profile:             N/A
Local Profile:               C:\Users\Anesa
Connected over a slow link?: No


COMPUTER SETTINGS
------------------
    
    Last time Group Policy was applied: 3/10/2009 at 11:11:57 AM
    Group Policy was applied from:      N/A
    Group Policy slow link threshold:   500 kbps
    Domain Name:                        COFFEE
    Domain Type:                        <Local Computer>

    Applied Group Policy Objects
    -----------------------------
        Local Group Policy

    The computer is a part of the following security groups
    -------------------------------------------------------
        BUILTIN\Administrators
        Everyone
        NT AUTHORITY\Authenticated Users
        System Mandatory Level
        
    Resultant Set Of Policies for Computer
    ---------------------------------------

        Software Installations
        ----------------------
            N/A

        Startup Scripts
        ---------------
            N/A

        Shutdown Scripts
        ----------------
            N/A

        Account Policies
        ----------------
            N/A

        Audit Policy
        ------------
            N/A

        User Rights
        -----------
            N/A

        Security Options
        ----------------
            N/A

            N/A

        Event Log Settings
        ------------------
            N/A

        Restricted Groups
        -----------------
            N/A

        System Services
        ---------------
            N/A

        Registry Settings
        -----------------
            N/A

        File System Settings
        --------------------
            N/A

        Public Key Policies
        -------------------
            N/A

        Administrative Templates
        ------------------------
            GPO: Local Group Policy
                KeyName:     Software\Policies\Microsoft\Windows\LLTD\AllowRspndrOnPublicNet
                Value:       1, 0, 0, 0
                State:       Enabled

            GPO: Local Group Policy
                KeyName:     Software\Policies\Microsoft\Windows\LLTD\ProhibitLLTDIOOnPrivateNet
                Value:       0, 0, 0, 0
                State:       Enabled

            GPO: Local Group Policy
                KeyName:     Software\Policies\Microsoft\Windows\LLTD\AllowRspndrOnDomain
                Value:       1, 0, 0, 0
                State:       Enabled

            GPO: Local Group Policy
                KeyName:     Software\Policies\Microsoft\Windows\LLTD\ProhibitRspndrOnPrivateNet
                Value:       0, 0, 0, 0
                State:       Enabled

            GPO: Local Group Policy
                KeyName:     Software\Policies\Microsoft\Windows\LLTD\AllowLLTDIOOnDomain
                Value:       1, 0, 0, 0
                State:       Enabled

            GPO: Local Group Policy
                KeyName:     Software\Policies\Microsoft\Windows\LLTD\EnableLLTDIO
                Value:       1, 0, 0, 0
                State:       Enabled

            GPO: Local Group Policy
                KeyName:     Software\Policies\Microsoft\Windows\LLTD\AllowLLTDIOOnPublicNet
                Value:       1, 0, 0, 0
                State:       Enabled

            GPO: Local Group Policy
                KeyName:     Software\Policies\Microsoft\Windows\LLTD\EnableRspndr
                Value:       1, 0, 0, 0
                State:       Enabled


USER SETTINGS
--------------
    
    Last time Group Policy was applied: 3/10/2009 at 11:16:40 AM
    Group Policy was applied from:      N/A
    Group Policy slow link threshold:   500 kbps
    Domain Name:                        Coffee
    Domain Type:                        <Local Computer>
    
    Applied Group Policy Objects
    -----------------------------
        Local Group Policy

    The user is a part of the following security groups
    ---------------------------------------------------
        None
        Everyone
        BUILTIN\Users
        BUILTIN\Administrators
        NT AUTHORITY\INTERACTIVE
        NT AUTHORITY\Authenticated Users
        This Organization
        LOCAL
        NTLM Authentication
        High Mandatory Level
        
    The user has the following security privileges
    ----------------------------------------------

        Bypass traverse checking
        Shut down the system
        Remove computer from docking station
        Increase a process working set
        Change the time zone
        Manage auditing and security log
        Back up files and directories
        Restore files and directories
        Change the system time
        Force shutdown from a remote system
        Take ownership of files or other objects
        Debug programs
        Modify firmware environment values
        Profile system performance
        Profile single process
        Increase scheduling priority
        Load and unload device drivers
        Create a pagefile
        Adjust memory quotas for a process
        Perform volume maintenance tasks
        Impersonate a client after authentication
        Create global objects
        Create symbolic links

    Resultant Set Of Policies for User
    -----------------------------------

        Software Installations
        ----------------------
            N/A

        Logon Scripts
        -------------
            N/A

        Logoff Scripts
        --------------
            N/A

        Public Key Policies
        -------------------
            N/A

        Administrative Templates
        ------------------------
            GPO: Local Group Policy
                KeyName:     Software\Microsoft\Windows\CurrentVersion\Policies\System\DontDisplayLogonHoursWarnings
                Value:       1, 0, 0, 0
                State:       Enabled

            GPO: Local Group Policy
                KeyName:     Software\Microsoft\Windows\CurrentVersion\Policies\System\LogonHoursAction
                Value:       2, 0, 0, 0
                State:       Enabled

        Folder Redirection
        ------------------
            N/A

        Internet Explorer Browser User Interface
        ----------------------------------------
            N/A

        Internet Explorer Connection
        ----------------------------
            N/A

        Internet Explorer URLs
        ----------------------
            N/A

        Internet Explorer Security
        --------------------------
            N/A

        Internet Explorer Programs
        --------------------------
            N/A

H2SO4 · Mar 12, 2009

I agree - the policy readouts do not suggest anything obvious.

I've also overlooked something previously. Policy would technically hide the "options" dialog entirely, rather than leaving it present and still nominally clickable.

Is the error message you've posted the exact text? I'm curious and I'd like to dig into this a bit.

balthazor · Mar 12, 2009

The error message is a pop up window labeled "Restrictions".

The text reads: "This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator."

In normal OR safe mode if I use Control Panel and attempt to access Folder Options no window or error message pops up.

I have admin access to all other aspects of the computer that I've checked.

Thanks for helping me try to figure this out.

bdmartin27 · Aug 9, 2009

Did you ever find a solution to your problems with restricted folder options? I suddenly developed exactly the same problem in the last day or so and I can't find a solution anywhere or any discussion of the problem other than the discussion above.

balthazor · Aug 9, 2009

Unfortunately, no, I haven't found a solution to this. Thankfully Windows 7 is coming around and I'll do a fresh install then; no other problematic symptoms appeared on the computer, and I haven't absolutely needed the 'restricted' functions to date, so it hasn't been a problem.

delphin · Aug 10, 2009

Open regedit and navigate to hkcu\software\microsoft\windows\current version\policies\explorer. examine all the keys in the right pane. Post a screen shot of the right pane.

If you didn't find anything, download this View attachment folder.reg, merge it and check.

bdmartin27 · Aug 10, 2009

The issue of "No Folder Options" in the Tools menu is relatively common, but I have a slightly different problem exactly the same as Balthzor described in his original posting.

The folder options is avaialble in the Tools menu, but when you click on it you get a dialogue box that says "This option has been cancelled due to restrictions... See your administrator." This happens with full administrator rights or even when logged on as Administrator. Also, when you click on Folder Options in the Contol Panel nothing happens.

delphin · Aug 10, 2009

hmm...

Download and run hijack this. Post the log here

bdmartin27 · Aug 11, 2009

Log file is attached. Thanks for looking at this for me.

delphin · Aug 13, 2009

see if you can open regedit and see if
the registry key below exists and if it does change the value to zero.

http://www.vistax64.com/tutorials/113709-folder-options-enable-disable.html

User Key:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
Explorer]
System Key:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\
Explorer]
Value Name: NoFolderOptions
Data Type: REG_DWORD (DWORD Value)
Value Data: (0 = show options, 1 = hide options)

If the above not solved your problem, download View attachment RRT.zip and run it.

balthazor · Aug 18, 2009

Delphin, thanks for attempting to help us.

As mentioned by bdmartin, the problem isn't that the option is hidden. The option exists, but gives a strange error when selected (see OP for details.)

I have attached the screenshot of the registry, as requested. No 'folder options' key is present, as you can see. I have, in the past, attempted to add this and set it properly, with no change in the 'permissions' error message I am getting.

Running the RRT tool you attached had no effect. I ran the tool as admin and restarted after.

bdmartin, have you by chance installed and uninstalled any windows explorer mods at all? I tried out one such program, called Opus, and uninstalled it from the system it was on. I'm not certain the problem started after this, however.

bdmartin27 · Aug 18, 2009

I believe the problem started after I tried TweakUAC andVista Services Optimizer that were recommended by Windows Secrets (Fred Langa) and were supposed to make Vista "smaller and faster". I don't know that they caused the problem, but I found the problem shortly after installing these. Removing the programs didn't help, but I'm not sure I restored everything that the programs changed.

balthazor · Aug 19, 2009

I wish I knew for sure that Opus or something else caused the issue on the system in question; if it were my regular system, I'm sure I would have picked up the issue instantly. And things like that drive me crazy if it is on my own computer; if it were happening to my system, I would have just re-installed Windows from scratch.

But the problem is on my wife's computer, and I can't be sure when the problem started. With Windows 7 around the corner, and the problem not preventing me from doing anything else, it is looking like I'll just wait and upgrade the OS. The computer itself is five years old and will probably be upgraded soon anyway.

It sure is annoying though! I ran another suite of anti-malware tools today, with nothing found but a few tracking cookies. I checked services, also, and can't seem to identify anything out of the ordinary that would be causing the issue.

jrgilman · Aug 24, 2009

I have the same problem but I have not tweaked my system that I can recall. The registry looks the same.

delphin · Aug 24, 2009

Have you tried rrt.zip?

http://www.vistax64.com/general-dis...-folder-options-restricted-2.html#post1111907

jrgilman · Aug 24, 2009

Use of the RRT utillity did not correct the problem.

Windows Explorer: Folder Options 'Restricted'

New Member

My Computer

A bit of a numpty

My Computer

New Member

My Computer

A bit of a numpty

My Computer

New Member

My Computer

A bit of a numpty

My Computer

New Member

My Computer

New Member

My Computer

New Member

My Computer

Eager to learn

My Computer

New Member

My Computer

Eager to learn

My Computer

New Member

Attachments

My Computer

Eager to learn

My Computer

New Member

Attachments

My Computer

New Member

My Computer

New Member

My Computer

New Member

My Computer

Eager to learn

My Computer

New Member

My Computer