Solving setup errors by using the SubInACL tool to repair file and registry permissions


A while back, I wrote a blog post about a .NET Framework 2.0 beta 2 installation problem that was caused by incorrect access control list (ACL) permissions on some registry hives.  In that post, I described how to use a tool in the Windows Resource Kit named SubInACL to reset file and registry ACLs to help solve this problem.

Ever since I wrote that post, I have run into installation errors for several other products that have been solved by using the SubInACL tool.  Therefore, I wanted to write a standalone set of instructions for how and when to use the SubInACL tool because the previous blog post is specific to the .NET Framework 2.0 setup and does not always appear in search results when people run into this kind of a problem and search the Internet for assistance.

How to download and run SubInACL

Here are some steps that can be used to download and run the SubInACL tool to repair file and registry permissions that are often needed to successfully install programs on Windows, particularly for MSI-based (Windows Installer) setups:

  1. Download the SubInACL tool and install it.  By default it will install to c:\Program Files\Windows Resource Kits\Tools
  2. If you are running Windows Vista, click on the Start menu, choose All Programs, then Accessories, then right-click on the item named Command Prompt and choose Run as administrator
  3. If you are running an OS other than Windows Vista, go to the Start menu, choose Run, type cmd and click OK
  4. In the cmd prompt, type notepad reset.cmd and click yes to open Notepad.exe and create a new text file named reset.cmd
  5. Copy and paste the following contents into reset.cmd (or download it from this location on my file server and rename it from reset.cmd.txt to reset.cmd):

    @echo off
    title Resetting ACLs…

    setlocal

    echo.
    echo Determine whether we are on an 32 or 64 bit machine
    echo.

    if “%PROCESSOR_ARCHITECTURE%”==”x86” if “%PROCESSOR_ARCHITEW6432%”==”” goto x86

    set ProgramFilesPath=%ProgramFiles(x86)%

    goto startResetting

    :x86

    set ProgramFilesPath=%ProgramFiles%

    :startResetting

    echo.

    if exist “%ProgramFilesPath%\Windows Resource Kits\Tools\subinacl.exe” goto filesExist

    echo ***ERROR*** – Could not find file %ProgramFilesPath%\Windows Resource Kits\Tools\subinacl.exe. Double-check that SubInAcl is correctly installed and re-run this script.
    goto END

    :filesExist

    pushd “%ProgramFilesPath%\Windows Resource Kits\Tools”

    echo.
    echo Resetting ACLs…
    echo (this may take several minutes to complete)
    echo.
    echo IMPORTANT NOTE: For this script to run correctly, you must change
    echo the values named YOURUSERNAME to be the Windows user account that
    echo you are logged in with.
    echo.
    echo ==========================================================================
    echo.
    echo.
    subinacl.exe /subkeyreg HKEY_CURRENT_USER /grant=administrators=f /grant=system=f /grant=restricted=r /grant=YOURUSERNAME=f /setowner=administrators > %temp%\subinacl_output.txt
    echo.
    echo.
    subinacl.exe /keyreg HKEY_CURRENT_USER /grant=administrators=f /grant=system=f /grant=restricted=r /grant=YOURUSERNAME=f /setowner=administrators >> %temp%\subinacl_output.txt
    echo.
    echo.
    subinacl.exe /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f /grant=system=f /grant=users=r /grant=everyone=r /grant=restricted=r /setowner=administrators >> %temp%\subinacl_output.txt
    echo.
    echo.
    subinacl.exe /keyreg HKEY_LOCAL_MACHINE /grant=administrators=f /grant=system=f /grant=users=r /grant=everyone=r /grant=restricted=r /setowner=administrators >> %temp%\subinacl_output.txt
    echo.
    echo.
    subinacl.exe /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f /grant=system=f /grant=users=r /setowner=administrators >> %temp%\subinacl_output.txt
    echo.
    echo.
    subinacl.exe /keyreg HKEY_CLASSES_ROOT /grant=administrators=f /grant=system=f /grant=users=r /setowner=administrators >> %temp%\subinacl_output.txt
    echo.
    echo.
    echo System Drive…
    subinacl.exe /subdirectories %ProgramFilesPath%\ /grant=administrators=f /grant=system=f /grant=users=e >> %temp%\subinacl_output.txt
    echo.
    echo.
    echo Windows Directory…
    subinacl.exe /subdirectories %windir%\ /grant=administrators=f /grant=system=f /grant=users=e >> %temp%\subinacl_output.txt
    echo.
    echo.
    echo ==========================================================================
    echo.
    echo FINISHED.
    echo.
    echo Press any key to exit . . .
    pause >NUL

    popd

    :END

    endlocal

     
  6. Change the values named YOURUSERNAME to be the Windows user account that you are logged in with.

    Note:  The YOURUSERNAME value should match the name of your user folder at c:\Documents and Settings (or c:\users on Windows Vista and higher).  You can also find the value to use for YOURUSERNAME by launching Task Manager and looking at the user name listed in the User Name column of the Processes tab.

  7. Save and close reset.cmd. 
  8. In the cmd prompt, type reset.cmd and press enter to run the SubInACL tool.  This tool will take several minutes to run, and it requires that the user account you are using has administrator privileges on the system.  This is why it is necessary to run it from an elevated cmd prompt on Windows Vista.  Step 2 above can be used to start an elevated cmd prompt on Windows Vista.
  9. After reset.cmd completes, try to install the product that previously failed to install correctly on your system.

Note: There are a couple of scenarios where installing or running SubInAcl can fail.  For example, some non-English versions of Windows have the name of the Administrators group translated to another language, and the command lines listed above will fail in that case.  I have posted workarounds for the issues that I know of in this separate blog post.

Also note: Running the above command lines will cause SubInAcl to create a log file named %temp%\subinacl_output.txt.  If you see any errors reported in the cmd prompt after running SubInAcl, you can look in this log file for more detailed information about what file(s), folder(s) or registry value(s) are causing the errors.  To open this log file, you can click on the Start menu, choose Run, type notepad %temp%\subinacl_output.txt and click OK.

When looking at this log file, you may see some errors reported with error code 5.  That error code means Access Denied, and it is typically caused by Windows or some other program running on your system that is holding files, folders or registry values in use so that SubInAcl is unable to update the permissions for them.  Most of the time, that type of error in the SubInAcl output can be safely ignored, but you may need to try to reboot and then manually fix the permissions for these files, folders or registry keys as a workaround.

When is SubInACL useful

I have found that the SubInACL tool is most useful when a setup package fails with error code 5 or 0x5 or 0x80070005.  All of these error codes mean Access Denied, and this type of error code is often caused by missing ACLs for the Administrators group or the built-in System account.  The Windows Installer service runs with System account permissions in most cases.  If the System account does not have sufficient permissions to access the file system or parts of the registry, an MSI-based setup package will fail with an Access Denied error.

SubInACL can also help resolve Internet Explorer script errors caused by incorrect access control permissions for specific user accounts on the system.

Example of a setup failure that was fixed by SubInACL

A customer contacted me with a problem installing Visual Studio 2005.  I looked at the main Visual Studio log file located at %temp%\dd_vsinstall80.txt, and I found that Windows Installer 3.1 setup was failing.  Then, I looked at the Windows Installer 3.1 setup log file located at %windir%\KB893803v2.log.  It showed the following error:

30.844: DoRegistryUpdates:UpdSpInstallFromInfSection Failed for MSI.Reg.Install: 0x5
30.844: DoInstallation:DoRegistryUpdates failed
30.875: Access is denied.

I had the customer run the above steps to use the SubInACL tool to update the file and registry ACLs on their system, and then they were able to install Windows Installer 3.1 and Visual Studio 2005 with no further problems.

<update date=”11/15/2006″> Updated subinacl command lines to include recursive ACL updating for folders and files under %windir% </update>

<update date=”3/22/2007″> Updated the steps to make them easier to follow by moving the directory change into the batch file. </update>

<update date=”9/25/2007″> Updated the notes to indicate that some Internet Explorer script errors can be resolved with this tool as well. </update>

<update date=”5/30/2008″> Updated command lines based on customer feedback regarding their experiences on Windows Vista. </update>

<update date=”6/16/2008″> Updated command lines to cause SubInAcl to create a log file in the %temp% directory in case it is needed for troubleshooting afterwards. </update>

<update date=”6/17/2008″> Added a link to a blog post where I describe a couple of workarounds for problems that can occur while trying to install and/or run SubInAcl. </update>

<update date=”6/20/2008″> Updated command line to include a backslash after %SystemDrive% in the 2nd to last command. </update>

<update date=”6/24/2008″> Updated wording of link to the post for troubleshooting SubInAcl errors to try to make it more visible. </update>

<update date=”7/29/2008″> Updated directory ACL command lines to not affect the Documents and Settings sub-folders. </update>

<update date=”3/12/2009″> Fixed broken link to reset.cmd. </update>

<update date=”4/7/2009″> Added clarification about how to determine the correct value to substitute for YOURUSERNAME in the sample SubInAcl script. </update>

<update date=”5/18/2009″> Added clarification about where to run reset.cmd after creating it. </update>

 

Comments (454)

  1. ALF1328 says:

    I can’t thank you enough for writing this quide. I was having installation problems which I spent a few days constantly trying to solve. I finally found information telling me to use the SubInACL tool but wasn’t told how to create the file named Reset.cmd.

    I have now sorted my problem thanks to your EXTREMELY HELPFUL instructions.

    Thankyou so much!

  2. racecarfl says:

    Thanks for your help with this. I too had been days trying to get either dotnet 2 or dotnet 3 to install and they kept stopping on permission errors and I was admin and reset file permissions on the one file with no luck. I used the cleaner and it helped with other problems but this got dotnet 3 working finally !! Great Job…

  3. danlanier says:

    Aaron, Thank you so much for this posting. On the campus I work we have encountered a host of issues. All while I kept think that the issue wasn’t this "program" or this "update" or install. You excellent work here has validated what my gut has been telling me.

    Your solution goes to the very root a problem that may plauge more users than I’d care to think about.

    As an analyst in the field, THANK YOU!!

  4. FuzzyBS says:

    Add me to the ranks above lauding your efforts.  I wish I had found this information at least 3 or 4 years ago.  Ever since Visual studio .NET, I’ve had problems opening websites on my local IIS using FrontPage extensions which I recently found out is caused by registry permissions in HKCR (thanks to researching my IE7 installation problems).  I hope this will either get me straightened out permanently or at least give me a quicker resolution when it happens.

    To give something back, I’ve enhanced the Cmd batch script above so it’s capable of being run without going into a shell or changing directories, so it’s easier to give to novice users needing help.  I’m not sure the best way to post this, so I’ll paste it here and perhaps Aaron can make it into a link.  (By the way, I called my file ResetACLs.cmd.)  If this gets munged, email me for a copy of the file.

    @echo off

    title Resetting ACLs…

    cd /d "%ProgramFiles%Windows Resource KitsTools"

    echo.

    echo Resetting ACLs…

    echo (this may take several minutes to complete)

    echo.

    echo ==========================================================================

    echo.

    echo.

    subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f /grant=system=f

    echo.

    echo.

    subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f /grant=system=f

    echo.

    echo.

    subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f /grant=system=f

    echo.

    echo.

    echo System Drive…

    subinacl /subdirectories %SystemDrive% /grant=administrators=f /grant=system=f

    echo.

    echo.

    echo Windows Directory…

    subinacl /subdirectories %windir%*.* /grant=administrators=f /grant=system=f

    echo.

    echo.

    echo ==========================================================================

    echo.

    echo FINISHED.

    echo.

    echo Press any key to exit . . .

    pause >NUL

  5. Hi FuzzyBS – Thank you for contributing this updated version of reset.cmd.  I’ve updated the version on my file share to contain these contents so it will be easier to use in the future.

  6. Mattie says:

    Do you have any guidance on a 64-bit version of SubInAcl?

    It’s been over a year, but I seem to recall that it didn’t work properly on x64 (at least for registry usage) because it couldn’t access the 64-bit registry hive. I asked for a 64-bit version of the tool at the time, and the response was that none were planned. I thought I’d check to see if there was anyone else running into this, or thought towards an x64 version.

  7. Hi Mattie – I’ve never tried SubInAcl on 64-bit systems, but it wouldn’t surprise me if it didn’t work on that processor architecture.

    On a 64-bit system, you might need to use one of the built-in Windows tools such as cacls to reset ACLs on your system.  You can click on the Start menu, choose run, type cmd and click OK, and then run cacls /? to list usage information for this tool.  Hopefully this will help in your scenario.

  8. larz65 says:

    As an admitted hack (Step 1 of the 12), I am compelled to address you as Mr. Stebner.

    I’ve been puzzled by the persistant registry errors I received while trying to install IE7. The directions in your post finally fixed the problem. I’m adding my IE7.log with the error string for others that might be encountering the same problem. Thanks again for the excellent advice!

    0.265: ================================================================================

    0.265: 2007/08/08 21:49:11.328 (local)

    0.265: c:b7a15deb6e2d1a90b811b9a464769875updateupdate.exe (version 6.2.29.0)

    0.281: Hotfix started with following command line: /quiet /norestart /er /log:C:WINDOWS

    2.187: IECUSTOM: Scanning for proper registry permissions…

    2.969: IECUSTOM: Scanning for proper registry permissions…

    3.156: IECUSTOM: Scanning for proper registry permissions…

    3.469: IECUSTOM: Unwriteable key HKLMSOFTWAREClassesInterface{3B7C8862-D78F-101B-B9B5-04021C009402}

    3.469: IECUSTOM: Unwriteable key HKLMSOFTWAREClassesInterface{859321D0-3FD1-11CF-8981-00AA00688B10}

    3.484: IECUSTOM: Unwriteable key HKLMSOFTWAREClassesInterface{E9A5593C-CAB0-11D1-8C0B-0000F8754DA1}

    3.484: IECUSTOM: Unwriteable key HKLMSOFTWAREClassesInterface{ED117630-4090-11CF-8981-00AA00688B10}

    3.500: IECUSTOM: Backing up registry permissions…

    3.500: IECUSTOM: Unable to backup DACLs HKLMSOFTWAREClassesInterface{ED117630-4090-11CF-8981-00AA00688B10}

    3.500: IECUSTOM: Finished backing up registry permissions…

    3.500: IECUSTOM: An error occured verifying registry permissions. ERROR: 0x80070005

    3.500: DoInstallation: CustomizeCall Failed: 0x3f5

    3.500: IECUSTOM: Restoring registry permissions…

    3.500: IECUSTOM: Unable to restore DACLs HKLMSOFTWAREClassesInterface{ED117630-4090-11CF-8981-00AA00688B10}

    3.500: IECUSTOM: Unable to restore DACLs HKLMSOFTWAREClassesInterface{E9A5593C-CAB0-11D1-8C0B-0000F8754DA1}

    3.500: IECUSTOM: Unable to restore DACLs HKLMSOFTWAREClassesInterface{859321D0-3FD1-11CF-8981-00AA00688B10}

    3.500: IECUSTOM: Unable to restore DACLs HKLMSOFTWAREClassesInterface{3B7C8862-D78F-101B-B9B5-04021C009402}

    3.500: IECUSTOM: Finished restoring registry permissions…

    3.500: The configuration registry key could not be written.

    3.500: Internet Explorer 7 installation did not complete.

    3.500: Update.exe extended error code = 0x3f5

    0.375: ================================================================================

  9. d.cochran says:

    I’m going to go ahead and preemptively thank you for this – I’ve been getting this error (with installer 3.1, curiously enough) for *ages* now and until I found this site, no one really had any functional ideas on how to fix it.

    When/if this works, if I ever meetcha in real life, I’m buyin you a pizza and/or beer, whichever you prefer 😉

  10. Hi D.cochran – Hopefully these steps will end up working for you.  As my wife can attest – I’m always up for pizza  🙂

  11. psale says:

    There is but a single account on my Win XP Pro SP2 notebook, an Administrator account, so of course I am the Administrator. Prior to installing any new software on this notebook I like to temporarily disable all Startup programs by running MSCONFIG, un-checking "Load Startup Items" and clicking OK. I then re-boot and continue with the installation of my new software. Very recently, while this procedure seems to continue to work, it also displays an ominous message, "An Access Denied error was returned while attempting to change a service. You may need to log on using an Administrator account to make the specified changes." A Google search revealed Aaron Stebner’s Weblog for “Solving setup errors by using the SubInACL tool to repair file and registry permissions” as a possible solution to this vexing problem.

    The good news is that Mr. Stebner’s cmd file runs correctly, and breaks nothing. The bad news is that I continue to get that ominous message even though the change I make inside MSCONFIG seems to “take” just fine. That is, I can successfully disable and later re-enable all “Load Startup Items”.

    Peter Sale

    Santa Monica CA USA

  12. Hi Psale – I’m sorry for the hassle this is causing for you.  Each object in the OS has specific ACLs assigned to it, including files, registry keys, services, etc.  Even if you’re running as an administrator, if your administrator group doesn’t have correct ACLs, you won’t be able to modify an object.  The SubInAcl tool adds administrator and system permissions for files and registry entries, but it doesn’t modify other objects like services.  It is possible that there is a service that you have to manually go and change the ACLs for in order to fix this issue.  You can use a tool like Process Monitor (http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/processmonitor.mspx) to narrow down what object is causing the access denied error.  From there, you should be able to use Windows Explorer or the Services control panel to right-click on the object, choose the Security tab and add the missing ACLs.

  13. jcmeyrignac says:

    I encountered a similar problem during the installation of VS2008 on Vista (more exactly, it crashed during the installation of Document Explorer 2008).

    I fixed the problem myself, by writing a small tool that was similar to SubInACL.

    After spending more than one day on fixing the problem, I discovered this nice page. Argh !

    Anyway, here is a way to reproduce the bug, since it appears to be a bug from Vista:

    1) Install Vista on a computer

    2) Create a temporary admin account

    3) Install Visual Studio 2005 or Office with this account (I disabled UAC, but it may be possible to reproduce the problem by running the installer as Administrator).

    4) Use another account, or simply log into a domain

    5) Delete the temporary admin account.

    Now, Vista’s registry is completely broken, with a ton of registries giving access denied, even if you are admin.

    In my case, I had 729 broken registries, and it was impossible to manually repair.

  14. michaelflinn says:

    Beautiful article.  Now to see if it will solve my problems….

    I reproduced JC’s scenario above inadvertently – perhaps by trying the easy way to do things – which should work.  

    Had Vista RC1 installed and Office 2007 Beta.  Office Beta expired. Needed quick edits in a web page, Installed Front Page 2003.

    Everything – IE 7, Search, Cntrl Panel — working.  RC1 Expired.  

    Installed RTM Vista Ultimate.  As an upgrade, which succeeded without complaint. Installed Office 2007.       Left FP 2003 on there.  Ran a little .reg file that turned of the completely inappropriate control over directory appearance in Explorer.  

    Now, IE7 wouldn’t start.  Search from the start menu wouldn’t start.  Control panel would not show any entries on the so called "Control Panel Home" (but would work in classic view).  Running ProcMon while starting IE7 showed an "Access Denied" followed by a thread exit and then a few thousand more events as it shut down without opening.  I changed the permissions on the questionable key (had to take ownership as others have noted -as admin, not dev, knew this) and now it would start, that is the window would open.  But it was absolutely dead.  Nothing in the window would work.  

    Looked at the reg again – now, a couple subkeys had appeared, and behold, they lacked the proper permissions.  

    Same sort of thing happened when monitoring the attempted start of Search.  10 access denieds.  Monitored a boot sequence: 423 access denieds.  Gave up and started searching for something like this.  Two days of failure – using search on MSFTs site – Live lost the search battle, because Google, not Live, found this blog the fourth entry down.  

    Thanks for the article!

    Whether it works or not….:)    

  15. michaelflinn says:

    Double plus good beautiful!

    Reported that it took about 2.6 minutes, but took closer to 10.  Changed several hundred thousand entries.  Good lord, no wonder vista needs horsepower- a wonder it works at all.  

    It solved the three problems noted above and also fixed the inability to copy files and directories from another (XP) machine.  AND the failure to find a file when Excel started.  And Access’s refusal to start because there was no license on the machine.  

    You the man, you the reg man!  

    PS:

    Note to other msft devs: please learn to think.  Not to code, to think.

    Also learn to write halfway intelligent error messages.  "Access can not start because there is no license on this machine."  That’s your error message and it is to stupidly wrong there are no words to describe it.  How about: "this program failed to start because it could not access the following registry key[s]….xxxxx…."  How hard is that?  Jeeez.

    PPs

    Thx again for the article.

  16. JayAh says:

    You Sir, are a genius. I had problems installing Quicktime – was getting a ‘you don’t have sufficient permissions’ nonsense whenever I installed it…I tried everything but nothing worked. Apple told me to re-install Windows but that’s their answer to everything when they can’t figure out what to do. I followed your tips, and everything installed beautifully. Well done, sir, well done!

  17. GaryE says:

    Dear Aaron,

    I am somewhat computer "illiterate" but I found your posts via a search on Windows XP advice site.

    I have the same problem trying to open any program files, Windows Updates, "run", etc…same message continually appears:

    Windows cannot access the specified file, program or device. You may not have the appropriate permissions to access…"

    My system is Windows XP Home Edition.

    I followed the instructions you gave but when I attempt to "run" the downloaded file SubInACL.exe, I get the following error message:

    "Windows Installer – The feature you are trying to use is on a network resource that is unavailable. Click OK to try again, or enter an alternate path to a folder containing the installation package "subinacl.msi" in the

    box below:"

    The "box below" shows Desktop as the only location. When I browse the Windows files I do not see a folder called "Windows Resource KitsTools" anywhere on my system.

    I saved the downloaded file to the folder "Downloaded Installations" in any event, but when I click the file to run it, I get the same exact message as

    above.

    When I click OK, the following message appears:

    "The installation source for this product is not available. Verify that the source exists and that you can access it."

    I am frustrated beyond measure and would greatly appreciate any and all pertinent advice.

    I am the Administrator and the only person using the laptop.

    In "Safe Mode" I gave myself permissions for all program files, Windows files, etc…

    Kind regards,

    Gary English

    Abu Dhabi, UAE

  18. Hi GaryE – It sounds like something went wrong with the installation of the SubInAcl tool on your system.  I’d suggest trying to do the following:

    1.  Use the steps listed at http://blogs.msdn.com/astebner/archive/2005/10/30/487096.aspx to manually remove the SubInAcl product from your system.

    2.  Re-download it and re-install it from http://www.microsoft.com/downloads/details.aspx?FamilyId=E8BA3E56-D8FE-4A91-93CF-ED6985E3927B

    3.  Try again to use the steps listed above in this blog post.

    Also, in general, it is not sufficient to just grant your user account permissions.  Usually you have to also grant the local system account and the Administrators group access as well (which is essentially what the instructions above will achieve).

    Hopefully this will help.

  19. GaryE says:

    Thanks Aaron – I deleted Windows Installer and dowloaded a newer version, the was able to install SubInAcl. I followed your instructions to the letter…but I still receive the message:

    "Windows cannot access the specified device, path or file. You may not have the appropriate permissions to…"

    A colleague here suggested it might be caused by a "worm" which has taken control of registry files..? Scans do not show any viruses or worms but he said they can be hidden, or "removed" but still cause havoc.

    Many thanks and Happy New Year to everyone,

    Gary

  20. Hi GaryE – If SubInAcl didn’t help resolve the permission problem, then there are a few other things I typically suggest.  First, you can try to disable some services to see if there is something else preventing you from accessing those resources (such as an anti-virus program or anti-spyware program).  You can use the steps listed at http://blogs.msdn.com/astebner/archive/2006/11/25/disabling-services-with-msconfig-to-work-around-setup-failures.aspx to try this out.

    If that doesn’t help, you can try to use a tool like Process Monitor (http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx) to try to manually narrow down which file/folder/registry key is causing the access denied error and then try to fix the permissions directly.

    I’ve also heard of cases where this type of error has been caused by a virus, but typically in those cases, the virus is discovered by running a scan on the system.

    Hopefully one of the above suggestions helps.

  21. BobbyL says:

    Yep..I have the same problem with script errors on wife’s account only when she opens Adobe Photoshop Elements (not an install problem just opening existing app).  The SubIn ACL fix looks very promising, but like Gary E, I have XP Home SP2, not Pro as the MS descriptin at the SubInACL download site says.  That is pretty clear that it will not work with XP Home.  Has anyone been successful with this tool with XP Home?  I’m pretty reluctant to try it for fear of screwing things up a lot worse.

    BobbyL

  22. Hi BobbyL – The web site doesn’t specify this, but SubInAcl will run fine on Windows XP Home just like on XP Professional.  I’d suggest giving the steps a try to see if they help at all on your system.  If they don’t work, you may need to try the additional suggestions I posted in my most recent reply above to GaryE.

    Hopefully this helps!

  23. BobbyL says:

    Aaron,

    The URL you provided right in the beginning of your blog to the MS site for SubInACL tool does indeed in the System Requirements section explicity say XP Pro…no mention of XP Home.  The problems that GaryE had may be traced to the fact that he is using XP Home, as he said in his very first comment above on 12.30.07.  

    I was hoping that someone might have successfully used the SubInACL fix under XP Home.  I am willing to try it if I had some confidence that I would not further hose up my system.  You think I might be safe to proceed if I had a Ghost image to restore the system to if things went south?

    BobbyL

  24. Hi BobbyL – I understand that the wording on the SubInAcl download page seems to indicate that it supports XP Pro but not XP Home, but from what I can tell and what I know about the tool, that is just an oversight in the wording on the page and not an indication that this tool won’t work on XP Home.  Nearly all of the operating system code for Windows XP is identical between the Home, Pro, Tablet and Media Center versions, including this type of security permissions management code that SubInAcl interacts with.  As a result, I don’t believe you run any risk of further damage to your system by trying it out.

    The issues that GaryE has run into simply mean that for some reason SubInAcl didn’t help resolve the issue he was encountering.  The SubInAcl steps listed in this blog post do not work for 100% of the possible cases where an access denied error can occur.  These steps have been tailored to help in the majority of cases I’ve seen in the past though, so they tend to work most of the time.  GaryE’s system had some other missing permissions that these command lines didn’t help fix, so additional troubleshooting steps are needed to narrow down the cause further.  These issues weren’t caused by trying to run SubInAcl though – they existed before the tool was even attempted on his system.

  25. BobbyL says:

    Aaron,

    I took the plunge and tried your fix…and it did the job!!  No problem with running XP Home. Thanks so much for sharing your knowledge and encouragement on this…you are the man!

    BobbyL

  26. Hi BobbyL – I’m really glad to hear that these steps helped solve this issue on your system.  I’m sorry for the hassle it caused for you along the way, and I’m also sorry for the confusion caused by the documentation on the SubInAcl download page.  Please let me know if you run into any additional problems on your system.

  27. clockman says:

    I found this post on Google. 2 years and no SP2 because of permission errors on my XP Home OS. I followed BobbyL’s bravery and tried the SubINAcl install too. I am happy to report SP2 now is installed on my XP Home Edition with now problems. – except for the install of 61 – SP2 MS updates that took awhile to complete. 🙂

  28. GaryE says:

    Hi again,

    Sorry for the delay in getting back to you but I was down with what is known as "Abu Dhabi Flu" which is going around this time of year.

    I did download and install Process Monitor but to be honest, I have no idea at all what I am looking at when it is running…or what I should be looking for.

    I ran the codes you listed above once again and when it completed, I had the following messages (some of my spacing my not be correct as I copied it quickly):

    C:Program FilesWindows Resource KitsTools>subinacl /subdirectories C: /grant=administrators=f /grant=system=f Access is Denied

    Also another >subainacl with the following:

    /subdirectories C:Windows*.* /grant=administrators=f /grant=system=f Access is Denied

    Any thoughts about this?

    Kind regards,

    Gary

  29. Hi GaryE – I’m sorry that you ended up getting sick.  I’ve been fighting something similar to that myself  🙁

    It can be difficult to narrow down exactly what to look for in Process Monitor.  What I usually do is start by adding a filter based on the process name – typically that is the name of the setup program you are trying to install, or if the setup is an MSI then it will be msiexec.exe.

    Then, I run the setup and reproduce the failure, and start looking for errors listed in the output.  From the errors, you can see the cause of the error in one of the columns in Process Monitor – they should be listed as access denied in this type of scenario.

    I’ve never heard of a case where running SubInAcl itself gave an access denied error though.  Are you running it when logged in as an administrator on your system?  You may need to go and manually try to do what each of those failing SubInAcl steps are doing.  You can manually change the permissions for a folder or registry key using Windows Explorer or regedit.exe.  You will want to add the Administrators group and grant that group full control and also add the SYSTEM account and give it full control.  You can do this for the root of your C drive, the c:windows directory, and the roots of the HKEY_LOCAL_MACHINE, HKEY_CLASSES_ROOT and HKEY_CURRENT_USER registry hives and hopefully that will help.

  30. I found a copy of this fix on another blog that mentioned they had used it on Vista to fix it so that the latest beta of Safari would run. I backed up my system, created a system restore point, and ran the script.

    Upon restarting, most of my services failed to start.  I could not run any properties boxes, nor run most system programs without getting a message that "The system does not have enough memory to complete this task (0x8007000e).

    Even using the Vista DVD and trying to do a system restore would not work correctly.  It was completely crazy.

    Finally I stumbled on another page where someone else had used this tool with a slightly different command.  Since I was on the verge of re-installing everything anyway I figured it was worth a try, and it fixed EVERYTHING.

    cd /d "%programfiles%Windows Resource KitsTools"

    subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f /grant=system=f /grant=restricted=r /grant=USERNAME=f /grant=restricted=r /setowner=administrators

    subinacl /keyreg HKEY_CURRENT_USER /grant=administrators=f /grant=system=f /grant=restricted=r /grant=USERNAME=f /grant=restricted=r /setowner=administrators

    subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f /grant=system=f /grant=users=r /grant=everyone=r /setowner=administrators

    subinacl /keyreg HKEY_LOCAL_MACHINE /grant=administrators=f /grant=system=f /grant=users=r /grant=everyone=r /setowner=administrators

    subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f /grant=system=f /grant=users=r /setowner=administrators

    subinacl /keyreg HKEY_CLASSES_ROOT /grant=administrators=f /grant=system=f /grant=users=r /setowner=administrators

    I wouldn’t use this fix at all unless you are desperate!!

  31. KenBanks says:

    Using the subinacl tool has solved this similar problem on my HP Pavillion Media Center running Vista Home Premium which I first ran into after installing Pinnacle software for use with a Pinnacle Show Center ( and this was with UAC enabled).  It has recurred a few more times all related to installing other sorts of media server related software.   I still cannot get beyond the Media Center receiver Service (ehRecvr.exe) form continuosly crashing and the Hauppauge tuner card can no longer be found in the MS Media Center, even though it works perfectly with WinTV.

    BUT these issues are not what I want to call attention to here (I just mentioned them in case other see similar problems or can suggest anything)

    What I really want to point out are some of the side effects of running the above script using subinacl.exe on a Vista system which has more than one user login.  If you have several family members and multiple logins on your initial login screen, these logins (except for your Administrator member Accounts) will disappear after running the above script.

    I was completely stumped when I saw mine had vanished, but yet I could still see all of them  in the Control Panel under User Accounts.  I found a simple solution to bring them back by simply running ‘net localgroup User /ADD username’ for each.   HOWEVER, I still run into all kinds of permissions issues with various applications and service, like printing, etc. which require their own varied security settings.

    I have added  this to the script to help out on some of this, but there is still something missing

    for %%i in (TYPE YOUR USERNAMES HERE) DO (

         echo Fix USER: %%i

         net localgroup Users /ADD %%i

         subinacl /subdirectories c:Users%%i  /grant=administrators=f /grant=system=f /grant=%%i=f /grant=Users=r

    )

    I don’t know if grant=r is enough for regular Users or what other permissions need to be reinstated to get things completely back to normally.

    So what I’m saying here is that you may think everything is great again after running these subinalc commands, but I guarantee something will turn up somewhere, and things become a lot more complicated when you have multiple user accounts.

    What I really wish we had was some sort of permissions map which states what permissions should be assigned for what and whom by default on a vanilla install.  Trying to figure this out by tweaking this and that (which is what I have been doing) is much too dangerous.   This seems to be a half-baked permissions scheme which breaks and falls apart with little effort and there has been provided no patch to correct it.  This horrible experience has caused me to discourage anyone who asks from moving to Vista.  It is unreliable and I wouldn’t be able to help them, if they ran into his problem, with much confidence.

    Ken Banks

  32. KenBanks says:

    MY BAD.

    this command is the culprit for disabling my user accoutns…

    secedit /configure /cfg %windir%infdefltbase.inf /db defltbase.sdb /verbose

    and it is not referenced in the above script of subinacl commands.

    However, the permissions issues that I pointed out still apply when you have multiple logins on Vista.

    Ken banks

  33. Allan1 says:

    Recently had a similar issue and am unable to resolve it. I’m taking the liberty of pasting a full description of the issue as posted on my forum. As stated in the text, the SubInACL tool did not help (btw, when I ran it I noticed severl "error" messages, the the utility did run to completion. Here’s the issue – any assistance will be greatly appreciated:

    Over the weekend I tried to upgrade my setpoint software to the latest release. After installation I opened setpoint to find there were no tabs – either for the mouse or the keyboard. Spoke with Logitech and they asked me to do a selective startup. When I tried to do so I received the following message from msconfig:

    "An Access Denied error was returned while attempting to change a service. You may need to log on using an Administrator account to make the specified changes."

    Logitech says that’s the problem – setpoint will only install when logged into an Admin account. I am the only user and am logged on with full admin rights. I then went to my office system and got the exact same message when I tried to do a selective startup. My first thought was that it might be some services I disabled – so I changed them all to default XP Pro settings – didn’t help. Other things I’ve tried:

    Ran the SubInACL tool to repair file and registry permissions

    Per a suggestion on the web I changed an HP registry setting

    Tried making the changes from Safe Mode

    Ran full scans with AV, AdAware & SpyBot

    BTW, I do not use ZA

    Bottom line, I still get the same error message in msconfig on both systems and still cannot install the latest setpoint sw. I have a current Acronis image of my system partition and have been reverting to that after each unsuccessful attempt

  34. Hi Allan1 – The SubInAcl commands that I list above in this blog post are not guaranteed to fix all possible access denied errors on a system.  Specifically, it only changes the permissions on some files/folders and some parts of the registry.  It does not make any changes to service permissions.  You may need to try to manually correct any remaining permission issues on your system.

    One other thing I should note here – if you get an access denied error, it does not necessarily mean that the account you’re logging in with is not a member of the Administrators group on your system (as its seems to be implied by the Logitech error message above).  It means that whatever account you’re logged in with doesn’t have sufficient permissions to whatever resource the system is trying to access.  Not all resources on a system are accessible even by administrators, plus permissions can be changed by other software or by the user.

    Also, selective startup mode does not cause the logged in user to no longer be a member of the Administrators group.

    I’d suggest trying to contact Logitech again to find out exactly what files, registry and/or services are being accessed when you tryt o start your software and see if they can walk you through steps to fix the permissions manually.

  35. zArchASMPgmr says:

    I have some good news, and some so-so news.

    Always starting off with good news:  SubInACL works on Vista x64 (in this case, Ultimate).  

    So-so news:  I think I also discovered a bug related to depth.

    My HKEY_LOCAL_MACHINESOFTWAREWow6432NodeClassesCLSID branch is huge.  (Well, so is Classes.)  At some point, the path name printed during the progress message starts to be inaccurate; the Wow6432Node starts repeating in the display, but it does work (based on the last messages after a ^C).  But eventually SubInACL crashed.  I was able to specify just Classes and it eventually worked (after about 4 million updates).  I manually updated the other Wow6432Node branches.

    I’m happy to report that this has cleared up the 80070005 and 8020(something or other) errors that I’ve been having with Automatic Update.

  36. Allan1 says:

    Okay, here’s an update.

    First, after some trial and error (and several hours on the phone with Logitech) I was able to install Setpoint 4.00 (not the latest version, but close enough). Turns out it had nothing to do with permissions or rights.

    Second, a couple of us have done some trial and error and we think the message in msconfig may be related to systems that have .Net Framework 2.0 (SP1) or higher installed.

    Last, when all is said and done it appears that the system will indeed still boot to diagnostic mode even though that message is displayed.

    Thanks so much for taking the time to respond and for this superb thread and tutorial 🙂

  37. Hi Allan1 – I’m glad you were able to get this software to work, but I’m sorry for all of the hassles you had to go through.  What was the underlying issue in this scenario?

    One comment – I don’t know of any dependencies between MsConfig and the .NET Framework.  MsConfig should work fine regardless of whether or not you have any versions of the .NET Framework installed on your system.

  38. Allan1 says:

    There were a couple of things. First, Logitech support told me that Setpoint versions newer than 4.00 and had me download that version from their FTP site. Second, I had to rename a specific file in windowssystem32drivers (wdf01000.sys) to a non-usable name (ie, .bak) and then plug in the dongle for the new mouse (XP would not install the HW if that file existed). I still got a "could not complete HW install) at this point, but upon reboot XP did report finishing the hw installation(it recognized the new mouse and installed the new wdf01000.sys driver file – same version as the old one). Then I installed the setpoint sw and it did recognize both the new mouse and my old keyboard. Logitech acknowledges the problem I had (no tabs after upgrading to Setpoint 4.x) is not uncommon and they can generally get it to install with some known work-arounds, but they say my problem was a little more sever than most. They did make note of the steps I had to take to get it to work and entered the "fix" in the DB.

    As for .Net Framework and msconfig I agree – there should be no issue. But we’ve found the problem exists on those systems where we have ver.2 (sp1) installed and does not appear on other systems. Could be coincidence I suppose.

  39. firecop1 says:

    I followed the instructions to setup and run SubInACL but I am unsure that what I am seeing is success.

    When I run it, and the window is open there is a red bar across the top showing "Done:, Modified and Failed. It seems that the same number that were modified also failed. Is this what I should be seeing or did I do something wrong?

  40. Hi Firecop1 – I haven’t heard of SubInAcl displaying this type of information in the past.  Would it be possible for you to post a screen shot of what you’re seeing?

    Also, did you try to run SubInAcl because you received an "access denied" error while trying to install a product on your system?  If so, did you try to re-run that product setup after running SubInAcl to see if it helped?

  41. hairball says:

    Hey Aaron, i had the same type of display that firecop1 talks about, but out of all of the registry entries shown, it only threw up 3 errors. I believe you may get this "red bar" screen when it is actually modifying registry entries, as i had a lot of those. Anyway, I do have a screenshot of what it looks like, but don’t know how to post it here, but I’ll gladly send it if you’d like.

    SubInACL did fix my problem, which was a failing Windows Update for KB885836 that has stumped me for the last 6 months. I noticed a lot of other folks have this same type of problem with other Windows Updates, so I downloaded and tried to manually install KB885836 which is when it gave me the registry permission denied error code 5, that led me to your awesome article/application!

    Thanks a bunch, my machine is fully patched again.

  42. pdotnet says:

    kevin@greatriverdesign.com… thank you so much for that comment!  The original reset.cmd in the blog post totally killed my Vista install.  Not even System Restore would work.  Thankfully I took an image of my entire drive using a 3rd party tool before running it!  

    After restoring my drive, I ran your version of the script and everything works brilliantly now!  No more access denied registry warnings when trying to install and run certain software.  Thanks!!

  43. Grzyb says:

    re: Solving setup errors by using the SubInACL tool to repair file and registry permissions

    I have some good news, and some so-so news.

    Always starting off with good news:  SubInACL works on Vista x64 (in this case, Ultimate).  

    So-so news:  I think I also discovered a bug related to depth.

    My HKEY_LOCAL_MACHINESOFTWAREWow6432NodeClassesCLSID branch is huge.  (Well, so is Classes.)  At some point, the path name printed during the progress message starts to be inaccurate; the Wow6432Node starts repeating in the display, but it does work (based on the last messages after a ^C).  But eventually SubInACL crashed.  I was able to specify just Classes and it eventually worked (after about 4 million updates).  I manually updated the other Wow6432Node branches.

    I’m happy to report that this has cleared up the 80070005 and 8020(something or other) errors that I’ve been having with Automatic Update.

    I am running Vista Ultimatex64 & I am having the same issues. Could someone please tell me how to "specify" Just Classes & Manually Update all the Other Now6432Node Branches???

    Regards

    Grzyb

  44. Hi Grzyb – When you install the SubInAcl tool, it also installs a readme file to the location C:Program FilesWindows Resource KitsToolssubinacl.htm.  That readme provides detailed usage information, including how you can specify exact sub-keys to update.  Hopefully this will help in your scenario.

  45. Thomas1981 says:

    Hello at all,

    i have the 80070005 Update Problem at Vista, so i tryid this, installed SubInAcl successfully, but when i run the reset.cmd, i get syntx errors for every line, like this:

    Error when checking arguments – HKEY_Local_Machine

    any solutions to this?

  46. Hi Thomas1981 – You need to make sure to run subinacl.exe from an elevated cmd prompt on Windows Vista.  To open an elevated cmd prompt, you can click on the Start menu, choose All Programs, then Accessories, then right-click on the item named Command Prompt and choose Run as administrator.

    I’m not sure that will solve this error though – I haven’t heard of this exact issue while running subinacl before.  You may want to review the readme at C:Program FilesWindows Resource KitsToolssubinacl.htm to see if you can figure out possible causes of this error.  You may also want to review the other comments on this blog – there are some specific notes posted by others who have tried running subinacl on Vista and run into issues, and they have posted other suggested workarounds that may be useful to you as well.

  47. Thomas1981 says:

    I’ve solved the problem, i deleted the

    /grant=administrators=f

    argument and it works fine. Vista Update is working too!

    Thanks alot

  48. olamoree says:

    XP Pro SP2 Media Center, Toshiba Satellite A105

    Hi Aaron,

    Since July 15th of 2007, altho WGA always reports Genuine, all Updates FAIL to install, even individual installs, reporting Error Code 0x80070005. Looked around, modified a couple of Registry Permissions with no luck and FINALLY found your blog, DLed and INS SubInACL tool and ran your script.  Report:

    Elapsed Time: 00 00:04:26

    Done: 28654, Modified 28654, Failed 0

    Last Done: C:WINDOWSwtwtupdateswtwebdriverupdate_infodata.wts

    C:Program FilesWindows Resource KitsTools_

    Now, I am going to Restart and pray… Back to MS Update, 9 Hi-priority updates listed, A-V, malware and Firewall stopped, Install Updates, a long pause (20 minutes), "Installation started…done!, then Installing"…. the rest following suit, taking 45 minutes and Toshy restarted! and 10 optional updates selected, A-V, malware and Firewall stopped and Installed without problems.

    I am wondering, with what SubInACL repairs and your script resolves, does any of that have to be returned to its original state?  Has a "hole" been left anywhere that could cause problems?

    At any rate, I want to compliment you on your diligence, knowledge and craft as well as sharing it with those who will listen.  I have no choice, I am subscribing to your Blog… and will sit at the feet of the guru… just tell me what to think!

    Ali

  49. Hi Olamoree – The steps listed in this blog post use SubInAcl to add full control permissions to the Administrators group and the local system account to the following parts of your system:

    1. The HKEY_LOCAL_MACHINE registry key and any sub-keys.

    2. The HKEY_CLASSES_ROOT registry key and any sub-keys.

    3. The HKEY_CURRENT_USER registry key and any sub-keys.

    4. The %windir% folder and any sub-folders and files.

    5. The %systemdrive% folder and any sub-folders and files.

    Most installers for applications and OS hotfixes require this type of permission to be able to install successfully.  You shouldn’t need to reverse any of these things later on.

    Thanks for the compliment on my blog.  Please let me know if you run into any issues in the future.

  50. aoshrin says:

    Thank you !!  I am running an old machine with the world loaded on it, running under Windows XP Home SP2. After recently installing Norton 360, some problems on my wife’s (administrator account) got worse. I saw the apparently classic unending Script error windows in IE7, Control Panel/User Accounts, etc. Though I was somewhat concerned about using your fix under XP Home, I saw that you addressed this issue, and said it would work.  I took more than a few minutes to run (our registries have grown huge over the years), but it worked. Control panel works, IE7 works, Flash 9 works. I didn’t even have to reboot or uninstall any software.

    It’s hard to express how appreciative I am.

  51. staura says:

    Hi Aaron

    Thanks for your info, I have a problem with my registry and I think your solution regarding SubInACL may well work, however I am rather concerned that it could also make the situation worse?  I have had issues with iTunes so I decided to uninstall and reinstall iTunes, uninstalling went fine however half way through reinstalling, the following error msg came up

    "Could not open key:

    HKEY_LOCAL_MACHINE/software/Classes/Interface/(915DA835-02FA-624BDF5D85AB)/ProxyStubClsid.

     Verfiy that you have sufficient access to that key. or contact your support personnel"

    after this I was unable to install iTunes.  In desperation I restored the pc back to before I uninstalled iTunes at which point iTunes was back on the system however now it won’t run, and I can’t uninstall it.  I tried to roll back the restore point and iTunes is still there and still won’t work… HELP!!!  It’s driving me crazy!  I have contacted, iTunes, Microsoft, Acer and the closet I they have come to helping me is to advise I restore the factory settings.

    I am confident that if I can gain access/permission to the HKEY mentioned it would resolve the problem.  I was going to try the SubInACL idea you suggested, however I am running Vista and the reviews other people have left across the net have been very mixed where Vista is involved.  Do you think this registry fix would be the solution to my iTunes problem or have I misinterpreted the use of the SubInACL tool and I am likely to cause more problems with my already problematic Vista laptop???

    For  the record, I have AVG 8.0 always running and I have no viruses, rootkits, etc!

    Any suggestions would be greatly appreciated

    Thanks

  52. Hi Staura – It sounds like you have a permission problem for this registry key, which is typically something that SubInAcl will allow you to solve.  However, before running the tool, you could attempt to manually fix the permissions for just this one registry key and see if it helps resolve your iTunes installation issue.  To do that, you can launch regedit.exe, then find this registry key, right-click on it and choose Permissions.  From there, you can add the SYSTEM account and the Administrators group, and grant them Full Control permissions.

    Hopefully this helps!

  53. staura says:

    Hi Aaron

    Thanks for the feed back, I have just tried and the key says

    "ProxyStudClsid32 cannot be opened.  An eror is preventing this key from being opened.  Details: Access is denied"

    It then allows me access to the Permissions but I can’t save any chages or add any admistration groups.  I think I will try your SubInACL soloution and if it doesn’t work, I will restore the factory settings and start again!  To be honest we are having so many problems with Vista anyway; recyling files is now taking a good minute regardless of size (Microsoft have been no help on this), Windows media player won’t work either despite installing all kinds of codecs to resolve the issue (we are now running classic version as it is the only one that will work), I think a complete system restart really could only improve the situation.

    Thanks for you help, its really appreciated

  54. bfrederi says:

    Aaron:

    Thank you. Thank you. Thank you.

  55. dbd7 says:

    Hi,

    I’ve been having problems with Office 2003 updates since I upgraded to XP SP3. When I start MS Expression Web, Windows Installer would start and try to reinstall Office 2003 and then it would fail due to a registry key permission issue (which I tried to fix manually in the registry, but it didn’t help). Also, I couldn’t install Office updates I received from Windows Automatic Updates. I found reference to your blog on the Windows XP Microsoft Discussion board. I followed your directions above using the SublnACL tool and it worked!  I no longer get the Window Installer popping up all the time and I was able to install the Office 2003 automatic updates. Thank you for posting these instructions! I will amend my post to the discussion board where I sought help for this issue, and state that I found the answer here on your blog. Thanks again! Great job!

  56. ex19 says:

    ok, blackberry works now… but now all my sound is not working and the network monitor and updates are disabled. Ummm, not like I knew what I was doing running this but I was desperate last night. How now to re-enable those other devices.

    Thanks

  57. Hi Ex19 – I’m sorry for the hassles this is causing for you.  I’m not sure what to suggest to fix your sound and network monitor.  What kind of specific errors do you get for those things?  It might help to try to update drivers for your sound card to fix your sound issue.

  58. speedytina says:

    Hi;

    Just discovered this great thread and am reading it with great interest. I am having a terrible time getting Adobe Flash to install with Windows XP Home. I,m just a Joe average PC user and have tried everything I could find to solve the problem but nothing has worked. My question is this. When you state that "you will need to have adminstrator privileges for this to run correctly", what exactly do you mean? Can I accomplish everything in you instruction by logging into windows "Safe Mode"? If so, how? It’s a whole other issue (admin pw problem)but the only way I can log into Windows as an administrator is while in Safe Mode.

    Will I still be able to solve my flash installation problem using SubInACL while logged-in in safe mode. I hope I’m making sense.

    Thanks

    speedytina

  59. ex19 says:

    Thanks for answering. Well here’s the deal. Audio Service is not running, connection status unknown not enough storage is available to complete this operation, windows installer service could not be accessed, security center can not change your automatic updating settings (tried manual, failed) Like EVERYTHING in the system is pretty much flipping out.

    I ran the blackberry no media after this subinacl and everything from then on was all downhill. I have no idea what I’m doing but it seems that lots of stuff in my computer has fried. Tried to reinstall the drivers for audio, no help. Now I’m going to try running vista update to hope it will go through and figure out what is wrong and fix it. Prob. wishful thinking. I’m not sure but I have a feeling it’s acutally the blackberry software, but now I can’t uninstall it. I’ll keep you up to date, but if you see some theme in here I’d really appreciate a hand.:)

  60. Hi Speedytina – Without knowing exactly what errors you’re getting while trying to get Adobe Flash to install, it is difficult to say whether or not SubInAcl will be useful for you.  SubInAcl generally helps when the error is 5 or 0x5 or "access denied" during installation.

    Administrator privileges means that you need to log on to your computer with an account that is a member of the Administrators group because SubInAcl needs a certain set of privileges in order to be able to change the file and registry permissions on the system.

    You may also want to look on the Adobe web site to see if they have any troubleshooting guides or FAQ lists for installation problems related to the Flash player.

  61. Hi Ex19 – I’m not sure how to explain these additional errors that you’re seeing.  Since you mentioned that you’re running Windows Vista, you may be running into some of the complications that other folks who have posted comments on this blog post have mentioned.  Specifically, I’d suggest looking at the comment at http://blogs.msdn.com/astebner/archive/2006/09/04/solving-setup-errors-by-using-the-subinacl-tool-to-repair-file-and-registry-permissions.aspx#7394609 to see if these modified steps help at all.

  62. ex19 says:

    Yes Aaron, the above comment absolutely solved my issue! It was scary, I have to say, but in the end it completely restored all those things that were not working under Vista. Thanks so much for your help.

  63. Hi Ex19 – I’m glad to hear that this fixed things for you.  I’ve gone back and updated the list of commands to run in the main blog post and in the cmd file linked in this blog so that others will hopefully not run into this type of error in the future.

  64. grb1 says:

    Dear Aaron,

    I am trying to solve issues with updating windows SP3 and a many other updates that I cannot get ever since May 14. (My case is similar to GaryE) and I am a mere and humble pc home user.

    I am getting additional error messages when i dowloand & install subinacl.exe even if i tried to ignore and kept going – Internal error 2350.

    Then I followed the thread of issues with subInAcl (739820) and now I am getting – unexpected error 1605 () – at the cmd [prompt.

    I am feeling desperate and I do not know what to do. Can anybody guide me please?

    Grb1

  65. Hi Grb1 – I’m not sure I understand the exact problem you’re currently facing.  Are you seeing errors while trying to install SubInAcl.msi, or while trying to run the command lines listed in this blog post to update permissions?  Can you please list the exact steps you have tried and the exact error messages that you received while doing so?

  66. Cathy C says:

    I’ve been using Vista Ultimate with all current updates for over a year

    without any installation issues, but for the past month I’ve been having

    problems with program updates not installing due to access being denied.

    Specifically: Error 1310. Error writing to file: c:Config.Msi… .rfb.

    Verify that you have access to that directory. Also encountered similar

    problems with QuickBooks and iTunes+QuickTime updates. I started having

    problems with searching in Outlook 2007 last week and tried a repair. That’s

    when I narrowed down what was going on (or not). I’ve remedied that by

    reindexing, but now get an error about Custom UI Runtime Error in MS Access

    Outlook Add-in for Data Collection and Publishing … An error occurred

    while calling the callback: "Ribbon_GetDCVisible." I’ve consulted with a

    Dell tech and another Vista-savvy tech. I’ve tried logging on as

    Administrator (which I am also), creating a new administrator profile, Aaron

    Stebner’s SubInACL recommendation:

    http://blogs.msdn.com/astebner/archive/2006/09/04/739820.aspx . After this I

    was able to install the QuickBooks update, but not iTunes, nor can I

    accomplish a repair to MSO 2007 Pro. I’ve installed the latest versions of

    Windows Installer and .NET Framework. UAC is disabled. Does anyone have any

    suggestions for further action? And information on why this started

    happening?

    Thanks,

    Cathy

  67. Hi Cathy C – I’m not sure how to explain all of these errors.  Do you have any idea what specific changes were made to your system immediately before these errors started happening?  If you could narrow it down to a specific Windows Update or something like that, it could be really helpful.

    Also, if you haven’t already, I’d suggest trying to install Windows Vista SP1 on this system to see if that resets any of the permissions on your system and helps fix any of these errors.

  68. A while back, I posted some instructions for using a tool from the Windows Resource Kit named SubInAcl

  69. bm55b says:

    I think you have a type-o in the script missing a backslash after %SystemDrive%.

    Somehow my Windows XP Home Ed. got its permissions on "C:Program Files" corrupted and this script skipped over it.  Running this command got my file system perms fixed up…

    subinacl /subdirectories c: /grant=administrators=f /grant=system=f

    What a relief….

  70. Hi Bm55b – Thanks for letting me know about this missing back-slash.  I’m going to update the main blog post text and the downloadable script to address this.

  71. sandman88 says:

    I had vista x64 and was trying to get SubInACL to work.  For some reason I was defaulting the install to C:Program FilesWindows Resource Kits.  Anytime i tried to run subinACL it would give me an error about not being recognized.  I removed the program, reinstalled and made sure to allow it to default to C:Program Files (x86)Windows Resource Kits

    Once complete I was then able to run SubInACL and fix my registry issue quickly.

    Not sure if this has been posted, but I saw people having issues with Vista Ultimate X64 and would like to say that it does indeed work in vista x64

    Thanks for the help!

  72. Datajack says:

    I did this procedure and not I am having trouble with access permissions, some things I can do before I can’t anymore, getting access permission errors (ex: saving a color management profile in the windows/system director which worked before not gives me access denied).

    I tried what one of the posts suggested but can’t figure out where to type the command subinacl /subdirectories c: /grant=administrators=f /grant=system=f)

    Please, please can someone tell me how to fix this, or how to undo the entire operation to post did? I don’t want to continue years wondering at every bug if it is caused by what this blog suggested…

    I am really not hardcore tech, please can someone help?

  73. Hi Datajack – There isn’t a way to undo all of the changes made by running SubInAcl.  It sounds like you still do not have enough permissions for all operations on your system, such as saving files to the system32 folder.  The command lines in the script I posted at http://astebner.sts.winisp.net/Tools/reset.cmd.txt already contain a command line to grant administrators and the system account full control to the sub-directories under the Windows directory though, so you should not need to run it again as long as you already ran all of the steps listed above in this blog post.  I’d suggest double-checking that you ran all of the commands listed above and not just the registry commands, and see if that helps.  If not, you can manually update permissions for folders by right-clicking on them in Windows Explorer and choosing Properties, then going to the Security tab and adding the permissions that you need.

    Hopefully this helps.

  74. toby77jo says:

    Hi,

    I was desperate as i got a access denied message when trying to update my 2 windows 2003 x64 domain controllers to sp2 from r2. So I thought the problems were related to permissions either in the registry or on the filesystem. After running your reset.cmd, I only have blank desktops, no taskbar, some services are not running, for example IIS, i am lost, what can I do??

  75. Hi Toby77jo – I’m sorry for the hassles that this issue is causing for you.  I haven’t heard of the SubInAcl command lines listed above causing this kind of trouble on the system, so I’m not sure how to explain why this is happening.  The commands listed above should only be adding permissions to the registry and file system on your computer – they shouldn’t be removing anything that existed previously.

    I’d suggest using a system restore point to roll back to a point before you ran SubInAcl if possible, and then you can try to manually update permissions to try to fix the access denied errors you are encountering.  For files/folders, you can update permissions by right-clicking on them in Windows Explorer.  For the registry, you can update permissions by opening regedit and right-clicking on keys.

  76. toby77jo says:

    Hi,

    but windows 2003 does not have system restore by default, am i wrong?

    I will try a full system restore from an image, hope it will work. All this might not be the reset.cmd fault but also due to the failed sp2 installation…

  77. Hi Toby77jo – Yes, I think you will need to do a restore from an image in this case.  It is possible that the failed SP2 install caused these issues, but I’m not sure.  I’m not sure how the SubInAcl commands would cause services that previously worked to stop working though.

  78. ZAB says:

    Did you even know what are you doing???

    This command grant access to every folder for every user:

    subinacl /subdirectories %SystemDrive% /grant=administrators=f /grant=system=f /grant=users=e >> %temp%subinacl_output.txt

    How could you explain this???

  79. Hi ZAB – That command line grants read and execute permissions to all users, not full control.  When I look at the computers that I have in my office, read and execute appears to be the default for the users group for all folders on the system.  If you don’t want this permission applied on your system, you can modify the command line to remove the /grant=users=e switch.

  80. ZAB says:

    Of course not! You grant access to folder c:documents and settings too, and every subfolders like "my documents" every profile settings all stored passwords for outlook and so on… and it will be transparent to everyone. If you dont know what are you doing at least not recommend this to others.

  81. Hi ZAB – You’re right – I missed the Documents and Settings (or Users on Vista) sub-directories.  The systems I have been looking at are only single user systems, and are not shared by multiple users.  I’ve updated the command line above and in the linked script to refer to the %ProgramFiles% folder and %windir% folder instead.  Thanks for letting me know about this.

  82. celtc says:

    Hi people, I have a little problem over here when trying to use SubInACL to solve my problem. I’ve tried everything I’ve found on the web but no matters what I do I just can’t find out a solution. I get this when I type reset.cmd on my command prompt:

    D:WINDOWS>reset.cmd

    Determine whether we are on an 32 or 64 bit machine

    Resetting ACLs…

    (this may take several minutes to complete)

    ==========================================================================

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume

    nts – HKEY_CURRENT_USER

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume

    nts – HKEY_CURRENT_USER

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume

    nts – HKEY_LOCAL_MACHINE

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume

    nts – HKEY_LOCAL_MACHINE

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume

    nts – HKEY_CLASSES_ROOT

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume

    nts – HKEY_CLASSES_ROOT

    System Drive…

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume

    nts – D:Archivos

    Windows Directory…

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume

    nts – D:WINDOWS

    ==========================================================================

    FINISHED.

    Press any key to exit . . .

    By the way here is some extra information you may need to help, I’m using XP SP2 as OS, and my windows installation is in the drive D:,… the language of my OS is spanish – that is the reason for which I have a bad quality of english, I am an argentinean :P-

    I’ve already try lots of things such as running as administrator or use a different reset.cmd.txt I’ve found on google. The problem    that I’ve by which I’ve to SubInACL is that when I try to install Natural Color Pro I get an error saying:

    Self-Registration Error

    The following files din not self-register or unregister:

    1. D:WINDOWSsystem32Flash.ocx

            Error al tener acceso al Registro OLE

    So I can’t isntall it because of that problem with accessing OLE registry.

    Any suggestions would be greatly appreciated.

    Thx for reading all this ;D

  83. Hi CeltC – I haven’t seen any errors like this before.  SubInAcl seems to think that the names of the registry keys are invalid in those command lines or something like that.  Can you run individual SubInAcl command lines outside of reset.cmd and see if they work?  Or could you try running subinacl.exe /? or subinacl.htm (which is in the same directory as subinacl.exe) and look at the syntax and try to create a command line that works on this system?

    Hopefully this helps.

  84. celtc says:

    Thanks Aaron – I’ve followed your instructions. I run subinacl.exe /help and /help syntax and it seems to be everything ok, however when I individually run the command lines of reset.cmd I still get that annoying "syntax error":

    D:Archivos de programaWindows Resource KitsTools>subinacl /subkeyreg HKEY_CUR

    RENT_USER /grant=administrators=f /grant=system=f /grant=restricted=r /grant=Ezc

    urraUsuario=f /setowner=administrators > %temp%subinacl_output.txt

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume

    nts – HKEY_CURRENT_USER

    I tried to find out what was wrong, and I realized then that some command lines such as: (…)subinacl /keyreg HKEY_LOCAL_MACHINE /display   works perfectly. Even when I tried to run (…)subinacl /file D:TESTACCESS.TXT /grant=EzcurraUsuario=o for verifying if it works everything just is perfect. So I took the previous command line from the oringal reset.cmd and erased every action except for the one that gives full control of the HKEY_CURRENT_USER regkeys and subregkeys to the current user and I got this:

    D:Archivos de programaWindows Resource KitsTools>subinacl /subkeyreg HKEY_CUR

    RENT_USER /grant=EzcurraUsuario=f > %temp%subinacl_output.txt

    Elapsed Time: 00 00:00:19

    Done:    10391, Modified    10385, Failed        6, Syntax errors        0

    Last Done  : HKEY_CURRENT_USERVolatile Environment

    Last Failed: HKEY_CURRENT_USERSoftwareALWIL SoftwareAvast4.0ashSimplSettin

    gs – RegSetKeySecurity Error : 5 Acceso denegado.

    It seems that it worked fine but I do not know if this command in fact is of some utility. At this point I think I can’t do much more and I don’t want to do anything risky. So instead of  doing something harmful I would like to have an opinion of someone who really knows about this.

    Thx again for your aid and I apologised for any writing error that I may have had since in fact I am still learning English.

    Celtc

  85. Hi Celtc – I haven’t seen this kind of error before, so I can’t tell for sure what is going on and I’m not sure what to suggest to resolve it.  It sounds like the SubInAcl tool is working on your system, but that there is something wrong with the exact command lines being used.  I’d suggest trying different combinations of the command line switches listed in this blog post in order to narrow down exactly what part of the command line is causing these errors.

  86. Hi CeltC – One thing I forgot to mention here – if you are using a non-English version of Windows and any of the user or group names are translated on your system, then you will need to adjust these SubInAcl command lines to use the translated names.  This is described in more detail in issue #1 in the blog post at http://blogs.msdn.com/astebner/archive/2008/06/17/8613982.aspx.

  87. DaddySam says:

    In the file "reset.cmd" you are supposed to replace "username’ with your name.

    Assuming your name is "John Doe", would you replace with:

    John Doe

    or

    "John Doe"

    With thanks

  88. Hi DaddySam – That is correct – there is a step listed above that says "Change the values named YOURUSERNAME to be the Windows user account that you are logged in with."  However, it is easy to miss that, so I’ll add a comment to the copy of reset.cmd on my file server as well to hopefully help people find that in the future.

  89. DaddySam says:

    Windows Update for SP3 gave me the following error message:

    Service Pack 3 setup could not backup Registry Key HKLMSoftwareMicrosoftWindowsCurrentVersionUninstallKB873339 to file C:Windows$NtServicePackUninstall$reg02315. 5: Access denied

    Should I run the SubInACL tool or would there be a simpler solution to that problem ?

    This is the first time that I am encountering an installation problem

    With thanks

  90. Hi DaddySam – The SubInAcl command lines listed above will update the permissions for several locations on your file system and in your registry.  For this particular error, it lists an exact location that it is having trouble accessing.  It might be possible to just go in and manually update the permissions for that specific folder location and see if that solves this error.  You can update permissions manually by doing the following:

    1.  Opening Windows Explorer

    2.  Right-click on the folder and choose Properties

    3.  Click on the Security tab

    4.  Add the necessary permissions (typically, you need to make sure that the SYSTEM account and the Administrators group both are listed there and have Full Control permissions granted to them

    Hopefully this helps.

  91. fredjones says:

    Running the script at the top of this page on a Vista 32 machine I get several ‘Failed’ and a 1.8Gb subinacl_output.txt file generated. Is this normal? I have tried running in normal windows mode as well as safe mode with similar results. Should I be able to get to a point where there are no failures or should there always be a few?

    Thanks for any help.

    The summary output from running the script is:

    Determine whether we are on an 32 or 64 bit machine

    Resetting ACLs…

    (this may take several minutes to complete)

    IMPORTANT NOTE: For this script to run correctly, you must change

    the values named bob to be the Windows user account that

    you are logged in with.

    ==========================================================================

    Elapsed Time: 00 00:00:23

    Done:    19122, Modified    19122, Failed        0, Syntax errors        0

    Last Done  : HKEY_CURRENT_USERVolatile Environment1

    Elapsed Time: 00 00:00:00

    Done:        1, Modified        1, Failed        0, Syntax errors        0

    Last Done  : HKEY_CURRENT_USER

    Elapsed Time: 00 00:10:31

    Done:   377633, Modified   377618, Failed       15, Syntax errors        0

    Last Done  : HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesa9hqrxfrParam

    etersPnpInterface

    Last Failed: HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicessptdCfg : 5 A

    ccess is denied.

    Elapsed Time: 00 00:00:00

    Done:        1, Modified        1, Failed        0, Syntax errors        0

    Last Done  : HKEY_LOCAL_MACHINE

    Elapsed Time: 00 00:08:49

    Done:   128238, Modified   128226, Failed       12, Syntax errors        0

    Last Done  : HKEY_CLASSES_ROOT{FEDC2E25-975DFD53-6981D376}

    Last Failed: HKEY_CLASSES_ROOTCLSID{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}Inpr

    ocServer32 : 2 The system cannot find the file specified.

    Elapsed Time: 00 00:00:00

    Done:        1, Modified        1, Failed        0, Syntax errors        0

    Last Done  : HKEY_CLASSES_ROOT

    System Drive…

    Elapsed Time: 00 00:12:26

    Done:        0, Modified        0, Failed        0, Syntax errors        0

    Windows Directory…

    Elapsed Time: 00 00:04:20

    Done:    92977, Modified    92972, Failed        5, Syntax errors        0

    Last Done  : C:Windowswinsxsx86_xrxscan.inf.resources_31bf3856ad364e35_6.0.60

    00.16386_en-us_ed393488b2a7196cxrxscan.inf_loc

    Last Failed: C:WindowsSystem32LogFilesWMIRtBackupEtwRTEventLog-System.etl

    – CreateFile Error : 5 Access is denied.

    ==========================================================================

    FINISHED.

  92. Hi FredJones – In my past experience using SubInAcl, I found that there are typically always some registry values held in use by the OS that can cause errors/warnings when trying to update the permissions.  It is usually OK to ignore that type of error/warning unless it is causing some specific error while trying to install or use a specific application on your system.

  93. tmc1961 says:

    Thanks a lot for this routine.

    I’m running XP, and tried to install DeLorme Topo USA 7.0.  Tried about ten other things before I found your blog.  Ran the reset.cmd from here and it worked like a champ.

    http://astebner.sts.winisp.net/Tools/reset.cmd.txt

    Again. Thanks a million!!!

  94. oscarmat says:

    I was not able to install .net framework 3.0 nor Visual Basic express 2008, and this post solved the problem. Thanks!.

    This are some of the error messages. A little help for google 🙂

    WIC Installer: [2] Error code 1603 for this component means "Fatal error during installation.

    ProductInstall.GlobalRegistryChanges.Install error: 0x5

    Access is denied.

    WIC installation did not complete.

  95. MHalladay says:

    Is this an ignorant question? I’m installing SP1 on VISTA and it goes into a loop on stage 3 – no matter if it’s SAFE mode or not. The solution is to do a restore. I’ve tried restore from WinRE, and the original DVD and I get 0x80070005 – access denied. Since I don’t have a system – only WinRE (a basic DOS) system can SubInACL run in that environment? I just want to do a restore and somehow get by the ‘access denied’ problem. Thanks … Michael

  96. Hi MHalladay – I don’t know for sure if SubInAcl can be run from this type of environment.  For this type of Vista SP1 install error, I’d suggest trying one of the free Vista SP1 support options listed at http://support.microsoft.com/oas/default.aspx?ln=en-us&prid=11274.

  97. MHalladay says:

    I started with notes to Microsoft last Tuesday – took 72 hours for the 1st 24hr (advertised) response. The 2nd response was within the 24 hours. They asked me to do a CHKDSK /R (which anyone knows takes about 12 hours – needless to say a brush off) I told them I’d aready done that it was clean) Took another 24 hours for them to ask me to do a RESTORE. Since I’d already told them in my 1st note that I’d tried that – it was another brush off. Anyway it’s been about 6 days and so far nothing in the last 36 hours. I suspect they’ll either tell me to re-install VISTA (Clean of course) or to do another CHKDSK. Needless to say MS is a write-off which is why I’m looking everywhere else for an answer.

    You’d think my original question to them – I’m in a loop on stage 3 installing SP1 and restore gives me a 0x80070005 – access denied – would be for them a simple look in their database for an answer and tell me what it is. Instead it’s the same old run around. Luckily only one of my systems is VISTA, but it’s an important system. I’m still looking for answers.

  98. Rajan SP says:

    Dear Aaron,

    I have a Lenovo laptop which has Vista O/s in it.  It’s a Pre-Installed Version.  Recently i noticed that i’m facing a strange problem,

    that i’m unable to delete/move files inside a folder in D Drive.

    I have two folders in D Drive.

    1. Program Files

    2. Others

    I’m able to create/delete/move/copy files or folders into "Others" folder.  Were as i don’t have permission to

    delete/move/add new file or folders to the "Program Files" folder in D Drive.

    I found your blog discussing about similar issue(s).  I tried even installing "SubInACL tool" but that hasn’t helped me.  

    Is there any specific method/way to get rid of this problem.  I’m facing this for more than 2 months.

    Thanks for any help.

    Regards,

    Rajan.SP

  99. Hi Rajan SP – The SubInAcl command lines listed in this blog post only change permissions on the system drive (the drive letter that you have Windows installed to).  If you don’t have Windows installed to your D drive, then those command lines will not help.

    You can try one of the following to see if they help in this scenario:

    1.  Update the command lines listed above to cause SubInAcl to modify permissions on your D drive instead of %programfiles% and %windir%

    2.  Manually change the permissions for the folder that you’re having trouble with by right-clicking on the folder and choosing Properties, then Security, then clicking the Edit button and adding the users/groups that you want to have permission to this folder

  100. Rajan SP says:

    Hi Aaron,

    Thanks for your reply.

    But i’m unable to get rid of the problem.

    I tried changing the Command line to "D:Programfiles" but i am getting the following error

    SetKernelObjectSecurity Error for the folder.

    When i tried to run the command for other folders

    ie. "D:Others", i am not getting this error.

    Also i tried changing the security setting by right clicking, but that doesn’t helped me either.

    Please help me solve this problem.

    Regards,

    Rajan.S.P

  101. Hi Rajan SP – If you are getting an error message like the SetKernelObjectSecurity error you describe, it likely means that the command line you’re passing to SubInAcl isn’t exactly correct.  When you install the SubInAcl tool, it also installs a readme HTML file in the same directory as the tool.  I’d suggest reviewing the contents of that readme to see the exact syntax you need to use for updating the security permissions on this folder.

    If you are unable to get SubInAcl to work and also are unable to get the security permissions to change by using Windows Explorer, then I’m not sure what else to suggest.  You may want to post a question to one of the Windows Vista newsgroups or contact your computer manufacturer for more in-depth troubleshooting assistance.

    I’m sorry I haven’t been able to be more helpful in this scenario.

  102. balaji7u says:

    Hi Aron,

    I’m facing the same problem of update error 80070005 (I’m using vista ultimate).

    I’ve tried as per above instruction.

    First downloaded the Subinacl, then installed in c:Program FilesWindows Resource KitsTools

    then copied the commands as reset.cmd then i run this file as adminiatrator.

    An dos window prompted and started resetting the ACL. This has started y’day evening 8pm still it’s going on, nearly 45 million registries have been modified and aroung 36 registries failed.

    I want to know how long it’ll take to complete the resetting and regarding failed registries what i’ve to do.

    Kinldly advice.

    Thanks/Balaji

  103. Hi Balaji7u – The time it takes to run the SubInAcl tool depends on how many files, folders and registry values it needs to process (which is specified by the command lines you pass in when you run it).  If you are getting that many errors, it doesn’t sound like it is running correctly though.  I’d suggest trying to run it from an elevated cmd prompt instead of right-clicking and trying to run it as administrator that way.  Step 2 in this blog post will allow you to launch an elevated cmd prompt.

    Also, if your issue is happening while installing OS updates on Windows Vista, there are a couple of other things I’d suggest trying before resorting to using SubInAcl:

    1.  Try to install Windows Vista SP1 if you haven’t already.  It contains many fixes for the OS update installation engine on Vista, but it may not install correctly either if you’re already having trouble installing OS updates.

    2.  Try the System Update Readiness Tool described at http://support.microsoft.com/kb/947821.

  104. balaji7u says:

    Hi Aron,

    Thank you for your reply.

    In continue to my above post, it took totally 17 hours to modify the registries. finally it shown as

    done:5536543, modified:5536500, failed: 42, syntx error: 0.

    and a pop up window appeared saying as ‘subinacl stopped working’

    Pls advice what i’ve to do now.

    I’ve installed vista SP1 one month back. after that i’ve changed my anti virus from Norton to Mcafee. After this only the updates are not getting installed.

    Pls help to resolve this.

    Thanks / Balaji

  105. Hi Balaji7u – If SubInAcl crashed, it probably did not complete the actions in the command lines that you ran.  There are a couple of things I’d suggest trying next:

    1.  Manually update the permissions for the files/registry that are currently giving you the 0x80070005 error messages.  Usually, there will be log file entries or event log entries that specify exactly what files/registry you are getting access denied from.

    2.  Try the Windows Vista SP1 support site for more in-depth troubleshooting assistance.  You can find contact information for this at http://support.microsoft.com/oas/default.aspx?ln=en-us&prid=11274.

  106. andreboy says:

    Hi,

    I’ve bought a new laptop last year and haven’t been able to download itunes because I get the following error-

     The installer has insufficient privileges to modify this file: C:programFilesItunesItunes.Resourceszh_TW.lprojYahooLicense.rtf.

    I was using the Itunes message boards for help and was directed to your tool.  I tried to run it but I got the following message-

     subinacl’ is not recognized as an internal or external command, operable program or batch file

    Would this tool help fix my problem?  If so, could you help me use your tool correctly?

    Thanks

  107. lrios80 says:

    Hi Aaron,

    Sorry if this is the wrong place for this, but it seemed related.

    I was having problems getting a program running on 64 bit Vista due to an issue that I’ve seen where the registry has no users listed as having access to the registry. (The issue is described here: http://www.brianpeek.com/blog/archive/2007/11/29/weird-vista-registry-issue.aspx)

    I know someone else who had this same issue and was told by a Microsoft rep to install subinacl to c:WindowssysWow64 and to save the batch file to the same location. This was the content of the file:

    @echo off

    subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f

    subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f

    subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f

    subinacl /subdirectories %SystemDrive% /grant=administrators=f

    subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=system=f

    subinacl /subkeyreg HKEY_CURRENT_USER /grant=system=f

    subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=system=f

    subinacl /subdirectories %SystemDrive% /grant=system=f

    @Echo =========================

    @Echo Finished.

    @Echo =========================

    @pause

    When ran it, it started to work correctly, until I got an error stating that "subinacl.exe has stopped working", then the command prompt closed.

    Now, after rebooting, the program will start up fine, but the system audio, GoToMeeting, and Windows Mobile Device Center do not work. Also, Windows Explorer does not see the workgroup machines. I checked system restore, but it says that "System restore is not functioning correctly on this system"

    Sorry for the long post. I’d appreciate any help.

  108. Hi Andreboy – SubInAcl might be able to help for this type of installation error.  To run SubInAcl, you first have to download and install it, then you need to follow the exact steps listed in this blog post.  I’ve tried to make those steps as simple to follow as possible, and I’m not sure how else to explain them.

    Can you describe exactly what you tried when you ran it and got this error?  From the error, it sounds like either you didn’t yet install the tool, or it did not install to the expected location of c:Program FilesWindows Resource KitsTools.

  109. Hi Lrios80 – If you’re having the same issue as described at http://www.brianpeek.com/blog/archive/2007/11/29/weird-vista-registry-issue.aspx, then I’d suggest using the SubInAcl command lines listed in that blog post instead of the set that you listed.  If you had no users listed for permissions in these registry keys, then the commands you list will only grant the system account and Administrators group access to those keys, but they will not grant your user account access.  That can end up causing a lot of problems getting software to run correctly unless you run it as an administrator.  The command lines in that other blog post include steps to grant your user account permissions as well.

    Hopefully this will help in your scenario.

  110. herolegendmyth says:

    I tired using the SubInACl and all it did was restart my computer and cause all my files have the share icon on them, did I do something wrong? And how can get rid of all the share icon on all my folders?

  111. Hi Herolegendmyth – I’ve never heard of SubInAcl causing your system to reboot on its own.  I’m also not sure what you mean by a share icon.  You may want to try to restore back to an earlier system restore checkpoint to revert any changes that SubInAcl made to your system.

  112. CindyC says:

    Hi Aaron,

    Not sure if a non-techie should give this fix a whirl, but I’m pretty desperate. (Background – I’m working from the VISTA O/S – I am the administrator, but my kids also have accounts). I followed your instructions, (I had to download the zipped version).  After creating the reset command file, I get this when I type reset.cmd on my command prompt:

    C:Windowssystem32>reset.cmd

    C:Windowssystem32>cd /d "C:Program FilesWindows Resource KitsTools"subinacl

    /subkeyreg HKEY_CURRENT_USER /grant=administrators=f /grant=system=f /grant=res

    tricted=r /grant=Cindy=f /setowner=administrators  /keyreg HKEY_CURRENT_USER /gr

    ant=administrators=f /grant=system=f /grant=restricted=r /grant=Cindy=f /setowne

    r=administrators  /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f /grant=s

    ystem=f /grant=users=r /grant=everyone=r /grant=restricted=r /setowner=administr

    ators  /keyreg HKEY_LOCAL_MACHINE /grant=administrators=f /grant=system=f /grant

    =users=r /grant=everyone=r /grant=restricted=r /setowner=administrators  /subkey

    reg HKEY_CLASSES_ROOT /grant=administrators=f /grant=system=f /grant=users=r /se

    towner=administrators  /keyreg HKEY_CLASSES_ROOT /grant=administrators=f /grant=

    system=f /grant=users=r /setowner=administrators  1>>C:UsersCindyAppDataLoca

    lTempsubinacl_output.txt

    The filename or extension is too long.

    C:Windowssystem32>subinacl /subdirectories C:Program Files /grant=administra

    tors=f /grant=system=f /grant=users=e  1>>C:UsersCindyAppDataLocalTempsubi

    nacl_output.txt

    ‘subinacl’ is not recognized as an internal or external command,

    operable program or batch file.

    C:Windowssystem32>subinacl /subdirectories C:Windows /grant=administrators=f

    /grant=system=f /grant=users=e  1>>C:UsersCindyAppDataLocalTempsubinacl_o

    utput.txt

    ‘subinacl’ is not recognized as an internal or external command,

    operable program or batch file.

    C:Windowssystem32>

    I’ver read through this blog and didn’t see anyone else post this kind of problem (although it’s a pretty long blog).

    If you can offer any suggestions, I’d really appreciate it. I’m sorry if I’m wasting your time with this…

    Cindy

  113. Hi CindyC – From the output that you listed, it looks like the commands are all being listed on a single line instead of on separate lines.  That is causing the cmd prompt to run all of them at once, which will give errors.  Can you open your reset.cmd in notepad and make sure that each command is on a separate line by pressing enter at the end of each of them, then try running the reset.cmd script again?

  114. DFradeneck says:

    Just wanted to pop in and say thanks for the great fix.  My parents (and my resulting sanity at not hearing "Come over and fix our computer!") thank you!

  115. Susan052 says:

    Thank you so much for this SubInACL fix.  I have a MS Vista Home Premium operating system and I was getting the 80070005 error and the automatic updates just stopped.  I downloaded the SubInACL and followed the directions explicitly, retried updates and it worked perfectly.  It feels risky entering code without understanding, but I’ll just add that to the list of everything else I just have to trust!  I’ve bookmarked your blog and am going to pass it on to my kids who will be thrilled that I didn’t call them to solve my problem.  Thank you Aaron.

  116. AbZu says:

    OS XP Pro SP2

    DotNet VersionCheck Utility confirms that no version of .NET Framework is installed. Attempting to install any version of .NET including .NET 1.0 fails always for basically the same reason. Failure to access a registry key in HKEY_LOCAL_MACHINESOFTWAREMicrosoftActive SetupInstalledComponents. Logged in as Administrator, permissions have been given full control as Admin and even as Everyone fo that specific tree starting from HKEY_LOCAL_MACHINESOFTWAREMicrosoft. Running the Subinacl cmd as mentioned in this blog unfortunately fails to solve the issue.

    Attempting to install .NET 1.0 after have set Full Control returns the following error:

    Error 1402. Could not write value Locale to key SOFTWAREMicrosoftActive SetupInstalledComponents{78705f0d-e8db-4b2d-8193-982bdda15ecd}.

    Verfiy that you have sufficient access to that key

    Attempting to install .NET 1.1 after have set Full Control returns the following error:

    Error 1406. Could not write value Locale to key SOFTWAREMicrosoftActive SetupInstalledComponents{CB2F7EDD-9D1F-43C1-90FC-4F52EAE17A1}.

    Verfiy that you have sufficient access to that key, or contact your support personnel

    The mentioned keys do not exsist and I assume are being created during the installation process.

    All installed security programs that have been closed or disabled prior to installation of .NET.

    ESET NOD32 Antivirus

    Greatis RegRun

    Comodo Firewall

    Comodo BOClean

    installed security programs active but not disabled:

    Spybot

    Spyware Blaster

    Malwarebytes Anti-Malware

    I don’t know if attempting to install .NET 1.0 in Safe mode would solve the problem, but would like to get some feedback on that process before proceeding. Any other ideas would be most welcome. TIA

  117. Hi AbZu – When Windows Installer creates registry values, it is running with the permissions of the local system account.  It is not enough to just add the Administrators group to the permissions list for this registry key to solve this 1402 or 1406 error.  I would suggest adding both the Administrators group and the local system account, granting them full control, and making sure to allow these permissions to be inherited by sub-keys to see if that will solve this issue.

    Some of the command lines for SubInAcl listed above in this blog post will accomplish that for you if you’d prefer to use that tool instead of trying to set these permissions manually.

  118. mcooksb says:

    Many thanks.

    "How to download and run SubInACL" worked for me with an installation error message.

    The msconfig startup suggestion did not work.

    Your mitzvah for the day.

    M.

  119. dharamg says:

    I am unable to install vista sp2, so I followed the instructions given by MS and installed the subinacl file. On running the reset file, I got an error in the cmd line for each cmd saying "subinacl is not recognised as an internal or external command". I have vista 64 bit and have admin rights. Please let me know why this error has occured.

    Based on a mail from a Microsoft Vista professional from Microsoft support site, I also downloaded and ran the System Update Readiness tool which didnt solve the problem and also tried  downloading the Standalone Installer and installing it in Clean Boot Mode. But Vista sp2 still does not install and I got error "The specified service does not exist as an installed service." 0x80070424.

    Can someone help me.

    Thanks

    Dharam

  120. Hi Dharamg – The reset.cmd script currently doesn’t work on 64-bit operating systems.  I can post a fix later, but in the meantime, all you need to do is change the item that says %ProgramFiles% to say %ProgramFiles(x86)% instead and then it should run correctly.  The error you see about "subinacl is not recognized…" means that the full path listed for subinacl.exe in reset.cmd doesn’t match the location that it is actually installed on your system.

    Please note that the error you are getting about a service not existing is probably not going to be solved by running SubInAcl though.  I found a blog post at http://whatsonmypc.wordpress.com/2009/06/09/vistasp2-2/ that has several good troubleshooting options for Vista service pack install issues.  I’d suggest trying out the support links listed in there to see if any of those are helpful to you.

  121. Musashi says:

    I’d like to say a big thank you for this guide, which is a bit more comprehensive than the original Microsoft article for this.

    -ISSUE HISTORY-

    I was having serious problems with my work PC running Windows XP Pro SP2, ever since it was migrated from a workgroup to a domain which I can only assume was down to registry permissions and keys having been corrupted.  I had already resigned to the fact I would need a complete reinstall of my operating system to sort the issues after spending many many hours fruitlessly attempting to resolve the issues, from guides on all sorts of other websites.

    The problems I had been experiencing included the following:

    – Service Pack 3 failing to install, along with all other updates dependant on this.

    – Excel 97 and 2000 crashed whenever trying to run workbooks with macros in them, often saying something about the Excel8.olb missing, although it was in the correct folder with the right permissions.

    – Access 97 crashed whenever you tried to run it.

    – InstallShield Professional 6.3 was failing to compile certain builds, saying that a component was missing, when other near-identical builds were fine.

    – Some VPN packages would not run remote desktop displays, possibly due to SP3 failing to install.

    – Many MSI install packages would fail to install.

    – Several different software packages my company produce would no longer run on my PC.

    I had previously tried to check and edit registry permissions manually after seeing the failures in the Service Pack 3 install log, however this failed suggesting corrupt registry keys which I had no access to and was not allowed to take ownership of despite being an admin on the PC.

    Running these bits of code through subinacl has sorted ALL of these problems!

    I joined this site so I could post this; hopefully it will help others who have experienced similar problems to me!

    Many thanks,

    ~ Iain

  122. daviddemarneffe says:

    After running the reset.cmd script, my problem with Windows update was resolced. However, I started having issues with my audio: red cross in the notification area and a "no audio device is installed" message whenever I was trying to open the volume mixer. I checked that the drivers were OK and reinstalled the latest versions, and all the usual fixes recommended on the net for this issue, when I finally stumbled upon this: http://blogs.msdn.com/larryosterman/archive/2009/01/06/fixing-a-customer-problem-no-audio-device-is-installed-when-launching-sndvol-on-windows-vista.aspx

    Matter of fact, I also did not have Audiosrv and AudioEndpointBuilder listed in the permissions of my MMDevices registry keys. I never managed to add them back, but I gave full permission to Everyone on these keys and that fixed the problem. Was this possibly caused by the reset.cmd script?

  123. Hi Daviddemarneffe – It is possible that SubInAcl indirectly caused this type of problem.  I have heard of some sporadic cases where on Vista, somehow some parts of the registry end up with entirely blank permissions (which is the equivalent of everyone having unlimited access).  This is described in a bit more detail at http://www.brianpeek.com/blog/archive/2007/11/29/weird-vista-registry-issue.aspx.  If that happened on your system and then you ran SubInAcl using the commands in reset.cmd, it would have added permissions for the SYSTEM account, the Users group and the Administrators group, and by virtue of adding those permissions to a key that previously had blank permissions, it would have removed permissions that might have inadvertantly been there previously.

    The SubInAcl commands listed in this blog post do not do anything with those 2 audio service items listed in Larry Osterman’s blog post.  The SubInAcl commands here don’t specifically remove an ACLs that are already set, but if you ended up in that weird state with blank permissions, it could seem like it removed permissions.

  124. Richard Westlund says:

    Hi, After searching for hours, I stumbled upon your site.  I have DLed and followed ´as best as I could´ the instructions to no avail and quite frankly, I am not a ´network´guy, so I will ask you to let me know if I am even looking in the right place for my solution.

    I changed from simple file sharing, to a permission based share on some private folders (kids at the curious age and a few connections throughout the house/office).

    While testing I UNCHECKED the permissions to ´everyone´ and now I cannot access the folder as admin or any other means on the local machine (forget about the network obviously).  Is there a solution for this?  Is this tool the solution?

    I thank you for the information and I thank you in advance for any assistance.

    Richard

  125. JodyRoody says:

    Installed the Subinacl and followed directions.

    Maybe I am copying tooo much of the reset contents that you provided? I removed the YOURUSERNAME in two locations and created a new .cmd file.

    Still, the results are;

    file too long not recognize internal or external.

    Where am I going wrong?

    Thank you

  126. Hi Richard Westlund – I’m not sure if the SubInAcl steps listed in this blog post will help solve the issue you describe.  It modifies a lot of permissions on the system, but only in specific locations that tend to cause problems with product installations (such as the Windows directory or Program Files).  The steps in this post do not change permissions on any private user folders.  You might be able to use the information in the readme that is installed to the same directory as the SubInAcl.exe tool to figure out an alternate set of command lines that will let you fix the permissions that you need to reset in your scenario.

  127. Hi JodyRoody – It sounds like you are trying to run all of the commands in a single line instead of one by one.  It might help to try to download and run the reset.cmd from my file server instead of typing in the commands yourself.  You can find that at http://cid-27e6a35d1a492af7.skydrive.live.com/self.aspx/Blog%7C_Tools/reset.cmd.txt.

  128. luv1another says:

    thankyou soooooo much.

    I have been having stupid script problems and was unable to access user control settings and a few other things. I tried this after trying heaps of other fixes and wow it worked. thankyou.

    I came across your site from here…

    http://forums.techarena.in/windows-xp-support/956284.htm

  129. Mj&#246;lnir @ PCPerspective.com says:

    ** CORRECTED AND TESTED **

    Hi Aaron,

    Gotta say I love this tool. It sees action at least once a week.  "Unrecognised USB Device", Flash Player not installing, etc, etc.

    I've gotten sick of having to enter the username every time, so I've modified the batch file to automatically grab the username.  As you know, the %username% variable flakes out when spaces are used (eg. "My Username" would only return "My") and the Display Name doesn't work at all.

    The modified code also includes the server name, which should work for PC's on a domain or workgroup and also standalone PC's.  It works by separately grabbing the USERNAME and USERDOMAIN values out of the registry.  If either one don't exist, it reverts to the values of their respective alternatives:

    [HKCUSoftwareMicrosoftWindowsCurrentVersionExplorer]"Logon User Name"

    [HKCUVolatile Environment] "LOGONSERVER"

    I haven't tested this on domain PC's, but it should work except perhaps when using Roaming Profiles, particularly when the logon servers vary from one session to the next.

    My Modified code:

    @echo Off

    title SubInACL

    cls

    REG Query "HKCUVolatile Environment" /v "USERNAME" >nul 2>&1

    IF %ErrorLevel%==1 GOTO NM2

    IF %ErrorLevel%==0 GOTO NM1

    :NM1

    FOR /F "tokens=3*" %%f in ('REG QUERY "HKCUVolatile Environment" /v "USERNAME"') DO SET unm=%%f

    REG Query "HKCUVolatile Environment" /v "USERDOMAIN" >nul 2>&1

    IF %ErrorLevel%==1 GOTO DM2

    IF %ErrorLevel%==0 GOTO DM1

    :NM2

    FOR /F "tokens=3* DELIMS= " %%f in ('REG QUERY "HKCUSoftwareMicrosoftWindowsCurrentVersionExplorer" /v "Logon User Name"') DO SET unm=%%f

    REG Query "HKCUVolatile Environment" /v "USERDOMAIN" >nul 2>&1

    IF %ErrorLevel%==1 GOTO DM2

    IF %ErrorLevel%==0 GOTO DM1

    :DM1

    FOR /F "tokens=3*" %%e in ('REG QUERY "HKCUVolatile Environment" /v "USERDOMAIN"') DO SET srv=%%e

    GOTO RSTACL

    :DM2

    FOR /F "tokens=2* DELIMS=" %%e in ('REG QUERY "HKCUVolatile Environment" /v "LOGONSERVER"') DO SET srv=%%e

    GOTO RSTACL

    :RSTACL

    if "%PROCESSOR_ARCHITECTURE%"=="x86" if "%PROCESSOR_ARCHITEW6432%"=="" goto x86

    set ProgramFilesPath=%ProgramFiles(x86)%

    goto startResetting

    :x86

    set ProgramFilesPath=%ProgramFiles%

    :startResetting

    cd /d "%programfiles%Windows Resource KitsTools"

    echo.

    echo.

    echo Resetting ACL's.  This may take several minutes.

    echo.

    subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f /grant=system=f /grant=restricted=r /grant="%srv%%unm%"=f /setowner=administrators > %temp%subinacl_output.txt

    echo.

    subinacl /keyreg HKEY_CURRENT_USER /grant=administrators=f /grant=system=f /grant=restricted=r /grant="%srv%%unm%"=f /setowner=administrators >> %temp%subinacl_output.txt

    echo.

    subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f /grant=system=f /grant=users=r /grant=everyone=r /grant=restricted=r /setowner=administrators >> %temp%subinacl_output.txt

    echo.

    subinacl /keyreg HKEY_LOCAL_MACHINE /grant=administrators=f /grant=system=f /grant=users=r /grant=everyone=r /grant=restricted=r /setowner=administrators >> %temp%subinacl_output.txt

    echo.

    subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f /grant=system=f /grant=users=r /setowner=administrators >> %temp%subinacl_output.txt

    echo.

    subinacl /keyreg HKEY_CLASSES_ROOT /grant=administrators=f /grant=system=f /grant=users=r /setowner=administrators >> %temp%subinacl_output.txt

    echo.

    subinacl /subdirectories %ProgramFilesPath% /grant=administrators=f /grant=system=f /grant=users=e >> %temp%subinacl_output.txt

    echo.

    subinacl /subdirectories %windir% /grant=administrators=f /grant=system=f /grant=users=e >> %temp%subinacl_output.txt

    cls

    echo.

    echo.

    echo Finished.

    echo.

    echo Press any key to exit . . .

    pause >nul

  130. Danny says:

    This is AWESOME.  I hope others who have this problem finds this page.  Microsoft needs to take a look at this.

  131. Maggie says:

    Hey! Thank you so much .. you can be proud of yourself …you just helped a psychologist to solve an IT problem 😀

  132. Julian says:

    WELL done !..

    Thanks, after a week of struggle. all is working 😀 (on a windows 7 machine non the less)

  133. Jim says:

    I installed the application on a laptop running XP SP3, changed the username in the script to match the name in 'C:Documents and Settings' for my account (which has Administrator priveleges), saved and then ran the editited script.  The output text file is really large (710 Mb!), and starts with the identification of a specific call to a user name which isn't exactly correct (following text):

    LookupAccountName : HKEY_CURRENT_USER:james 1337 The security ID structure is invalid.

    Current object HKEY_CURRENT_USER will not be processed

    LookupAccountName : HKEY_CURRENT_USER:james 1337 The security ID structure is invalid.

    Current object HKEY_CURRENT_USER will not be processed

    : delete Perm. ACE 1 builtinadministrators

    : new ace for builtinadministrators

    : delete Perm. ACE 0 nt authoritysystem

    : new ace for nt authoritysystem

    : new ace for builtinusers

    : delete Perm. ACE 0 everyone

    : new ace for everyone

    : delete Perm. ACE 0 nt authorityrestricted

    : new ace for nt authorityrestricted

    : builtinadministrators is the new owner

    ————–

    I haven't finished scrolling through much of the output file but found only one instance of an "unable to find" error message so I'll have other questions, but for starters how do I interpret the above error?  I searched the Registry on a lower-case "james" after the combination "james 1337", and while the latter got no hits at all, the former always turned up only those with a capital "J" in the "James Vance" entries through that were legitimate.  I don't whether the subinacl output found an accurate reference because of the lower-case text, or a ghost of some sort that's completely unrelated to the issue I was hoping to address by running the application — some sort of "permissions" issue with 16-bit programs which arose earlier in the year and remains unfixed following the application's run.

    FWIW, the initial Command window progress bar noted "3 errors" for the initial screen function reported, so I may or may not have accounted for all of those in describing the output.  Is that error message above (and its reference number "1337") significant in some manner?  What might I do to "correct" the invalid security ID structure or remove the ghose of "james 1337" from the system?

  134. Nico says:

    Hi there,

    can anyone tell me the correct translation for "restricted" into german? I tried different translations, but nothing works … I'm running a german Windows-Version, so I need to translate the command lines.

    Thanks alot

  135. Hi Jim – I'm not sure how to explain those errors that are referring to "james 1337" in your output.  I'd suggest trying to use the version of the script that Mjölnir @ PCPerspective.com posted a few weeks ago in one of the comments on this thread and see if it helps correctly resolve your user name.

    Hi Nico – I don't know what the correct translation is for the RESTRICTED account in the German version of Windows.  You may be able to find it by looking at some of the existing permissions in the registry and file system on your computer in regedit.exe or Windows Explorer though.

  136. Linda says:

    I was really scared to try this but I had something wrong with my computer and I had to open Windows Media Player using "run as administrator" and I couldn't upgrade and numerous other problems.  I wanted to download audio books from OverDrive but WMP gave me errors when I tried the security update. I followed your instructions carefully and it took about 1/2 hour of the program to run.  When it finished, I tried all the programs that were giving me problems and they worked! I was able to get the security update and download my audio books.  It's so fantastic!! Thank you so much! I was going to burn all my stuff to DVDs and reformat my computer because I didn't know what else to do to fix it. It has saved me multiple hours (probably days) of work!  🙂

  137. Dene says:

    thank you fixed my "Could not open key: HKEY_LOCAL_MACHINESoftwareClassesInterface{Whole bunch of numbers}ProxyStubClsid" when trying to update itunes

  138. toneweaver says:

    We were trying to install a renewal update of McAfee and Windows showed that it was installing "Microsoft Office Professional Hybrid" — we stopped the install, but now Office won't work. Will SubACL work for this? We're running Vista SP1.

  139. Hi Toneweaver – I don't know if SubInAcl will work for this type of issue.  What exact errors do you see when you try to run Office?  Does it help to try to repair Office using the entry in the Programs and Features control panel?

  140. Kinnikuchu says:

    I am having problems with my registry.

    I am using Windows Vista Home Premium 32bit

    I'll explain:

    Trying to install somes plugins for an Audio software, I changed in "Regedit" the permission of "HKEY_LOCAL_MACHINESOFTWAREClasses"

    After changing that my computer became very strange.

    For example:

    I can't see anything in the regular Control Panel of Vista, I have to select Classic Mode.

    Many programs that appear when I right clicked on a file are missing.

    The icons of the Hard Drive had changed and the DVD Drives now says "CD"

    I can't copy anything into one of my external Hard Disk

    My Messenger is not working.

    The Windows Update is not working either.

    It seems that when I changed the permission, it all became a mess.

    I dont have a back up registry file nor a restore in time.

    This process you describe will help me to solve my problem?

    Please I ask for help for a solution to my problem. I am desperate.

  141. Hi Kinnikuchu – This type of issue is an example of why it is very important to make a backup of your registry before making this type of change.  The information under HKLMSoftwareClasses is used by many places in Windows and by many applications, so changing permissions to that can be particularly damaging.

    Normally, the Administrators group and the local system account have full control over that sub-key and all of its children, and the Users group has read permissions.  Some of the example SubInAcl command lines in this blog post will set those permissions for this key, so these steps might help solve some of these issues on your computer.  You could also try to manually update the permissions that you previously changed while trying to install those audio plug-ins.

  142. Kinnikuchu says:

    Hi,

    Im just writing this message to thank you for posting this magnificent solution.

    I was able to solve all of the issues I had. Now my computer is working as good as new.

    Now I have learned the lesson to never mess with the registry or with regedit.exe

    To always have a registry backup and a point in the Windows Restore.

    Many thanks for this post!

    BTW; I was capable of backing up all my files to my external hard drive before doing this process. I was doing it wrong at first but then I figure out how to do it right 🙂

    Thanks you///

  143. Toly says:

    My problem started from me not being able to access "User Accounts" from the Control Panel. It would give me a internet explorer error, (with the error name and location being all blank" asking me if I wanted to proceed. Clicking "yes" or "no" was futile, nothing would get me past that error screen. So I tried to update IE from 7 to IE 8 hoping that would solve the problem. But I get getting "installation failed" errors. Finally upon coming to this page and following the thorough instructions….. IT WORKS !!!!!!  THANK YOU !!

  144. joel45 says:

    Hey! Great advice! I have a slight problem however. I get to step 7 and it comes up with an error saying that I don't have permission to save in that location and to contact my administrator to obtain permission. I have tried everything from turning off my UAC to changing the security preferences on my C drive to give me all permissions. Someone please help asap!

  145. Hi Joel45 – What is the exact location you are trying to save the file to in step 7?  Does it help to download the copy of that file from my file server instead (using the link in step 5)?

  146. Kursat says:

    hi.. i've some trouble with Installing IIS on Windows Server 2008 Standart Edition/Enterprise Edition 32bit/64bit, thats to say all..

    i tried three different hardware but each time a got the same result, the computer freezes..

    i waited in once about 4hours but nothing gonna happened..

    i thought it could be for the same reason which was meintoned on this blog.

    could it be?

    Besides, i cannot uninstall Microsoft Office 2010 Professional x64, and tried to steps meintoned above but nothing gonna happens..

    it fails, img214.imageshack.us/…/aclfix.png

  147. Hi Kursat – Without more details about the exact errors that you're seeing, it is hard to say whether or not it is a file/registry permission problem causing the errors that you're seeing.  Do you have any more detailed error messages in your application event logs from these scenarios, or any log files from the failing installations that you can share?

    Also, the screenshot you provided shows zero errors, so I'm not sure I understand what is failing in that scenario.

  148. nacnudcw says:

    I tried this on my Windows 7 system to see if it would resolve my install issues with Quicken Home & Business 2020 (Error 1935).  I received many "Access is denied" errors during the run of SubInACL.  Here is a sample:

    HKEY_LOCAL_MACHINESOFTWAREClassesAccDictionary.AccDictionaryCLSID – RegSetKeySecurity Error : 5 Access is denied.

    I tried to install Quicken H&B again but got the same error 1935.

  149. Vinay28 says:

    Hi Aaron

    I downloaded and ran SubInAcl because I was having problems with Adobe Acrobat Installer and its uninstallation. Surprisingly, running SubInAcl and reset.cmd not only enabled complete uninstallation of Acrobat but also enabled uninstallation and reinstallation of Windows Live Essentials, which was giving me all sorts of problems. What's more Windows Media Player 11, which had stopped showing video, has started working properly again.

    However, Adobe Reader 9.4.0, which I still had, failed to open pdf files after uninstallation of acrobat. I am working on it now.

    Many thanks.

  150. Hi nacnudcw – Can you confirm that you're running SubInAcl from an elevated cmd prompt in your scenario?  If you are and you're still getting access denied errors, you may need to go to regedit.exe and manually take ownership of the registry key(s) that are getting this error and update the permissions there instead of using SubInAcl.

  151. Hi Vinay28 – You may want to try to contact Adobe technical support for more detailed troubleshooting assistance for the PDF opening issue that you're running into.

  152. Vinay28 says:

    Thank you Aaron. Apparently, my detailed post of yesterday has not got uploaded again even though I tried thrice. All my problems are solved, thanks to your help. However, I would have loved to get advice on two issues, namely (a) error 6 that occurred for the only failure I had after running SubInAcl and reset.cmd, a portion of the log of which I have given below and (b) the change in "installed on" date of many of the programmes in "programmes and features" of control panel to Oct 16, the day I ran SubInAcl.

    Done:   384383, Modified   384382, Failed        1, Syntax errors        0

    Last Done  : HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices{554C3BF9-CF6F

    -419D-80B4-C5D2B0CE526E}ParametersTcpip

    Last Failed: HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionPer

    flib09 – RegSetKeySecurity Error : 6 The handle is invalid.

    Thanks again & regards

    Vinay28

  153. Hi Vinay28 – The error code 6 can happen if some part of the OS is holding the registry key in use while SubInAcl is trying to update the permissions.  It is usually safe to ignore that type of error.  I suspect you would get the same type of error if you tried to manually update the permissions for that key in regedit.exe as well.

    I don't know what the control panel uses to figure out the "installed on" date for programs that it lists, so I'm not sure how to explain why it would have changed when running SubInAcl.  I'm sorry I don't have a better answer for you for that issue.  That should just be a cosmetic issue though – it doesn't actually affect the installation state of any program on your computer, so it should be safe to ignore.

  154. Vinay28 says:

    Many thanks Aaron. I guess I can work peacefully now.

    Best

    Vinay28

  155. redbeardedone says:

    Does this fix also include permissions on another drive? Data(D:) drive? Thanks!

  156. Hi Redbeardedone – The example command lines in this blog post do not change permissions on anything other than %programfiles% and %windir%.  You can use the SubInAcl tool to change permissions on whatever drives you want though.  After you install it, you can take a look at the HTML file that is installed with it to learn more about how to use the tool, what the command line parameters are, etc.  From there, you should be able to figure out how to create a command line that will update the permissions that you want to update on your computer.

  157. Rossmlg says:

    Hi aaron. Im having the 8007005 error when i try to download Vista SP2 32. And also my Windows Update will not allow me to update anything. Ive downloaded your tool and ran it twice but the problem presists. Any Idea on what i can do to fix this? Thanks.

  158. Hi Rossmig – It usually doesn't help to use SubInAcl to solve this type of Windows Update problem on Windows Vista and higher.  I'd suggest taking a look at the information and the tool in the blog posts at blogs.msdn.com/…/9472695.aspx and blogs.msdn.com/…/9303167.aspx.

    If the above information doesn't help, then I'd suggest contacting Microsoft technical support for more in-depth troubleshooting assistance.  You can find their contact information at http://support.microsoft.com.

  159. Richnitz says:

    Thank you so much for taking the time to help others solve their problems been dealing with this for about 4 months tried many different things and yours works the first time. Thank you! Thank You

  160. a formerly frustrated person. says:

    THANKYOU SO MUCH

    i had a problem with the 8007005 error then i went here to try this social.msdn.microsoft.com/…/b7d1a35f-3759-4217-91ba-e4416ac19d78     ….

    it turns out that script made me unable to open ANY FOLDERS with explorer.exe

    everytime i tried to open something it results in an error saying: not enough free memory to run program.

    also. the system sound and network connection showed that it was disabled, however the internet still works, YAY so i came across your site after a long search

    i had to use taskmanager (thank goodness it still work) to browse and open the reset.cmd and copied your script into it and ran it.

    in the end everything is fixed.

    happy holidays

  161. Ramaflore says:

    I'd like to have the script in french. Where to get it ?

    What do you understand by USERNAME in the script, all the users with Administrator's name ??

    In my case, I have 2 admin accounts and one user account. Do I have to set up for each accounts ?

    Need a reply, thanks !

  162. Hi Ramaflore – If you need a version of the script that runs correctly on French versions of Windows, you will need to make a copy of the original script and make the necessary modifications yourself.  I think some of the built-in account names (like "Administrators") will need to be translated into French but I'm not sure if anything else will need to change as well.

    The USERNAME value needs to be replaced with the account that you are logged in with.  There is a modified script posted by someone from PCPerspective.com in one of the earlier comments on this post that gives an example of how to determine the exact username value to use.

    The script will reset permissions for HKEY_LOCAL_MACHINE, which is used by all user accounts.  It will also reset permissions for HKEY_CURRENT_USER, which is only used by the currently logged in account.  If you want the script to reset per-user permissions for all accounts on the computer, you will need to make a copy of the original script and make the necessary modifications yourself.

  163. Dirk says:

    Hi astebner. I see in a previous post that this has worked successfully on a Windows 7 machine. I have also problems with Outlook 2007 and (in desperation) Windows Live Mail not showing up in Default Programs. I installed subinacl.msi, which, when I checked, puts subinacl.exe into the Tools folder. However, when I am running the reset.cmd file in the Administrator Command Prompt, it finishes very fast and results in a bunch of errors:

    "The file name or extension is too long."

    'subinecl' is not recognized as an internal or external command, operable program or batch file.

    I also cannot find a log file subinacl_output.txt.

    Merry Christmas and thanks

    (Not sure if this posted. My apologies if it is going to post twice)

  164. Hi Dirk – Could you send me a screenshot of the exact text that you typed into the cmd prompt and what the error is?  Also, can you confirm that the error that you listed is just a typo in the comments field on this blog post (you listed "subinecl" instead of "subinacl") and that you didn't try to run a program named "subinecl" on your computer?

  165. Sarah says:

    Hello, I've followed your instructions and I was not successful in installing my Windows Vista service pack 2. I

    Looked at the subinacl_output and I get this message (followed by a looong list of codes:

    LookupAccountName : HKEY_CURRENT_USER:sarah 1337 The security ID structure is invalid.

    Current object HKEY_CURRENT_USER will not be processed

    However, I thought my user name wasn't sarah but Sarah Ancellotti, which is what I've typed in the reset.cmd file…

    Should I try and change it to sarah?

    Kind regards,

    Sarah

  166. Hi Sarah – The user name that you use for these commands should be the same as what you use on the Windows login screen.  If you have a space in your user name, then you will probably need to put quotes around it in the command lines that you use to run subinacl.exe.

    I'm not sure that subinacl will help solve issues installing Windows Vista service packs though.  To solve that type of issue, I usually recommend the steps and tool listed at blogs.msdn.com/…/9472695.aspx.

  167. DH says:

    THANK YOU FOR THIS!!!!!

    I have been struggling for months trying to get MS Office to install and run and it was ALWAYS configuring itself on startup. I've tried every suggestion even mentioned in any of the MS Community threads all to no avail. I tried this last night and immediately everything started working correctly!!!!!!!!

  168. Roxy says:

    Hi 🙂

    Great information here, although I seem to be having the exact same problem as Dirk. I didn't make a typo though. It basically told me it could not operate the subinacl file. 🙁 My running system is Vista… I don't see where Iv'e gone wrong!

  169. Hi Roxy – Can you double-check that you've downloaded and installed the SubInAcl tool to the default location?  Also, can you post a screenshot so I can see the exact text that you typed into the cmd prompt and what the error is?

  170. Roxy says:

    Ah ha! I think I may have un covered a little break through here… was reading the website on which you can download the subInAcl.exe file… and under system requirements Vista is not listed… is this a possible set back?

  171. Hi Roxy – The SubInAcl tool will install and run correctly on Windows Vista (I've heard from many people who have tried this and had no issues).  The reason that Windows Vista is not listed on the download page for SubInAcl is that this tool was posted before Windows Vista existed.  They typically do not go back and refresh the information on the download pages for previously released tools when new versions of Windows are released.

  172. Reelix says:

    From the CMD window whilst running:

    Done:   373109, Modified   316422, Failed    56687, Syntax errors        0

    Oh gawd…

  173. Hi Reelix – There will always be some errors when running this tool due to things like registry keys being held in use by other applications on your computer.  Most of the time, those types of error can be safely ignored.

    Also, if you are on Windows Vista or higher, make sure that you are running the tool from an elevated cmd prompt so it will have the proper permissions to make changes to your registry.

  174. Steve says:

    I'm having the same issue that Cindy posted in Dec 2008.  Made sure all the commands are on their own line – same result.  I'm running Vista 32-bit.

    Microsoft Windows [Version 6.0.6002]

    Copyright (c) 2006 Microsoft Corporation.  All rights reserved.

    C:Windowssystem32>reset.cmd

    C:Windowssystem32>cd /d "C:Program FilesWindows Resource KitsTools"subinacl

    /subkeyreg HKEY_CURRENT_USER /grant=administrators=f /grant=system=f /grant=res

    tricted=r /grant=Steve Tesdahl=f /setowner=administrators  /keyreg HKEY_CURRENT_

    USER /grant=administrators=f /grant=system=f /grant=restricted=r /grant=Steve Te

    sdahl=f /setowner=administrators  /subkeyreg HKEY_LOCAL_MACHINE /grant=administr

    ators=f /grant=system=f /grant=users=r /grant=everyone=r /grant=restricted=r /se

    towner=administrators  /keyreg HKEY_LOCAL_MACHINE /grant=administrators=f /grant

    =system=f /grant=users=r /grant=everyone=r /grant=restricted=r /setowner=adminis

    trators  /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f /grant=system=f /g

    rant=users=r /setowner=administrators  /keyreg HKEY_CLASSES_ROOT /grant=administ

    rators=f /grant=system=f /grant=users=r /setowner=administrators  1>>C:UsersST

    EVET~1AppDataLocalTempsubinacl_output.txt

    The filename or extension is too long.

    C:Windowssystem32>subinacl /subdirectories C:Program Files /grant=administra

    tors=f /grant=system=f /grant=users=e  1>>C:UsersSTEVET~1AppDataLocalTemps

    ubinacl_output.txt

    'subinacl' is not recognized as an internal or external command,

    operable program or batch file.

    C:Windowssystem32>subinacl /subdirectories C:Windows /grant=administrators=f

    /grant=system=f /grant=users=e  1>>C:UsersSTEVET~1AppDataLocalTempsubinac

    l_output.txt

    'subinacl' is not recognized as an internal or external command,

    operable program or batch file.

    C:Windowssystem32>

  175. Hi Steve – It doesn't look like the commands in your reset.cmd script are running correctly.  The command to change directories in the first line never worked – you can see that because the directory in your cmd prompt stayed "c:windowssystem32", but that is not the location that subinacl.exe gets installed to when you install that tool.

    What does your reset.cmd file look like?  Also, could you take a screenshot of the cmd prompt when you run reset.cmd and upload it so I can take a look?

  176. Steve says:

    sure – what do I need to do to upload files?

  177. Hi Steve – You can upload the files to a file server of your choice (such as http://skydrive.live.com) and then reply back here and post links to the file server that I can use to download the files.

  178. Tez says:

    Aaron,

    I'm new to this process, so hope it works.  Here's the link:  cid-ad045636eb442e2e.skydrive.live.com/redir.aspx!102&authkey=vO*sduxCv1A%24

    Thanks!

  179. Hi Tez – Your screenshot shows all but the last 2 lines of reset.cmd concatenated together, and there is an error saying "the filename or extension is too long."  That means it is attempting to run all of those lines as a single command.  I'm not sure why it is doing that though.  Your reset.cmd looks OK, except for one thing – you've got a space in your user name, so I think you'll need to put that in quotes.

    You may need to try running each line in reset.cmd individually by copying and pasting it into your cmd prompt instead of trying to run them all via reset.cmd to solve this.

  180. Tez says:

    Aaron,

    Took your advice and ran each line individually.  Everything worked fine, with the exception of the third command having 675 failures and 5 access denied (along with 482,441 successful).  That said, my gremlins have not gone away as each time I receive or send an Outlook message I'm getting the annoying "Please wait while Windows configures Microsoft Office Ultimate 2007", following shortly thereafter by "Windows installer stopped working and was closed"  Any other words of wisdom?  Thanks for your help!

  181. Hi Tez – In this case, I don't think the SubInAcl tool is what you need to use to solve the issue.  There are a couple of things I can think of to try:

    1.  Try to launch Outlook with elevated permissions and trigger the configuration dialog again.  It might complete successfully if it is run from an elevated process.

    2.  If #1 doesn't help, then you may want to try to manually run a repair for Microsoft Office by using the entry in the Programs and Features control panel.

    3.  If #2 doesn't help either, then you may need to uninstall + re-install Microsoft Office to solve this problem.

    Hopefully one of these will help.

  182. Paul Moloney says:

    I was wondering if anyone can help here. on Win7 64 I was having a Windows Live Mail problem that appears to be related to this reg key:

    HKEY_LOCAL_MACHINE/SOFTWARE/Classes/.eml

    I get the following error when running WML:

    Detection of product '{9D56775A-93F3-44A3-8092-840E3826DE30}', feature 'WinMailFeat', component '{2C57E711-D78F-4008-9502-CC4DB2832354}' failed. The resource 'HKEY_LOCAL_MACHINESoftwareClasses.emlshellex{8895b1c6-b41f-4c1c-a562-0d564250836f}' does not exist.

    For some reason, I cannot make any changes to this registry key, and cannot even give myself permission to change it (even when I run regedit as admin). When I check its permissions, there's no users or groups attached.

    I downloaded the subinacl.exe command line utility and ran a suggested script to change permissions on reg keys. However, I get the following error:

    HKEY_LOCAL_MACHINESOFTWAREClasses.eml – AddAce error : 87 The parameter is incorrect.

    HKEY_LOCAL_MACHINESOFTWAREClasses.eml: 5 : Unable to enumerate subkeys

    … and still cannot access the reg key.

    Any help appreciated,

    P

  183. Hi Paul Moloney – I think you may have already tried this, but I am going to list it just in case.  Does it help at all to use steps like the ones in the blog post at http://www.raymond.cc/…/full-control-permission-to-delete-or-edit-restricted-windows-registry to take ownership of this registry key?

    The knowledge base article at http://support.microsoft.com/kb/313222 might also help you reset the permissions on this key.

     

  184. ne0c0de says:

    @FuzzyBS

    After a whole three days trying to install real player which happen to just dissappear trying to update. i finally got it running. I tried the first program which astebner has explained. It didnt work 🙁

    I came back to this post today and tried your program and finally it installed and ran. I just finished formatting my computer yesterday.

    Thanks a lot for your post !!!! You saved my day …

  185. Jon K says:

    Windows 7 Ultimate

    I ran SubInACL Tool and then edited the reset.cmd file just like you described.  Then I ran Reset.cmd and it seemed like everything worked.  I even rebooted my computer before I tried to run windows updates.  But I am still getting the same errir, Code 80070005.  I have not gotten a Windows Update since 11-10-2010 and I am the only user on my computer, and I am the administrator.  Any advice?  Please help!!!

  186. Hi Jon K – I haven't seen folks have good luck using the steps in this blog post to solve Windows Update installation problems on Windows Vista and higher.  I've posted some links to knowledge base articles that might help in this scenario at blogs.msdn.com/…/9472695.aspx.

    If that information doesn't help, then you may need to either contact Microsoft Technical Support (using the contact instructions at http://support.microsoft.com) or try to repair/re-install Windows to solve this type of Windows Update installation issue.

  187. Saskia says:

    THANK YOU SO MUCH, I had been battling this issue for over a year! This worked I am sooooooo happy and grateful! Finally I am updated!

  188. Jeff says:

    Hi Aaron, thanks for this post.

    Do you know if there is a way we can include all shared folders as well? For example I have many shared drives folders whose permissions needed to be set.

    subinacl /subdirectories %fileserver% /grant=administrators=f /grant=system=f /grant=users=e >> %temp%subinacl_output.txt

    Would the above code work for all network shares? (sorry if double post, not sure if submitted?)

  189. Hi Jeff – I'm not sure whether or not SubInAcl would support this type of scenario.  The SubInAcl tool installs an HTML file with a user's guide to the same folder as subinacl.exe, so I'd suggest taking a look at that to see if there is any information in there that would help in your scenario.

  190. Jan says:

    Hope I didn't miss the answer in this very long post

    I have Win7-64bit, ran Office 2010 for 2/3 months in 32bit mode ( thinking it would install 64bit due to the OS) I then (today) un-installed office & installed office 64bit, every time I open a module ( word , excel) I get the "please wait while windows configures microsoft office single image 2010" screen. Was then in contact with MS, pointing me to this post. I followed all the advice, but still no luck.

    I then read further on that Subinacl is not suppose be work on 64bit OS ?

    I do get many-may error (in red) in the CMD box while its running

    Any advise or direction ?

  191. Hi Jan – SubInAcl will work on a 64-bit OS, but I think it will only fix permissions issues for 32-bit registry keys in that scenario.  I'm not sure that SubInAcl is needed to solve this type of issue with Office though.  When you see that type of configuration dialog, it means that Windows thinks that there is something broken in Office's installation process that needs to be repaired.  It might help to try to launch Office with administrator privileges (by right-clicking on it and choosing Run as Administrator), then let it repair once more.  Sometimes, the repair process cannot complete successfully without administrator privileges.

    If that doesn't help, then there are entries in the event log that will explain exactly why this repair is being triggered.  I'd suggest contacting the Microsoft support team again and having them take a look at your application event log to try to narrow down this issue further using those event log entries.  The steps I use to look at the event log for this type of issue are described at blogs.msdn.com/…/219764.aspx.

  192. Leonardo Castello says:

    Hello Aaron!

    Just commenting to let you know that four and a half years after you made this post you're still helping people.

    My case was the dreaded error#1402 from Adobe Reader, which I tried to solve a couple of months back then just ignored it for a while after failing. Yesterday I was cleaning up my computer and decided i'd get rid of it once and for all. Knew the problem was on registry, tried messing with the permissions but no success, until I found your post. Many thanks.

    Cheers from Brazil,

    Leonardo.

  193. Dig says:

    FYI I tried installing Win7 64bit SP1. It consistently got to 95% and then crashed with an 80070005 error. After hunting round and reading this blog I was directed to windows.microsoft.com/troubleshootwindows7sp1. It seems that they released the SP1 on Feb 22'11 and then released a Hotfix on the same day. I followed their instructions, ran the hotfix…and SP1 then installed OK.

  194. Rick says:

    This fixed my Silverlight Issue where IE8 kept saying install silverlight for a better web experience everytime which ultimatly became redundant.  Although silverlight worked fine in firefox, I needed it to work in IE8 so that it would also work with the NetFlix in Vists's Media Ceter.  Went months without a fix until finally now. 🙂

  195. Mauricio Villablanca says:

    Hard to believe a 5-year-old blog entry is still useful today. I have used subInACL to fix corrupt Windows installations quite a lot.

  196. Moon says:

    Thank you so much to write this tutorial. I had a MSN issue for quite a long time and thanks to this blog, the issue has been solved now.

  197. huskyluv says:

    Thank you, thank you, thank you! Windows Updates stopped working on my Vista & nothing was helping! This worked immediately and has ended several nights up late trying to fix my pc!

  198. Edmore says:

    Thanks very much Aaron for your precise instructions. I was having serious problems with upgrading to Office 2010. This post saved me from reformatting my laptop. Everything is running smoothly. Super work….

  199. Dennis says:

    NEED HELP!

    I rescently installed Visual Studio 2010 and found out it wont let me create new projects duw to some registry permission problems.. I found this forum social.msdn.microsoft.com/…/c273b0e1-7f46-4065-afaf-4edf285d2531 saying it can fix my problem and it did, but to my dismay it kept me from openning all my system programs (all application programs works just fine).. it says "Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item." I tried every forum there is except for this one.. I tried running sfc /scannow and tried editing permissions in the regedit but still no luck.. I think this is somehow related to this post.. I'm running 32 bit windows 7.. can anyone help me please..

  200. Hi Dennis – This issue sounds similar to the one described at http://www.brianpeek.com/…/weird-vista-registry-issue.aspx.  Can you please take a look at that post to see if the information there helps you resolve this issue?

  201. chuck says:

    Sorry forgot to add the system specs of the PCs having the 1935 Errors:  Most are Windows 7 x64.  In my case, Windows 7 Ultimate x64.

    ————————————————

    Hi Aaron,

    Don't know if you have seen this issue, but there are hundreds of people having issues installing iTunes 10.5.1.  The errors are very similar to the ones in your blog, and I beleive they are ACL or registry related.  Also seems to have a connection to C++.  Can you take a quick look at the errors and lend us some of your wisdom.  This is really an issue affecting many users.

    Error from installing ITunes 10.5.1:

    ———————————————

    Product: Apple Application Support — Error 1935. An error occurred during the installation of assembly 'policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86"'. Please refer to Help and Support for more information. HRESULT: 0x80070005. assembly interface: IAssemblyCache, function: CreateAssemblyCacheItem, component: {63E949F6-03BC-5C40-A01F-C8B3B9A1E18E}

    Similar error from installing Microsoft Visual C++ 2005 Redistributable:

    ————————————————————————-

    Tried installing this to fix above…

    Product: Microsoft Visual C++ 2005 Redistributable — Error 1935.An error occurred during the installation of assembly 'Microsoft.VC80.ATL,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86"'. Please refer to Help and Support for more information. HRESULT: 0x80070005. assembly interface: IAssemblyCache, function: CreateAssemblyCacheItem, component: {97F81AF1-0E47-DC99-A01F-C8B3B9A1E18E}

    Thanks

    Chuck

  202. Hi Chuck – The above error means access is denied.  That means that there is some kind of permission problem that is causing your computer to be unable to install the VC++ runtime files.  Here are some things I typically suggest that people try when they run into this type of error:

    1.  Install the latest OS service pack if you haven't yet.

    2.  Try the System Update Readiness Tool described at support.microsoft.com/…/947821.

    3.  Try using a tool like the one described above in this blog post (SubInAcl) to update the permissions on the computer.

    If none of the above help, then you might need to repair/re-install Windows to solve this type of problem.

  203. Lance says:

    I had follow the instruction to run the reset.cmd but I still fail to install microsoft office professional plus 2010 64 bits. the error still occur. Do you have any other method to solve the problem?? currently I am using Windows 7 Home premium. Hope to see you reply soon. Thanks

  204. Hi Lance – I'm sorry, but the SubInAcl tool isn't able to solve 100% of installation problems.  What is the exact error that you see when you try to install Microsoft Office on your computer?

  205. Lance says:

    Thank your for reply. The Exact error is Error 1402. Setup cannot open the registry key. and Error 1712. One or more files required to be restore your computer to its previous state could not be found. Restoration will not be possible.

  206. Hi Lance – Error 1402 is a registry permission error, and usually the SubInAcl tool is able to help fix that type of error.  If it didn't help in your scenario, then you will need to manually fix the permissions by locating the registry key that is causing the error in the setup log file and then using regedit.exe to grant full control to that key to both the local system account and the Administrators group.

  207. Lance says:

    It seems like very technical to me. How to grant full control to that key? Thanks for your reply.

  208. Hi Lance – You can use steps like the ones at http://www.raymond.cc/…/full-control-permission-to-delete-or-edit-restricted-windows-registry to manually change the registry permissions.  However, I don't recommend manually updating the registry if you are not confident in what you are doing.  You might want to contact Microsoft technical support to get further assistance with this type of issue instead of trying to fix it yourself.  You can find contact information at http://support.microsoft.com.

  209. Hello, Mr. Stebner.

    I just wanted to express my appreciation and admiration for the excellent service that you are providing.  Although I have barely scratched the surface of the material, I have seen your name previously, and I can see that you are doing an amazing job of assisting a lot of people like myself.  Thank you, sir.

    Best wishes for your good health and continued success.

    James

    jameshnelson2009@live.com

    (I rarely check my messages at that email address although I use it for logging into technical sites; jameshnelson2003@yahoo.com)

  210. Jaya Naicker says:

    Hello Mr.Stebner,

    I'm a novice at this.

    I install subinacl.

    I download the notepad from your server.

    A simple question, what happens if the user name is more than one character? How do I append that in the notepad?

  211. Hi Jaya Naicker – I wouldn't recommend trying the steps in this blog post if you are a novice and don't have confidence in your ability to react to issues that might arise after you run the steps.

    If you still want to try to run these steps, you will need to update the script to replace all instances of the string YOURUSERNAME with your actual login user name.

  212. Jaya Naicker says:

    Thanks for getting back

    What if my user name was like " YOUR USERNAME " instead of " YOURUSERNAME "?

  213. Hi Jaya Naicker – I haven't tried that myself because I don't have a user name with spaces in it, but I think you can put quotes around the user name in the command line in that scenario.

  214. Lance says:

    I had noticed some of the software(Nitro Pro) that I try to install has same problem with the microsoft office, fail to open registry key. How Should I do???

  215. Hi Lance – If you are getting registry permission problems, you'll need to narrow down which registry keys are causing the problems and then try to update the permissions to fix the problems.  If the SubInAcl tool in this blog post doesn't help, you can try to update the registry permissions yourself by using the steps in the link I posted in my previous comment to you (http://www.raymond.cc/…/full-control-permission-to-delete-or-edit-restricted-windows-registry) or you can work with a support team member to have them walk you through that process.  You can find support contact information at http://support.microsoft.com.

  216. Seth says:

    hey, Aaron,

    i am trying to install a game -front mission evolved- the game installs fine but when it goes to install/configure windows 2005 C++ redistributable i get the error 1935

    i downloaded the SubInACL tool, made a reset.cmd doc but when i type reset.cmd into command prompt, nothing happens. nothing opens, etc. it simly goes to the next line in prompt as if nothing happened. i pretty much suck at this troubleshooting stuff and was wondering if you could help me out?

  217. Hi Seth – Most of the time, 1935 errors for the VC++ redistributable cannot be solved with SubInAcl.  I'd suggest taking a look at the information and links at blogs.msdn.com/…/9904471.aspx to see if any of that information helps in this scenario.

  218. Hello Aaron,  My problem started with the inability to install Lightroom 3 to my Vista/32 laptop.

    I received the message:

    "Error 1935.An error occurred during the installation of

    assembly component

    {FF2F571A-6C54-31E3-B23E-2A60283B08A8}.

    HRESULT: 0x80070005"

    I entered into a chat session with Adobe support, and they instructed me to run the SubInACL program, and reboot the computer.  After looking at your complete instructions, however, I realize they did not have me change the login used id from "yourself" to my actual used id.

    After my system restarted, the desktop background had changed to Black.  On the bottom, right side of the monitor, the following information appeared:

    "Windows Vista (TM)

    Build 6002

    This copy of Windows is not genuine"

    I still attempted to re-install Lightroom 3, but it failed for the same reason.

    I ran the MS Genuine Advantage Diagnostic tool, 1.9.0027.0, and it reported that my license was, "Invalid."

    I have updated my case with Adobe, through their online portal, but thought I would run this past you before I tried another chat session.

    Any help would be much appreciated.

  219. Hi BluegrassPhotog – I'm very sorry for the hassles that these permissions issues and the attempts to fix them have caused.  If you're getting that type of Windows validation problem after running SubInAcl, I'd suggest trying to boot in safe mode and see if you can roll back the changes with a system restore point or something like that.  Then, once you've rolled back and you verify that Windows validation works and your desktop appears as expected, I'd suggest trying SubInAcl again with the correct username.

    There is a blog post at http://www.brianpeek.com/…/weird-vista-registry-issue.aspx that might be helpful to you in this scenario as well.

  220. Aaron, thank you for your reply.  I had another chat session with Adobe, today, and I am unhappy to report that their support leaves much to be desired.  The good news is that I was able to activate my license, so Vista is back to normal.  My system was actually functioning normally; my license was just invalid.  Lightroom 3 still won't install, but that is Adobe's problem, not yours or Microsoft's.  I really appreciate your getting back to me so quickly.  Good luck to you in all your endeavors.  BGP

  221. Mike says:

    I adopted a version of Aaron's original script to edit the permissions of the Registry key HKLMSoftwareMicrosoftInternet Explorer so that the local Users group would have Full control of the Internet Explorer key and all subkeys to be able to play sound on a special web application that uses MP3 sound files, but it doesn't seem to change anything. I am running Windows 7 Enterprise 64-bit. My script is:

    cd /d "%programfiles(x86)%Windows Resource KitsTools"

    subinacl.exe /noverbose /subkeyreg "HKEY_LOCAL_MACHINESoftwareMicrosoftInternet Explorer" /grant=Users=f > %temp%subinacl_output.txt

    subinacl.exe /noverbose /keyreg "HKEY_LOCAL_MACHINESoftwareMicrosoftInternet Explorer" /grant=Users=f >> %temp%subinacl_output.txt

    There are over 1300 subkeys under the Internet Explorer key and the output file lists four "Access Denied" warnings, which I am fine with.

    Am I expecting the permissions to change when really this is changing something else? Should I use something other than "Users"? I tried doing the same thing with Regini, but it doesn't let the inheritted permissions to trickle down to the child objects even though the child object do say thier permissions are inheritted from thier Parent. Thanks for any help.

  222. Hi Mike – I'm not sure how well tested SubInAcl is for 64-bit registry permissions because that tool was created before 64-bit OS's existed.  You might need to try to use a different tool like RegIni in your scenario.  There is a forum post at social.technet.microsoft.com/…/d5da5921-6f18-4ba4-ba9e-0e8f77bfbd06 that might be helpful to you in this scenario.

  223. Rob - Vista x64 says:

    Hi Aaron,

    Your script resolved my issue with Microsoft Office 2010 (32-bit) always wanting to re-install every time I started one of the Office applications.  Previously, any of the Office apps would show a pop-up message:

    Please wait while Windows configures Microsoft Office Professional Plus 2010…

    I didn't even need to reboot.

    Thanks so much!

  224. Hi Aaron,

    I wanted to get back to you about the problem I was having with installing Lightroom 3, running into the "error 1935, HRESULT: 0x80070005," situation.

    Just to remind you, this was the situation where Adobe Chat instructed me to run SubInACL, and my Vista license became invalidated.  I re-validated Vista online through MS to resolve that problem.  I think the problem was caused by Adobe not instructing me to change the (2) parameter values "Yourself," to my user ID.  At that time, I had no idea the purpose of SubInACL, only that I was desperate to get the problem resolved.

    After spending another half-day on the phone with Adobe chat, it was very apparent that the permissions were, indeed, causing all the problems.  The Adobe tech could not even perform any simple file copies, receiving "Access Denied," errors.

    After the tech gave up and referred me to MS, I decided to follow your instructions on running SubInACL.  Before that, I ran the "System Readiness Tool for Vista," to look for other inconsistencies.  I figured it couldn't hurt!

    I am happy to report that your instructions resolved the issue, and LR3 installed properly.

    Thank you so much for your assistance, in addition to your knowledge which you provide as a free service to those of us who don't have a clue.

    Best regards, Eric

  225. Jimena says:

    Hi Aaron. I have been having some issues lately with my laptop. My vista gadgets are not working…. they appear in a black little box. Also, my McAfee antivirus shows me a white screen when I open it. And,  skype wont open, it also shows me a white screen… I hope you have some good advices. My laptop is a Compac presario, which I bought 4 years ago….

    Thanks

    J

  226. Hi Jimena – I don't have expertise troubleshooting Vista gadget issue or McAfee anti-virus issues.  For the Vista gadget issue, I'd suggest posting a question on one of the Windows Vista forums listed at windows.microsoft.com/…/community.  For the McAfee issue, I'd suggest searching on their web site to see if they can suggest any workarounds for you to try.

  227. Dariowiz says:

    Hallo, I had 8007005 error after I've manually removed the fake S.M.A.R.T. Check malware program from a PC with Windows 7.

    To resolve it I've simply removed the hidden and read-only attribute from then c:WindowsSoftwareDistribution folder and subfolder and windows update worked again.

    Hope this helps

  228. Morris says:

    Hi Aaron,

    I am very impressed with the end result of the script.  It worked marvelously!  Thank you!

    My only point to improve upon this would be to rename "repair.cmd" into a *.bat (batch script) which I did and ran after modifying the field "YOURUSERNAME".  This really simplified the process for me.  The initial steps were confusing, but I finally got it and it did fix the error(s) I was having!  THANK YOU!

    — Morris

  229. Dear Mr. Aaron Stebner

    May I ask help from you?

    My system is Windows vista home basic, Service pack 2. In order to solve a windows update problem (code 80070005), I followed the procedure below, which is a post from a Microsoft forum. After running the reset batch, the original problem seemed to be solved, but it resulted in other more serious problems, such as the audio system, Windows Update, McAfee update and many other services not functioning. They frequently show the reason of “Not enough storage is available to complete this operation”. May I ask whether you think that your script can solve my problem? Or do you have any suggestion? Thank you very much anyway.

    ==========================================================

    Hi,

    I hope al the 80070005 sufferrers are still reading this thread.

    If disabling virus scan does not solve the problem then try the following.

    This worked like a charm for me on my Vista SP1 XPS Laptop.

    I got the solution from Microsoft, as was recommended in one of the postings on this site.

    They were actually really quick in responding and suggesting the soution.  The problem does have to do with corrupted permissions in the registry.

    Here are the steps to follow:

    In Scanning process, we can use Permission Reset Tool in TC.

    1. Please download the subinacl.msi file from the following link and save the installation patch onto the Desktop:

    http://www.microsoft.com/…/details.aspx

    2. Please go to the Desktop and double click the downloaded file.

    3. Please select the C:WindowsSystem32 folder as the Destination Folder during the installation. Later we will use this tool to reset the permission settings on the current machine.

    4. Click the "Start" Button, in the "Start Search" bar, type: "notepad" (without quotes) and press Enter.

    5. Copy the following commands and then paste them into the opened Notepad window:

    @echo off

    subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f

    subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f

    subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f

    subinacl /subdirectories %SystemDrive% /grant=administrators=f

    subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=system=f

    subinacl /subkeyreg HKEY_CURRENT_USER /grant=system=f

    subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=system=f

    subinacl /subdirectories %SystemDrive% /grant=system=f

    @Echo =========================

    @Echo Finished.

    @Echo =========================

    @pause

    6. After pasting the above commands, please close the Notepad window. Choose "Save" when you are prompted to save the file. Type "reset.bat" as the file name and choose "Desktop" from the left panel as the save location.

    7. Refer to the Desktop and right click the reset.bat file, then choose "Run as administrator."

    8. You will see a DOS-like window processing.

    NOTE: It may take several minutes, please be patient. When it is finished, you will be prompted with the message: "Finished, press any key to continue".

    Note: About some driver update installation procedure, we also received this error code, please reroute this kind of case to Vista System Team, because, it may regard for third party programs structure.  

    ==========================================

  230. Hi Sigurd58 – I don't think the script in this blog post would help in your scenario because it does essentially the same thing as the script you found in that forum post.  Your scenario sounds like it might be similar to the issue described at http://www.brianpeek.com/…/weird-vista-registry-issue.aspx, so I'd suggest taking a look at that post to see if the description matches what you see in your registry.  If so, then I'd suggest trying the steps there to see if they help.

  231. Dominic says:

    Excellent, been struggling with an access denied driver error, tried everything upto this point and nothing work. Was just at the point of reformatting machine when I found this, worked perfectly! Win 7 SP1. Thank you.

  232. Matt says:

    I'm trying to setowner of subkeyreg, and am receiving output that reflects nothing is performed:

    +subkeyreg HKEY_LOCAL_MACHINESYSTEMControlSet002Enum*

    /setowner=domainuser

    Done:        0, Modified        0, Failed        0, Syntax errors        0

    The user who is running subinacl has full control over HKLMSYSTEMControlSet002Enum

    Aaron, I noticed you do use setowner with subkeyreg and am curious what it is I'm doing incorrectly, or how I'm misunderstanding the tool.

    Thanks,

    Matt

  233. Hi Matt – What is the full command line that you're using in your scenario, and what version of Windows are you running it on?

    There is a user's guide named subinacl.htm that is installed next to subinacl.exe when you install the tool.  If you haven't yet, I'd suggest taking a look at the user's guide to see if it helps you at all as you try to troubleshoot this issue.

  234. Geekeroid says:

    I paused Kaspersky and now it went in like a dream

  235. KOz says:

    I tried the guide I get 40000 plus errors.

    W7 64 bit SP1.

    I run an admin account.

    Any help would be much appreciated.

    I turned my AV off didnt make a difference.

  236. Hi KOz – When the number of errors is that large, it usually means that subinacl wasn't run from an elevated cmd prompt.  Even if you are logged in as a user that has administrator privileges, you need to run subinacl from an elevated cmd prompt.  There are steps that will help you do that in the blog post above.

    If that doesn't help, then I'd suggest posting a question on the Windows 7 forums at answers.microsoft.com/…/windows_7 and describe the exact problem you are encountering that led you to try to run subinacl in the first place.  Hopefully someone there will be able to provide some additional suggestions for you to try.

  237. Jamie says:

    Hi there,

    Was directed to your blog after having a series of issues. Hopefully you can help and I will be eternally grateful!

    My dad got a new Lenovo laptop with Windows 8 installed. It was dire and he was used to windows 7 so after a load of issues we formatted and installed windows 7.

    At this moment in time, everything seems to work fine apart from MS office and Windows Live Mail. MS Office (regardless of programme, Word, Excel, all of them) when fired up attempts to install, attempts to grather required information, and with no error message just closes and nothing happens. The programs dont run and I dont get an error message. On the installation, everything seems fine too. All the files are on the C drive. I've tried uninstalling and reinstalling, tried office 2007 and 2010, tried your tool above, twice, still no luck.

    Windows Live Mail also gets the installation box, but runs after the box has disappeared without any noticeable issues.

    Any help would be very much appreciated.

    P.S. You need a "donate" button somewhere!

  238. Hi Jamie – To try to solve the Office auto-repair issue, I'd suggest trying to right-click on the Office application you want to run and choose Run as Administrator.  I'm hoping that whatever it is trying to repair will work correctly if the application is given administrative privileges at least once.  The same technique might also help solve the auto-repair that you're seeing when you launch Windows Live Mail.

    If this doesn't help, then I'd suggest posting a question on the Office forums at support.microsoft.com/…/gp_newsgroups_master to see if someone there can provide some additional suggestions for you.

  239. flipmenidsair says:

    Hi Aaron,

    i'm trying to solve a .net4 full installation problem with the subinacl script on win 2k3 server std 32bit ita. the command give me a syntax error in the "/grant=restricted=r" part and don't process the hklm and hkcu section of the registry. who is the "restricted" user or group? can i ignore that part and delete it from the script? i try both your and PCPerspective scripts versions

    thanks in advance for any suggestion

  240. Hi flipmenidsair – I think that restricted is a built-in user account, and there might be issues with that account name being translated on some non-English versions of Windows.  I think it should be safe for you to delete that from the script when you try to run it on your computer.  You might also want to review the contents of the file named subinacl.htm that is installed to the same folder as subinacl.exe.  It contains some more detailed documentation about the supported command line switches and usage examples for the tool.

  241. Hi Aaron,

    thanks for the help. I have already correct the script and execute with success. But this don't solve the problem. I still have error 0x80070643 irreversible error during installtion of .net 4. I can't run the windowsupdate.diagcab auto fix from kb/976982/en-us because the system ask me which program use to open it. Now i run sfc /scannow and restart the system. I don't understand why the file msdt.exe is not present on my system so i can't open diagcab files. How can i restore it?

  242. Hi Flipmendisair – I'm not sure how to restore msdt.exe if SFC didn't help.  Maybe you can copy it from another computer?

    For the .NET Framework installation error, can you please use the tool described at blogs.msdn.com/…/6458047.aspx to collect all of your setup log files, upload the file named %temp%vslogs.cab that this tool will create to a file server (such as http://skydrive.live.com), and then reply back here and provide a link that I can use to download your log files and take a closer look?

  243. Hi Aaron,

    Yesterday i have opened a payment request support to microsoft to solve the problem that is very critical for my company. You can find one of the last vslogs collected here skydrive.live.com/redir

    If i solve i will post the resolution found with the microsoft support

    Thanks

  244. Hi Flipmendisair – I'm sorry, but I can't tell for sure what the root cause is of this failure by looking at your log file.  It might help to try to use the tools and steps listed at blogs.msdn.com/…/8108332.aspx to repair and/or remove the .NET Framework and try again to install the .NET Framework 4 on this computer.

  245. Richard Osborne says:

    Thank you for this!  It fixed GoToMeeting issues on several of our PCs.

  246. @Aaron Stebner

    I ran this test:

       subinacl /subdirectories %ProgramFilesPath%

    First file reported is:

       +File C:app7pdfmakerApp7-PDFMakerlibAppOOoprogram

    So last subinacl cmd in your script should have double quotes around "%ProgramFilesPath%"

    Anyone who has run this may have changed any folder called "program"  or "files" as effectively running this on entire drive:

       "subinacl /subdirectories C:Program"

       "subinacl /subdirectories Files"

  247. Rajesh Mishra says:

    I am trying Visual Studio Ultimate 2012 on windows 7, only one user(RAJESH) is there. Still i went through your demo but it had many failure and application did not succeed as well in etting installed. Can not upload log file as it is 1.25Gb. But this log file is of my application which i ran:

    http://sdrv.ms/10MzgUN

    Can you help me find out the problem?

  248. Hi Rajesh Mishra – Your Visual Studio 2012 log file shows a bunch of errors like the following:

    [08FC:0BD0][2013-05-21T22:57:53]: Error 0x80070005: Failed to move C:UsersRAJESHAppDataLocalTemp{f9024a51-ab45-4a46-b597-ce12f74963c7}vs_preclean_vs to C:ProgramDataPackage Cache.unverifiedvs_preclean_vs

    Instead of using SubInAcl, I'd suggest trying to manually update the permissions on your Package Cache folder to see if that will solve this error.  You can find a tutorial that shows how to do this at http://www.wikihow.com/Change-File-Permissions-on-Windows-7.

  249. Prasad says:

    wounderful solution, it worked for me.

    able to install 2013 without errors

    Thanks a lot for sharing

  250. User says:

    Nice solution but can be done manually without needing any subinacl software

  251. John B says:

    Blessings on you and your descendants! I spent two hours trying other solutions to get Microsoft Office installed on my Win 7 (Dell) machine. This worked!

  252. Ryan says:

    I posted a comment as I had an issue getting rid of Bonjour for iTunes, I want to install iTunes to my laptop which is currently running Windows 7 Professional N but for some reason it won't let me remove the older version of Bonjour so that the new iTunes 11 can install. Please, can anyone help with this problem, I have tried literally everything I can and NOTHING is working… please guys?

  253. Hi Ryan – What is the exact error that you see when trying to uninstall the older version of this software?  It might help to try manual uninstall steps like the ones listed at blogs.msdn.com/…/487096.aspx.  It might also help to visit the iTunes web site to see if they have any troubleshooting guides for their installers.

  254. amazonpercy says:

    hi Ryan, have you tried comodo programs manager? just be careful because its real powerful and can remove important files etc.

  255. Leah says:

    Thank you so much! I was finally able to update and install my software. Worked perfectly.

  256. Rodolfo Cardoso says:

    Impressive, this had saved me from insanity 🙂

    Sometimes windows can surprise me for the worst reasons…..

    Save me from a error: Permission denied installing asp.net webpages 2 ("pre-requisite from asp.net mvc 4")

    thank you!

  257. Amador says:

    Hello Mr Stebner, after reading about your great tools I am writing to see if any of them can help me. I have just bought Visual Studio Professional 2013. Previously on this same machine I had installed both the 2010 and 2012 versions, never had any issue. This time, shortly after the VS installer starts, when it tries to install the .NET framewrok 4.5.1 I get a setup failed message, which specifies the famous "The Windows Installer service could not be accessed" error message. I have tried many things already, as indicated on several support articles, but nothing works for me. It's just terrible . OS Windows 7 pro

    I would appreciate if you can send me to any direction to solve this problem.

  258. Hi Amador – Can you please use the tool described at blogs.msdn.com/…/6458047.aspx to collect all of your setup log files, upload the file named %temp%vslogs.cab that this tool will create to a file server (such as http://skydrive.live.com), and then reply back here and provide a link that I can use to download your log files and take a closer look?

  259. Amador says:

    Thank you very much! I know that you must be very busy and I do not want to cause you trouble. The output of that tool is over 12 megs.

    You can download it from here https://db.tt/6DH7nh3y

  260. Hi Amador – From your logs, it looks like you've still got a preview version of the .NET Framework 4.5.1 installed on your computer, and that might be causing problems with the final version of the .NET Framework 4.5.1 and VS 2013.  I'd suggest trying to fully uninstall any preview versions of VS 2013 and the .NET Framework 4.5.1 that you have on your computer and then try to install VS 2013 again.

  261. Mikael says:

    OMG! Can't believe this. I had this annoying 80070005 error. Tried a bunch of methods none of them worked.

    But yours did!

    Bra jobbat (well done, in Swedish!)

  262. TomV says:

    I recently installed MS Office Pro 2007 on a Dell laptop.  Every time I start MSAccess, "Microsoft Office Professional Hybrid 2007" configuration runs before opening Access.  It doesn't happen with any other Office App.  Is there any way to stop this Hybrid configuration each tme Access is opened?  Thanks in advance for your response.

  263. TomV0714 says:

    TomV

    I forgot to mention I am running Windows XP Pro SP3.

  264. Hi TomV – I typically use steps like the ones listed at blogs.msdn.com/…/219764.aspx to narrow down the cause of this type of configuration dialog.  Those steps require relatively advanced knowledge of Windows Installer though, so you might want to try to post a question on the Office 2007 forum at answers.microsoft.com/…/office_2007 to see if someone there can provide more detailed troubleshooting steps.

  265. Carrie P for Mr Stebner says:

    Wow!  I have been working on an iTunes registry error for about 2 1/2 days (about 14 hours total) and THIS finally did the trick.  Thank you, thank you, thank you!  There was so much I found when researching this issue that just didn't work but this did.  Thanks again.  Also – I am an IT analyst and have been around Windows for a very, very long time.  For those of you that are wondering, this utility took about 75 minutes to run.  If you'd like, you can run the process monitor (3rd party tool that's blessed by Microsoft) at the same time while this runs so that you can "see" what's going on.  

  266. Steve i got results down / part 1 says:

    C:UsersiPhone3G>cd /d "C:Program FilesWindows Resource KitsTools"

    C:Program FilesWindows Resource KitsTools>subinacl /subkeyreg HKEY_CURRENT_US

    ER /grant=administrators=f /grant=system=f /grant=restricted=r /grant=iPhone3G=f

    /setowner=administrators  1>C:UsersiPhone3GAppDataLocalTempsubinacl_outpu

    t.txt

    Elapsed Time: 00 00:00:03

    Done:     4114, Modified     4113, Failed        1, Syntax errors        0

    Last Done  : HKEY_CURRENT_USERVolatile Environment1

    Last Failed: HKEY_CURRENT_USERSoftwareSecuROMLicense information : 2 The syst

    em cannot find the file specified.

    C:Program FilesWindows Resource KitsTools>subinacl /keyreg HKEY_CURRENT_USER

    /grant=administrators=f /grant=system=f /grant=restricted=r /grant=iPhone3G=f /s

    etowner=administrators  1>>C:UsersiPhone3GAppDataLocalTempsubinacl_output.

    txt

    Elapsed Time: 00 00:00:00

    Done:        1, Modified        1, Failed        0, Syntax errors        0

    Last Done  : HKEY_CURRENT_USER

    C:Program FilesWindows Resource KitsTools>subinacl /subkeyreg HKEY_LOCAL_MACH

    INE /grant=administrators=f /grant=system=f /grant=users=r /grant=everyone=r /gr

    ant=restricted=r /setowner=administrators  1>>C:UsersiPhone3GAppDataLocalTe

    mpsubinacl_output.txt

  267. hariom says:

    i had installed visual stdio 10 .can i install visual studio 2010 in my system both .?

  268. Hi hariom – Yes, you can install both of these versions of Visual Studio side-by-side on the same computer.

  269. anirudh says:

    'subinacl' is not recognised as an internal or external command, operable command or batch file.

    WHAT DOES THIS MEAN??

  270. Hi anirudh – That error message means that the file subinacl.exe is not in the directory that you ran the command from.  That could happen if you didn't install the subinacl tool or if you didn't change directory to the folder that it is installed to before running the other commands.  Can you please double-check that subinacl is installed correctly and that you ran the steps exactly as they are listed above in this blog post?

    If it continues to happen after checking those things, please post a screenshot so I can take a closer look.

  271. CaptainN says:

    Hey thanks for writing the guide, but when I run the reset.cmd it always says it is not an internal or external command. Please Help!

  272. Hi CaptainN – That error message means that the file reset.cmd is not in the directory that you ran the command from.  Please double-check that you ran the steps exactly as they are listed above in this blog post and that the file reset.cmd is located in the directory that you are running the command from in your cmd prompt.

  273. Marcell says:

    Hello!

    I can't run this script but I think I tried everything, I get these messages:

    C:Program FilesWindows Resource KitsTools>cd /d "C:Program FilesWindows Res

    ource KitsTools"

    C:Program FilesWindows Resource KitsTools>subinacl /subkeyreg HKEY_CURRENT_US

    ER /grant=rendszergazdák=f /grant=system=f /grant=restricted=r /grant=HM=f /set

    owner=rendszergazd├ík  1>C:UsersHM2ECF~1AppDataLocalTempsubinacl_output.tx

    t

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=rendszergazd

    C:Program FilesWindows Resource KitsTools>subinacl /keyreg HKEY_CURRENT_USER

    /grant=rendszergazdák=f /grant=system=f /grant=restricted=r /grant=HM=f /setown

    er=rendszergazd├ík  1>>C:UsersHM2ECF~1AppDataLocalTempsubinacl_output.txt

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=rendszergazd

    C:Program FilesWindows Resource KitsTools>subinacl /subkeyreg HKEY_LOCAL_MACH

    INE /grant=rendszergazdák=f /grant=system=f /grant=users=r /grant=everyone=r /g

    rant=restricted=r /setowner=rendszergazd├ík  1>>C:UsersHM2ECF~1AppDataLocal

    Tempsubinacl_output.txt

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=rendszergazd

    C:Program FilesWindows Resource KitsTools>subinacl /keyreg HKEY_LOCAL_MACHINE

    /grant=rendszergazdák=f /grant=system=f /grant=users=r /grant=everyone=r /gran

    t=restricted=r /setowner=rendszergazd├ík  1>>C:UsersHM2ECF~1AppDataLocalTem

    psubinacl_output.txt

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=rendszergazd

    C:Program FilesWindows Resource KitsTools>subinacl /subkeyreg HKEY_CLASSES_RO

    OT /grant=rendszergazdák=f /grant=system=f /grant=users=r /setowner=rendszergaz

    d├ík  1>>C:UsersHM2ECF~1AppDataLocalTempsubinacl_output.txt

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=rendszergazd

    I have win7 64bit(hungarian), I run this cmd with administrator(rendszergazdák) privilege.

  274. Hi Marcell – It looks like the SubInAcl tool doesn't like the name for the Administrators group that you're passing in via the command line.  Does it work if you use the English word Administrators instead of the translated word?  If not, then I'm not sure what else to suggest because I don't see any information about how to correct this type of error in the readme that is installed with the SubInAcl tool.  You might need to use some other way of resetting the permissions on your computer instead of SubInAcl in that case.

  275. Marcell says:

    Hello, Aaron!

    Thank you, for the fast reply!

    I tried it with "administrators" also, I get the same error:

    onedrive.live.com/redir

    I want to install Visual C++ without reinstalling my windows. What else can you suggest if SubInAcl doesn't work for me?

    I have already tried these solutions:

    -Read every post on the VC++ forum connetion with setup installation failure with 0x80070005 code

    -I tried to give full permission throught explorer, on C:ProgramDataPackage Cache (But I can't remove write block somehow, even if I have all the permissions)

    -I deleted my anti virus programs.

    -Downloaded different type of VC++ and verified the ISO file.

    -Tried to change the Character Coding in CMD, with CHCP (437|850|1250|1252|1253)(neither made me the "á" letter)

    -Ran the installer as administrators, and cmd also.

    -Tried this but It couldn't help also: support.microsoft.com/…/program_install_and_uninstall

    -I removed .Net 4.5.1 (I saw it somewhere it can help, idk…)

    I also tried to change things on the other ways, but I think I couldn't get aware of their proper using:

    -regini.exe (didn't get what to change exactly)

    -Tried to change manually throught regedit.exe, but I didn't know what to change exactly. :S

    When I try to install VC++, I get the following error during install:

    onedrive.live.com/redir

    I have some little observations, I can't install, neither uninstall these programs VC++ 2012/2013. It appears in my control panel-> progams, but somehow I get the same error at uninstalling.

    I hope you can determine something from these, if you need any more information, just ask, I try to do my best.

  276. Marcell says:

    Hello!

    I gone too far at manually editing my regitry, and I lost lot of thing from my windows now, I don't have sound, can't uninstall or reinstall microsoft offices, and they don't start, and so on… neither Visual C++ works.

    Now I reinstall my windows, I can't bare this ***… 🙁

    It took more then 10 hours already. I hate microsoft now very much.

    Anyhow, thank you for your help Aaron Stebner. I hope, I don't have to do this again on the new windows.

    Marcell

  277. Hi Marcell – I'm very sorry to hear that you ran into these issues and needed to re-install Windows to resolve them.

    If you run into any Visual Studio installation issues in the future, please use the tool described at blogs.msdn.com/…/6458047.aspx to collect all of your setup log files, upload the file named %temp%vslogs.cab that this tool will create to a file server (such as http://onedrive.live.com), and then reply back here and provide a link that I can use to download your log files and take a closer look.

    Also, here are some links to more information about how to manually update file and registry permissions in case you need them in the future:

    support.microsoft.com/…/310426

    support.microsoft.com/…/308419

    I always recommend making a backup of your registry prior to making any changes in case you run into any problems.  You can find instructions for doing this at windows.microsoft.com/…/back-up-registry.

  278. LTF123 says:

    après aoir fait ce que vous avez dit dans vos explications voici ce qu'il me répond :

    microsoft windows xp (version 5.1.2600)

    <c>copyright 1985-2001 microsoft corp

    'subinacl' n'est pas reconnu en tant que commande interne ou externe, un programme exécutable ou un fichier de commandes.

    que faire ? car je n'arrive pas à installer avast free.

    à bientôt et merci d'avance de votre aide.

    mail : jean.arsene@neuf.fr

  279. Hi LTF123 – That error most likely means that SubInAcl isn't installed at the expected location or you didn't change directories to the directory that SubInAcl is installed to.  I'd suggest double-checking both of those issues.

  280. Oscar says:

    Aaron:

    Since i had problems to reinstall my NVIDIA video card, i applied the subinacl solution that you suggested. It resolved the problem, but now i have a black screen to run IE9 and when i run an MS Office application, it says: "this action is only valid for products that are currently

    installed". Please help me.

    The subincl script that i executed was:

    subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrador=f /grant=system=f /grant=myuser=f /setowner=administrador > %temp%subinacl_output.txt

    subinacl /keyreg HKEY_CURRENT_USER /grant=administrador=f /grant=system=f  /grant=myuser=f /setowner=administrador >> %temp%subinacl_output.txt

    subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrador=f /grant=system=f /setowner=administrador >> %temp%subinacl_output.txt

    subinacl /keyreg HKEY_LOCAL_MACHINE /grant=administrador=f /grant=system=f /grant=usuarios=r  /setowner=administrador >> %temp%subinacl_output.txt

    subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrador=f /grant=system=f /grant=usuarios=r /setowner=administrador >> %temp%subinacl_output.txt

    subinacl /keyreg HKEY_CLASSES_ROOT /grant=administrador=f /grant=system=f /grant=usuarios=r /setowner=administrador >> %temp%subinacl_output.txt

    subinacl /subdirectories %ProgramFilesPath% /grant=administrador=f /grant=system=f /grant=usuarios=e >> %temp%subinacl_output.txt

    subinacl /subdirectories %windir% /grant=administrador=f /grant=system=f /grant=usuarios=e  >> %temp%subinacl_output.txt

  281. Hi Oscar – I'm sorry for the hassles you're running into here.  For the IE issue, I'd suggest trying to upgrade to a newer version of IE to see if that helps.  For the Office issue, I'd suggest trying to repair Office to see if that helps, and if it doesn't help, then I'd suggest trying to uninstall + re-install it.

  282. Oscar says:

    Hi, Aaron. IE runs OK with "Administrator" user. I have the probleme only wit myuser. So, the problem is about privileges.

    Can you inpect the script that i executed to help me, please?

    Thanks.

  283. Hi Oscar – I'm sorry, but I don't know what specific settings IE uses, and there isn't any specific logic to change permissions for IE settings in the subinacl script in this blog post.  If you know what specific settings are causing problems with IE, you can try to manually update the permissions using regedit.exe (for registry keys) or Windows Explorer (for files/folders).

  284. NARAYAN says:

    I tried this one on xp sp3 it didnt work ,i dont no where to save reset.cmd and that username i didnt understand

    please help i want to load sql 2005 .netframe 2.0 not installing

  285. Hi NARAYAN – In general, I don't recommend using tools like SubInAcl unless you're confident that you know what the tool is doing and have backed things up so that you can revert the changes if needed.

    Instead of trying to use this tool, can you please use the tool described at blogs.msdn.com/…/6458047.aspx to collect all of your setup log files, upload the file named %temp%vslogs.cab that this tool will create to a file server (such as http://onedrive.live.com), and then reply back here and provide a link that I can use to download your log files and take a closer look and see if I can figure out why the .NET Framework is failing to install on your computer?

  286. Marc M says:

    Been having a Windows update issue for weeks, Windows tries to update every night, and fails with error (80070005). Running Windows 7. Wasn't really an issue until last night when it added an update to Nvidia, the Nvidia windows update failed to install, but it also deleted all my graphics drivers to include monitor drivers. I've tried running the Nvidia driver installer, but that too fails to install, with no additional information as to why. I've installed the SubInAcl tool and below are the results (using the notepad from the file server in the first post).

    Noticing a lot of "Error : 5 Access is denied."

    not sure where to go from here.

    please advise

    ==========================================================================

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=marc : Error when checking arguments – HKEY_C

    URRENT_USER

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=marc : Error when checking arguments – HKEY_C

    URRENT_USER

    Elapsed Time: 00 00:02:54

    Done:   269750, Modified   214020, Failed    55730, Syntax errors        0

    Last Done  : HKEY_LOCAL_MACHINESYSTEMCurrentControlSetservices{157BCCF7-3451

    -4BD6-9F4B-4B1E6D656EBF}ParametersTcpip

    Last Failed: HKEY_LOCAL_MACHINESYSTEMCurrentControlSetservicesxmlprovParame

    tersSchemaGroupsUserhttp://www.microsoft.com/…/mspeapuserpropertie

    sv1 – RegSetKeySecurity Error : 5 Access is denied.

    Elapsed Time: 00 00:00:00

    Done:        1, Modified        1, Failed        0, Syntax errors        0

    Last Done  : HKEY_LOCAL_MACHINE

    Elapsed Time: 00 00:02:07

    Done:   129366, Modified    83113, Failed    46253, Syntax errors        0

    Last Done  : HKEY_CLASSES_ROOTLast Failed: HKEY_CLASSES_ROOT{2C256447-3F0D-4CB

    B-9D12-575BB20CDA0A}ProgID – RegSetKeySecurity Error : 5 Access is denied.

    Elapsed Time: 00 00:00:00

    Done:        1, Modified        1, Failed        0, Syntax errors        0

    Last Done  : HKEY_CLASSES_ROOT

    System Drive…

    Elapsed Time: 00 00:00:12

    Done:        0, Modified        0, Failed        0, Syntax errors        0

    Windows Directory…

    Elapsed Time: 00 00:01:15

    Done:   128554, Modified   128534, Failed       20, Syntax errors        0

    Last Done  : C:Windowswinsxsx86_wwf-system.workflow.runtime_31bf3856ad364e35_

    6.1.7601.17514_none_67224784fe4912e9System.Workflow.Runtime.dll

    Last Failed: C:Windowswinsxsx86_avast.vc110.crt_2036b14a11e83e4a_11.0.60610.1

    _none_1d37a43bbfe1dc9cmsvcr110.dll – CreateFile Error : 5 Access is denied.

    ==========================================================================

    FINISHED.

    Press any key to exit . . .

  287. David S says:

    I seem to be having the same problem as others = "subinacl is not recognised as an internal or external command, operable program or batch file". The subinacl.exe file is in my Cwindowssystem32 directory as is the reset.cmd file. What am I doing wrong?

    My windows updates haven't been working for over a month and now I've lost my printer. Please help if you can. Many thanks

  288. Hi Marc M – If the SubInAcl tool isn't able to update the permissions on your registry, then I'd first suggest double-checking to make sure that you are running it from an elevated cmd prompt.  If you're doing that and still seeing problems, then you might need to manually update the registry permissions on your computer using steps like the ones at support.microsoft.com/…/310426.

  289. Hi David S – That error message means that the file reset.cmd is not in the directory that you ran the command from.  Please double-check that you ran the steps exactly as they are listed above in this blog post and that the file reset.cmd is located in the directory that you are running the command from in your cmd prompt.

  290. shaikh zafar says:

    Hi….aaron

    when i'm trying to install visual studio 2012 the following error is coming ,please tell me how to solve it……..

    Microsoft Visual Studio cannot be installed, and you receive an error message that contains one of the following errors:

    If this article does not address the Visual Studio installation issue that you are experiencing or you receive an error message of other error codes, please go to the Visual Studio Setup and Installation forum.

    0x80200010, 0x80072efe, or 0x80072ee7 – Connectivity issue during download

    0x80070005 – Access denied

    0x80070643 – Installation cache or ISO is corrupted

    0x800713ec – .NET Framework installation is in progress

    Web Deploy 3.0 – Certificate warning or Unable to locate package source error

  291. Hi shaikh zafar – Can you please use the tool described at blogs.msdn.com/…/6458047.aspx to collect all of your setup log files, upload the file named %temp%vslogs.cab that this tool will create to a file server (such as http://onedrive.live.com), and then reply back here and provide a link that I can use to download your log files and take a closer look?

  292. Ravi Kumar says:

    I was trying to install visual studio 2013 with update 2 in my windows 8.1 pc. The installation stops and returns error "Update 2 doesn't apply or is blocked by another condition on your computer". Please help me in sorting out this problem

  293. Hi Ravi Kumar – That type of error usually means that the product that the update applies to isn't installed on the computer.  I'd suggest making sure that you have VS 2013 installed and that you downloaded Update 2 for VS 2013 (I've seen folks accidentally download VS 2012 updates, which is why I mention this).

    If that doesn't help, then I'd suggest posting a question on the Visual Studio setup forum to see if someone there can offer other suggestions for you to try.  You can find that forum at social.msdn.microsoft.com/…/home.

  294. ... :( ... says:

    This doesn't working for me.. Thank you..

  295. Hi … 🙁 … – I can try to help, but you need to provide more detailed information. What isn't working for you, and what exact error messages are you seeing on your computer currently?

  296. Mehboob88 says:

    hi sir ,

    i have tried this but same error.

    "error in opening installation log file. verify that specified log file location exists and that you can write to it."

    please help to solve this..

  297. gyox@live.com says:

    The same all the time, of course inside the every blog. Words, bla, bla, bla , and not solutions or serious guide to confront the problem.

  298. Hi Mehboob88 – If SubInAcl didn't fix the permission problem, you might need to manually update folder and file permissions on your computer using Windows Explorer instead.  What exact application are you trying to run when you see that error?  Do you know what location it is trying to open the log file from?

  299. Mehboob88 says:

    i m trying to instal Visual studio 2013..

    how i can manually update that log file permission as i don't know its actual location…??

    any method

  300. Hi Mehboob88 – Visual Studio 2013 creates log files in the %temp% directory on a computer.  There are a lot of different guides that describe how to manually change file and folder permissions in Windows.  For example – technet.microsoft.com/…/cc754344.aspx and http://www.wikihow.com/Change-File-Permissions-on-Windows-7.

    If you get stuck, there is also a VS setup forum that you can post questions like this at – social.msdn.microsoft.com/…/home.

  301. Mehboob88 says:

    well i have also asked there but getting very slow response..

    and manually i have changed permissions of files present in %temp% directory but still facing same error,

    don't know how to get rid off from this error :/

  302. Hi Mehboob88 – When new files are created, they typically inherit default permissions from the directory that they are being created in.  If you haven't yet, you should also update the permissions to the %temp% directory itself, not just the files in the directory.

  303. Mehboob88 says:

    still same error 🙁

    "error in opening installation log files. verify thta specified log file location exist and you can write to it"

  304. Hi Mehboob88 – I'm sorry for the continued hassles here.  It might help to use a tool like Process Monitor to narrow down exactly what path setup is attempting to create the log file at in case it is somewhere other than %temp%.  You can download Process Monitor from technet.microsoft.com/…/bb896645.aspx if you want to try that out.

  305. Mehboob88 says:

    hi Aron,

    it is giving error in installing Process Monitor that it can not find procmon64.exe in temp directory.

    i think it is my pc permission problems.

    doesn't it…?

  306. Hi Mehboob88 – Yes, this sounds like a permission problem.  It sounds like the manual steps you took previously to change the permissions on %temp% didn't work as expected.  It might help to try to reset the security permissions on your computer by using steps like the ones in the knowledge base article at support.microsoft.com/…/313222.

  307. Mehboob88 says:

    no relief,

    would reinstalling my OS will help me to get rid off from this problem….??

  308. Hi Mehboob88 – Yes, an OS repair/re-install should resolve this type of problem.  Before trying that, you might also want to try to create a new user account and log in with that and see if you have the same problems there.  The %temp% folder is different for each user, so creating a new user account might help.

  309. Mehboob88 says:

    well i think i have tried each and every thing to resolve this problem including this :/ but…

    well sincere thanks to you for being here every time 🙂

  310. thank you forever says:

    i am chinese 谢谢你的文章让我修复了这个c2005的无法顺利安装的错误,非常感谢!

  311. pk says:

    i installing the visual studio 2012 on my laptop.os is windows8 but there access denied problem is occure.i also try subACL tool but problem not solve. step no 6 i don't undestand.plz guid in brief.

  312. pk says:

    access denied problem is occure in visual studio 2012.i also used subACL tool but not solved that problem.step no 6 don't understand.plz guid in brief.my laptop os is windows 8

  313. Hi pk – Can you please use the tool described at blogs.msdn.com/…/6458047.aspx to collect all of your setup log files, upload the file named %temp%vslogs.cab that this tool will create to a file server (such as http://onedrive.live.com), and then reply back here and provide a link that I can use to download your log files and take a closer look?

  314. Gerald James says:

    Aaron,

    I need help with windows 7 update and hope you can help…

    The windows update has not worked for some time now and I have given up before finding your blog. I followed the post instruction and everything seems to have run fine with many items been changed correctly and just .25% failing. I would like to send you the log file for you to review…

    After receiving the finish statement I reran the windows 7 update but it did not work for me.

    Please let me know if you can help, and what I need to do to help you help me…

    Gerald James

  315. Hi Gerald James – If you haven't yet, I'd suggest using the information in the knowledge base article at support.microsoft.com/…/971058 to try to reset your Windows Update components.

    If that doesn't help, then please zip and upload the log files from the failing update to a file server (such as http://onedrive.live.com), and then reply back here and provide a link that I can use to download your log files and take a closer look.

  316. Gerald James says:

    I followed the instructions above with no success, I have placed reset.cmd.last and subinacl_output.txt in onedrive.live.com but have no way to add link to this note…help

  317. Hi Gerald James – Which instructions did you follow?  The knowledge base article to reset Windows Update components, the steps at the top of this blog post, or both?

    I don't need reset.cmd.last or subinacl_output.txt in this scenario.  If possible, can you upload one or more of the logs for the updates that you're trying to install that are failing?

  318. Gerald James says:

    I originally followed your post instructions and that is the subinacl_output.txt that I have saved in onedrive.live.com as you suggested. I do not know how to send you a link to that file. Please help with that question so you can then help after receiving my subinacl_output.txt file.

    Thank you in advance, for your help…

    Can you send an email to my email on file so we can speed thing up, Gerald

  319. Gerald James says:

    Where and under what file name do I find the log file to send to you after running the update?

  320. Hi Gerald James – I don't have access to your email on file.  You can use the Email Blog Author link at the top left of my blog to send me an email (blogs.msdn.com/…/contact.aspx).

    You should be able to right-click on the file in OneDrive and copy a shortcut to it from there.

    The log file names for the failing updates depend on which exact updates are failing.  I think most Windows updates will create logs in %temp%, so you might want to try to search there and sort by last modified times to see if you can find them.  You might also get a more useful error message if you try to manually download the update and try to install it yourself instead of letting Windows Update install it for you.  Windows Update runs the updates in silent mode, and that suppresses a lot of the possible error messages, which makes troubleshooting trickier.

    Also, I am not an expert with troubleshooting Windows Update installation issues, so you might get a faster resolution for this issue by posting a question on the Windows 7 forum at answers.microsoft.com/…/windows_7.

  321. Gerald James says:

    Here is the subinacl_output.txt file:

    <iframe src="onedrive.live.com/embed width="98" height="120" frameborder="0" scrolling="no"></iframe>

  322. V.R says:

    hi Aaron

    I checked the subinacl_output.txt file and there are many many lines

    but the first lines are like this:

    "SeSecurityPrivilege : Access is denied."

    WARNING :Unable to set SeSecurityPrivilege privilege. This privilege may be required.

    HKEY_CURRENT_USER – QueryObjectSecurity Error : 1314 A required privilege is not held by the client.

    and sometimes these phrases appear again and again:

    "RegSetKeySecurity Error : 1307 This security ID may not be assigned as the owner of this object."

    "RegSetKeySecurity Error : 5 Access is denied."

    "6 : Unable to enumerate subkeys"

    "CreateFile Error : 1314 A required privilege is not held by the client."

    I have read other requests but I don't understand anything at all

    so please, can you help me with this?

  323. Hi Gerald James – I don't see any errors in the subinacl_output.txt file that you uploaded.  Did you have any luck finding log files from the failing updates in your %temp% directory?  The file c:windowswindowsupdate.log might also have more information about the failures.  If you can upload that, I can try to take a quick look and see if I can spot anything there.

  324. Hi V.R. – Those errors might be caused by not running the script with elevated privileges, or maybe you missed the step to change YOURUSERNAME to the actual user name that you are logged in with?

    If neither of those suggestions help, then you might need to manually update your registry permissions instead of using subinacl.exe.  You can use instructions like the ones at http://www.ehow.com/how_5074690_change-registry-permissions.html to do that.

  325. Snatr says:

    Just wanted to say thank you. Was having trouble with updates. Also was having trouble with restore points- Not sure if it fixed that yet.

    PS: Didn't see the log in the temp folder btw. Had a lot of errors too. But all is well I suppose 🙂

  326. Mike says:

    Excellent desk & nice tweaking for requirement !!

    Just one question : Is the user to whom the permission is granted => he will be able to uninstall the application or software from control panel  ????

    Thanks

    Mike

  327. Hi Mike – The permissions that are granted by these subinacl commands does not change whether or not the current user is allowed to uninstall an application.  Most applications require Administrator privileges in order to uninstall, so the user account that you're using to perform the uninstall will need to be in the Administrator group or you will have to provide Administrator account credentials when Windows prompts you for elevation during the uninstall process.

  328. Shrikant Aralikatti says:

    Thank you very much for this document. It solve my problem.

  329. Thank you so much!!!! says:

    I had issues with Error 5 and Error 87 and this solved everything 🙂

  330. Frustrated says:

    I'm running the reset.cmd (Resetting ACLs) prompt now but it's saying that everything modified has also failed.  

    What does that mean?  That no changes have been made to the Registry??????

    I followed your instructions to the letter, but I used my administrator name instead of just "administrator."  

    I've got tons of registry problems in Vista Home Premium and without a degree in computer programming it's trial and error for me.

    Thank you for your time.

  331. Hi Frustrated – I'm sorry for the hassles that this issue is causing for you.  What are the exact error messages that you're seeing when you try running reset.cmd on your computer?  Also, can you double-check that you ran reset.cmd from an elevated cmd prompt (step 2 of the instructions in the main blog post)?

  332. Ian says:

    Is it normal that almost half the attempts fail?

    I'm on windows 8.1 and got this problem after changing my laptop SSD and cloning the old one.

  333. Hi Ian – No, I don't think that's normal.  Can you double-check that you ran reset.cmd from an elevated cmd prompt (step 2 of the instructions in the main blog post)?  Also, for the commands that fail, what exact error message is being reported by subinacl.exe?

  334. ian says:

    Hi Aaron, thanks for the fast reply,

    The code sort of rerun a second time it seems within 1 session [i had thought it stopped] and this gave no failiurs. However even after restarting i still cannot install the update. My laptop has also been slower since i swapped my SSD, not sure if this is related.

    I do have a 2gb log file generated, anything useful i can share with you in here?

    thanks for you help.

    ian

  335. Hi Ian – What update are you trying to install, and what is the exact error that you see when you try to install it?  If you have a log from the failing update install, that would be the most helpful thing for me to be able to look at to try to help you figure out possible next steps.  If you have that, can you zip and upload it to a file server (such as http://onedrive.live.com) and then reply back here and post a link that I can use to download the log and take a closer look?

  336. ian says:

    the update is :

    Definition Update for Windows Defender – KB2267602 (Definition 1.191.1774.0)

    Download size: 112.9 MB

    Update type: Important

    Install this update to revise the definition files that are used to detect viruses, spyware, and other potentially unwanted software. Once you have installed this item, it cannot be removed.

    More information:

    http://www.microsoft.com/…/overview.mspx

    Help and Support:

    go.microsoft.com/fwlink

    and the error in windows update is:

    WindowsUpdate_80070005 OR WindowsUpdate_dt000"‎ (1)

    Not sure how to get the logfile for windows update

  337. Hi Ian – I'd suggest trying to manually download and install the latest Windows Defender definition updates using the instructions at support.microsoft.com/…/923159.  I found some forum posts that indicated that these updates can install successfully in some cases where they fail via Windows Update.

    If you try to manually install and it still fails, then hopefully there will be a log created in your %temp% that will give more detailed information about the cause of the failure.

  338. ian says:

    when i open the file 'mpas-feX64.exe' nothing happens.

    Tried to open it as admin, the cursor loads for a while but nothing happens.

    Regarding the registry do you think i will have problems in the future because of this? should i just format my system? Is it easy to recover the windows key of a laptop bought with windows 8?

    thanks, i need to sleep now, laters and thanks again

  339. Hi Ian – I'm sorry, but I don't know how to explain why that file won't run for you.  Maybe the steps at http://www.eightforums.com/…/5906-windows-defender-kb2267602-update-fails.html will help fix that issue?  I also found information at answers.microsoft.com/…/6cf718ae-c1ff-49fb-87c6-5ac46f140ff2 that indicates that you may need to run the definition update installer in Windows 8 compatibility mode when you try to install it on Windows 8.1.

    I don't think you need to format your computer because of this issue.

  340. ian says:

    Thanks a lot aaron but i'm suspecting other things went wrong when i upgraded my hard disk and cloned it. The laptop is considerably slower with a faster SSD, e.g. the log in screen picture doesn't load always and the wifi icon etc freezes in 1 place and an other one appears a few pixels above it.

    A clean install i think would be the best solution right now. Pity that i will have to buy a new licence i think since i do not have an iso or something to create a usb windows installer

  341. EldarGoren says:

    Hi Aaron ant thx.

    but or me it doesn't working..

    im trying to download Visual Studio 2013 and every time i download after few seconds i get a massage "Setup Engine Access is denied". Now after i did what you post it immediately shows that massage. thanks again and please help. btw i have windows 7 64bit.

  342. Hi EldarGoren – That error you describe is specific to Visual Studio setup, and subinacl won't help you solve it.  I'd suggest searching for that error text in the Visual Studio setup forum at social.msdn.microsoft.com/…/home and trying the recommended solutions there.  If those solutions don't help, then I'd suggest posting a new question in that forum and hopefully someone there will be able to help you solve this problem.

  343. EldarGoren says:

    thanks man and thanks for fast answer 🙂

  344. EldarGoren says:

    Hi, its me again.. 😉

    I entered to the log file and i see now a lot of "RegSetKeySecurity Error : 5 Access is denied."

    So i didn't understand what to do next.

  345. Hi EldarGoren – Which exact registry keys/values are you seeing that error for?

    Also, can you please double-check that you ran reset.cmd from an elevated cmd prompt (step 2 of the instructions in the main blog post)?  

  346. EldarGoren says:

    Hi Aaron

    All of the registry keys had the error..

    I ran it through start/run/cmd im now trying to do like step 2 but i already seeing thousands of failed.

    thank you for helping

  347. Hi EldarGoren – If you're sure that you're running from an elevated cmd prompt, then I don't know how else to explain failures changing the permissions for every single registry key.  You might need to use a different solution to update your registry permissions if subinacl doesn't work for you.  The steps listed at support.microsoft.com/…/310426 can be used to manually change registry permissions for example.

    If that doesn't help either, then I'd suggest posting a question on one of the Windows forums at answers.microsoft.com/…/windows to see if someone there can offer any other workarounds for you to try.

  348. EldarGoren says:

    I got tens of thousands that failed.

    still doesn't working.

  349. EldarGoren says:

    haha i wrote the last comment and then yours just pop up. Im trying now what you suggested.

  350. EldarGoren says:

    Just one last thing. i noticed that just the HKEY_CURRENT_USER is okay and when it finish with the HKEY_CURRENT_USER those are these lines:

    SeSecurityPrivilege : Access is denied.

    WARNING :Unable to set SeSecurityPrivilege privilege. This privilege may be required.

    HKEY_CURRENT_USER – QueryObjectSecurity Error : 1314 A required privilege is not held by the client.

    SeSecurityPrivilege : Access is denied.

    WARNING :Unable to set SeSecurityPrivilege privilege. This privilege may be required.

    HKEY_LOCAL_MACHINE – QueryObjectSecurity Error : 1314 A required privilege is not held by the client.

    HKEY_LOCAL_MACHINEBCD00000000 : 5 Access is denied.

    and then it starting with the access is denied in all the HKEY_LOCAL_MACHINE.

    and after the HKEY_LOCAL_MACHINE there is the HKEY_CLASSES_ROOT that in this key some are good and some are not.

    hope its helping so you can understand, if its not ill go to windows forums.

    thank you.

  351. Hi EldarGoren – The BCD00000000 error is normal.  For the other HKEY_LOCAL_MACHINE keys that you see this error for, are you able to update any of their permissions using the manual steps at support.microsoft.com/…/310426

  352. Will says:

    Have a lot of issues trying to Install a specific program for a client. I receive this error.

    Error 1402. Could not open key: HKEY_LOCAL_MACHINE32SoftwareClassesInterface{BEF6E003-A874-101A-8BBA-00AA00300CAB}ProxyStubClsid

    Have tried running your script without success. Changed permissions for that specific key, no success. Changed users, used local admin rights and still nothing.

    Although 1 question i'd like answered .. what is with the "HKEY_LOCAL_MACHINE32" – It does not exist in the registry ?? Thank you!

  353. Will says:

    Never mind – HKEY_LOCAL_MACHINE32 Means 32BIT Regsitry which is in HKEY_LOCAL_MACHINESoftwareWOW6432Node

  354. Hi Will – That's correct.  Were you able to manually update the permissions for that registry key when you went to the 32-bit registry location in regedit.exe?

  355. Will says:

    Hi Aaron Stebner

    I had to take ownership of the key before I could edit in permissions. Although everything works now and it installs fine.

    I just had to analyse that error a lot, then realised HKEY_LOCAL_MACHINE32 could only mean 32bit reg key.

    Thanks anyway 🙂 (Love the article by the way)

  356. Zoltan says:

    Hello,

    I have found your blog searching for a solution for VC++2012 redistributable package installation problem. It gave me error code 0x80070005, access denied. The relevant part of the log: [1F24:1BE4][2015-01-24T16:33:32]: Error 0x80070005: Failed to register the dependency on package dependency provider: Microsoft.VS.VC_RuntimeMinimum_x86,v11

    So I tried your batch. It is failing on some thousands of keys. A lot of them work, but not all. The error message is: access denied.

    Before you ask: I am running the batch in an elevated command prompt, otherwise much more would fail.

    I manually checked some failing key, and found it owned by "TrustedInstaller" and SYSTEM and Administrator having only read access.

    So maybe that is the key.

    While I was searching for any reference to {33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}, I have found the keys:

    HKEY_CLASSES_ROOT/Installer/Dependencies/Microsoft.VS.VC_RuntimeMinimum_amd64,v11

    HKEY_CLASSES_ROOT/Installer/Dependencies/Microsoft.VS.VC_RuntimeMinimum_x86,v11

    HKEY_CLASSES_ROOT/Installer/Dependencies/Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v11

    HKEY_CLASSES_ROOT/Installer/Dependencies/Microsoft.VS.VC_RuntimeMinimumVSU_x86,v11

    I tried to display access rights on it, but the system said: "I have no right to display rights, but I can change ownership" (or something like that, in my national language).

    So I did exactly that: I changed the ownership of these keys to "Administrators", and _then_ granted fullcontrol to SYSTEM and Administrators.

    After that I was able to repair installation of the vcredist packages.

    The only question remains: How could it went wrong in the first place?

    There are thousands of reg.keys with similar ownership ( HKEY_CLASSES_ROOT/Installer/Dependencies/Microsoft.ASP.NET.mvc_runtime,v4 to mention the most closest), I wonder what kind of problems will it mean in the future?

    Thanks,

    Zoltan

    ps: some guy earlier run into the problem the script failed with the hungarian name of Administrator (which is: Rendszergazdák). Unfortunately it contains a non-English letter (what a bad idea!). It is a code-page problem, I think the editor saved the script in UTF-8. I don't know what codepage should I use, so I solved the problem by copy and paste the individual subinacl commands into an elevated cmd window one by one. Not to smart, but worked for me.

  357. Hi Zoltan – I'm not sure how those registry keys under HKCRInstaller got into the state where they were owned by TrustedInstaller and your SYSTEM account and Administrators group only had read access.  On my PCs, the equivalent keys are owned by SYSTEM and both SYSTEM and Administrators have read/write access.  I suspect you'll face similar access denied errors if you end up needing to repair/uninstall any other products on this computer that write data to that part of the registry.  You might need to go to the parent of all of these registry keys and change ownership and permissions from there and choose the option to have sub-keys inherit the changes in order to fully solve this issue.

  358. loshiye sindiyo says:

    Thank u

    I followed all 12 steps but after open the cmd command and typing the word reset.cmd after pressing enter it fail since it is not recognized as the internal or external command, operable program or file. what can i do?

  359. Hi loshiye sindiyo – That error means that reset.cmd is not located in the directory that your cmd prompt is pointing to.  If you type dir in the cmd prompt, you shouldn't see reset.cmd there.  You'll need to either copy reset.cmd to that directory or use the cd command to change directories in your cmd prompt to the directory that reset.cmd is located in on your computer.

  360. Aurora says:

    Thank you for all of this

  361. Marius says:

    Is this valid for Windows 8 64 bit?

  362. Hi Marius – I haven't heard of anyone reporting any problems when trying to run subinacl.exe on Windows 8 in the past, so I think it should work fine for you.

  363. Alex says:

    Well, I had an issue with installing an update, and did exactly as this said, and it didn't work. I'm running Windows 8.1. However, I am also working on an account that's had some of it's administrative permission changed, somehow, despite it being the starting account when I got my computer and being an admin account by default. I do have a backup full administrative account, but am wondering if I should run this with the parameters for the account I want the permissions corrected on, on the full administrative account, or if it will not work doing so. Please help, this has been an issue plaguing me for a while now.

  364. Hi Alex – I'm not sure if subinacl.exe will work correctly if you're trying to reset the permissions of an administrator account that is different from the one you're currently logged in with.  You can definitely try it and see how it goes though.  You might need to manually update the owners and change permissions using regedit.exe.  You can use steps like the ones at support.microsoft.com/…/310426 to do that.  That article says that it applies to Windows XP, but the instructions are the same for newer versions of Windows too.

    It would also be worth double-checking to see if you can install the Windows update that is currently failing with your other administrator account.  That would help narrow down whether it is a permissions issue specific to your user account or if there is some other problem on this PC that is causing the update to fail to install.

  365. Doc Sheldon says:

    Hello, Aaron-

    First, thanks so much for putting together this resource… I hope I can find my issue with it. However, I'm having some problems.

    I downloaded the subinac1 file and saved it per your instructions above. When I tried running it from the command prompt, it returned this:

    ***ERROR*** – Could not find file c:Program Files (x86)Windows Resource KitsToolssubinac1.exe. Double-check that SubInAc1 is Correctly installed and re-run this script.

    By the way, when I tried to access notepad %temp%subinacl_output.txt from the Run line, I'm told it cannot be found, and it asks if I want to create it.

    I'm running Win7 Ultimate, 64 bit

    Any ideas?

  366. Hi Doc Sheldon – The file is named subinacl.exe with the letter L at the end, but it looks like you're trying to run it with the name subinac1.exe with the number 1 at the end.  Can you try fixing the name and seeing if that helps resolve this issue?

  367. Doc Sheldon says:

    I typed the filename incorrectly here, Aaron. The file I originally downloaded and installed was L, not the number 1.

  368. Hi Doc Sheldon – Just to confirm, you're saying that you have the file c:Program Files (x86)Windows Resource KitsToolssubinacl.exe on your computer, and you're still getting an error saying that it could not find the file c:Program Files (x86)Windows Resource KitsToolssubinacl.exe?  If so, I don't understand how that would be happening.  Can you upload a screenshot of the exact command that you ran and the exact error message that you're seeing so I can try to take a closer look?

  369. Doc Sheldon says:

    No, Aaron – In fact, checking with Explorer, the WIndows Resource Kits folder doesn't even exist.

  370. Hi Doc Sheldon – If you install SubInAcl from http://www.microsoft.com/…/details.aspx and choose the default install path, it will install subinacl.exe to c:Program Files (x86)Windows Resource KitsTools.  Can you please double-check that you've done this step?

  371. Doc Sheldon says:

    Aaron, in the instructions above, it says to save and close, but gives no specific location. Can you clarify where it should be saved?

  372. Doc Sheldon says:

    No "default install path" is offered, Aaron. I see in your code that it will look for the Windows Resource Kits folder (which doesn't exist), but I don't see that it'll do anything but return that error if it's not found.

  373. Hi Doc Sheldon – When you go to http://www.microsoft.com/…/details.aspx, you download a file named subinacl.msi.  When you run subinacl.msi, it will launch a setup wizard UI, and clicking through the UI shows a page like this – onedrive.live.com/redir.  That is where the default install path is shown.

  374. Doc Sheldon says:

    Ah, okay. I just downloaded the file from http://www.microsoft.com/…/details.aspx and followed the instructions above. I'll try it that way.

  375. Doc Sheldon says:

    Since I don't have the Windows Resource Kits folder or its subfolder Tools, should I create those?

  376. Hi Doc Sheldon – No.  Installing the MSI will create those folders automatically.

    Instruction 1 above says "Download the SubInACL tool and install it."  If you think that step isn't clear enough, please let me know what wording you would suggest to indicate that you have to install the .msi file, not just download it.

  377. Doc Sheldon says:

    Okay, point taken, Aaron. 😉 I had created the reset.cmd file, and I confused that with the install… my bad.

    Now I'm faced with another roadblock… when I attempt to install the .msi file, my system won't do it because I'm trapped in Safe Mode. So I have no Windows Installer service. (And I tried using System Restore numerous times, but it fails.

  378. Hi Doc Sheldon – If you can't get the .msi to install on your computer, then you'll need to try the workaround in the "Issue 2" section of this blog post – blogs.msdn.com/…/8613982.aspx.

  379. Doc Sheldon says:

    okay, Aaron, I went through that procedure, using the .zip version, but when I tried to install it, using msiexec /i subinacl.msi /qb from the command prompt, I get a similar error:

    i38.photobucket.com/…/Microsoft%20Windowsnbsp2000%20Resource%20Kit%20Tool%20Download%20Release%20Notes_2015-04-14_13-15-59_zpshatf0trv.png

    is there any other way to force my Windows Installer Service to start, even though I can't get out of Safe Mode?

  380. Hi Doc Sheldon – Windows Installer will not work in safe mode.  However, the steps in "Issue 2" in the blog post at blogs.msdn.com/…/8613982.aspx don't say anything about installing an .msi.  They say to download the file named subinacl.zip and then extract the contents of the .zip file to a folder on your computer.  Can you please try doing that instead?

  381. Doc Sheldon says:

    I did that, Aaron. Issue 2 then directs me back to this post:

    "3. Use the steps in the previous blog post to run SubInAcl from the extracted location"

    The readme file in the extracted subinacl.zip file instructed me to install the .msi file from the command prompt.

    Obviously, I'm doing something wrong. And just as obviously, your patience seems to be running thin. But frankly, the entire process is a bit confusing to someone that has a LOT less technical chops than you do. I'm just trying to get some assistance in understanding exactly what I need to do (and apparently, NOT do, as well).

  382. Hi Doc Sheldon – I'm sorry for the confusion.  I've updated the other blog post (blogs.msdn.com/…/8613982.aspx) to try to eliminate this confusion.  Can you please take a look at the updated steps and see if you are able to run subinacl.exe after following the updated steps?

  383. Doc Sheldon says:

    Thanks, Aaron. I'm a little unclear on how to edit, per your new step #2:

    "Depending on where you extract the zip file to in step 2 above, you may need to edit reset.cmd and change the folder path that it is trying to run subinacl.exe from"

    I extracted the .zip file into a folder I named "subinacl" in My Documents…  C:UsersDocDocumentssubinacl

    But I'm unclear on which path needs to be edited in the reset.cmd file. Can you clarify for me?

  384. Doc Sheldon says:

    Would I just edit this line:

       pushd "%ProgramFilesPath%Windows Resource KitsTools"

    to read:

       pushd "UsersDocDocumentssubinacl" ?

  385. Hi Doc Sheldon – There are a few places you'll need to change.  Assuming that you have saved the file to C:UsersDocDocumentssubinaclsubinacl.exe, then you need to do the following:

    This line:

        if exist "%ProgramFilesPath%Windows Resource KitsToolssubinacl.exe" goto filesExist

    Should change to this:

        if exist "C:UsersDocDocumentssubinaclsubinacl.exe" goto filesExist

    This line:

        pushd "%ProgramFilesPath%Windows Resource KitsTools"

    Should change to this:

        pushd "C:UsersDocDocumentssubinacl"

  386. Doc Sheldon says:

    Hooray! It's running! Now I just hope it does the trick.

  387. Doc Sheldon says:

    Okay, it completed. In the sequence of the runs scheduled by the reset.cmd file, this is what it shows:

    0 failed

    0 failed

    57,676 failed RegSetKeySecurity Error = 5 Access is denied

    0 failed

    46k842 failed RegSetKeySecurity Error = 5 Access is denied

    0 failed

    0 failed

    0 failed

    Any thoughts, Aaron? Should I attempt a reboot now, to see if it will load Windows in Normal Mode?

  388. Hi Doc Sheldon – I think it is worth trying to boot Windows in normal mode now.  I don't know what exact problems you were having that led you to try running subinacl.exe in the first place though, so I can't tell from your screenshot whether or not to expect your problems to be fixed or not.

  389. Doc Sheldon says:

    Aaron – I can't tell you how much I appreciate

    (a) the effort you put forth to publish this wealth of information to begin with;

    (b) your assistance to a semi-literate hack in trying to troubleshoot/repair a machine;

    (c) your patience with said hack.

    With that said, I'll give it a try and see if the gods are in a good mood.

    Thanks again!

  390. Doc Sheldon says:

    Well, it looks like it's just not my day. Even when I go into setup during the boot process and select Normal Mode, it boots in Safe Mode.

    Aaron, do you, or anyone you could recommend, provide remote troubleshooting and system repair services? Is remote access even possible in Safe Mode? I'm desperate to get this system running again, and if I have to pay someone to help, so be it.

  391. Hi Doc Sheldon – I'm sorry to hear that you're still running into problems booting your PC after running subinacl.exe.  I don't personally know of anyone who provides PC troubleshooting/repair services.  I don't think remote access is possible in Safe Mode, so you might have to have someone come to your location or take your PC to a repair shop.

    Before doing that, I'd suggest posting a question on the Windows 7 forum at answers.microsoft.com/…/windows_7 to see if someone there has any additional troubleshooting suggestions for you to try out.

  392. Please Help says:

    I get the 80070005 error when trying to update windows via control panel. HELP please

  393. Allen Austin says:

    Hi guys, please help me! I get thrown the error when I try to update windows 7 Home Premium, with the throwback of 80070005. Would be highly appreciated if anyone could help me.

  394. Hi Please Help and Allen Austin – SubInAcl can help solve errors like this in some cases, so I'd suggest trying the steps at the top of this blog post if you haven't yet.  If you tried those steps and they didn't help, then I'd suggest posting a question on the Windows forum at answers.microsoft.com/…/windows_7 to see if someone there can suggest some other steps for you to try.

  395. edwin says:

    visual studio update 4 doesn't want to install it says set up blocked

  396. Hi Edwin – What is the exact text of the error message that you see in this scenario?  Can you please use the tool described at blogs.msdn.com/…/6458047.aspx to collect all of your setup log files, upload the file named %temp%vslogs.cab that this tool will create to a file server (such as http://onedrive.live.com), and then reply back here and provide a link that I can use to download your log files and take a closer look?

  397. Mauro says:

    Aaron, kudos for supporting this command-line script for 8 years!

  398. Eric says:

    You sir, are brilliant.  I've spent many hours trying to solve why my amd radeon r9 2oo series graphics card could not be updated with the latest driver.  I kept getting access denied & google searches were unable to solve.  This worked.  Thanks!

  399. edwin says:

    please help I tried your suggestion but still the same visual studio update 4 doesn't want to install it's just saying "update 4 does not apply or is blocked by another condition on your computer". please help me

  400. Hi Edwin – The error you describe doesn't sound like something that is typically able to be solved by changing file/folder/registry permissions with SubInACL.  Usually that error means that the version of Visual Studio that the update applies to is not installed.  If you can upload your vslogs.cab like I described in my previous reply, I can try to take a look and see if I can narrow it down further.

    Alternatively, you can post a question on the Visual Studio setup forum at social.msdn.microsoft.com/…/home to see if someone there has any additional suggestions.

  401. edwin says:

    [070C:04D0][2015-06-08T20:21:48]i001: Burn v3.7.3424.0,[070C:04D0][2015-06-08T20:21:48]i000: Initializing string variable 'EditionDisplayName' to value '#loc.vsupdatededitiondisplayname'

    [070C:04D0][2015-06-08T20:21:48]i000: Initializing string variable 'FactorMsi' to value '1.3'

    [070C:04D0][2015-06-08T20:21:48]i000: Initializing numeric variable 'MoreLanguageFwlinkId' to value '427825'

    [070C:04D0][2015-06-08T20:21:48]i000: Initializing numeric variable 'PrivacyAgreementFwlinkId' to value '427803'

    [070C:04D0][2015-06-08T20:21:48]i000: Initializing numeric variable 'PrivacyStatementFwlinkId' to value '427803'

    [070C:04D0][2015-06-08T20:21:48]i000: Initializing numeric variable 'MinOsLevelFwlinkId' to value '427813'

    [070C:04D0][2015-06-08T20:21:48]i000: Initializing numeric variable 'SolutionFwlinkId' to value '427804'

    [070C:04D0][2015-06-08T20:21:48]i000: Initializing numeric variable 'HelpFwlinkId' to value '427805'

    [070C:04D0][2015-06-08T20:21:48]i000: Initializing numeric variable 'IE10FwlinkId' to value '427807'

    [070C:04D0][2015-06-08T20:21:48]i000: Initializing numeric variable 'WinBlueFwlinkId' to value '427810'

    [070C:04D0][2015-06-08T20:21:48]i000: Initializing numeric variable 'SHA256BlockFwlinkId' to value '427811'

    [070C:04D0][2015-06-08T20:21:48]i000: Initializing numeric variable 'Win81PreRelBlockFwlinkId' to value '427809'

    [070C:04D0][2015-06-08T20:21:48]i000: Initializing string variable 'NetfxProductVersion' to value '4.5.31101'

    [070C:04D0][2015-06-08T20:21:48]i000: Initializing string variable 'ProfessionalVSVersion' to value '11.0.50727'

    [070C:04D0][2015-06-08T20:21:48]i000: Initializing string variable 'BaselineBundleVersion' to value '12.0.21005' [070C:04D0][2015-06-08T20:21:52]i101: Detected package: sqlsysclrtypes_Sql2014_amd64_rus, state: Absent, cached: None

    [070C:04D0][2015-06-08T20:21:52]i101: Detected package: sharedmanagementobjects_Sql2014_x86_rus, state: Absent, cached: None

    [070C:04D0][2015-06-08T20:21:52]i101: Detected package: sharedmanagementobjects_Sql2014_amd64_rus, state: Absent, cached: None

    [

  402. Hi Edwin – Unfortunately, that isn't enough information to narrow down the root cause of the error that you're seeing.  Can you please use the tool described at blogs.msdn.com/…/6458047.aspx to collect all of your setup log files, upload the file named %temp%vslogs.cab that this tool will create to a file server (such as http://onedrive.live.com), and then reply back here and provide a link that I can use to download your log files and take a closer look?

  403. LUANE says:

    QUERO SABER COMO RESOLVER ESSE PROBLEMA NO WINDOWS 7 ULTIMATE

  404. Snoy says:

    Hi Aaron,

    I am trying to install a McAfee Agent in my Windows XP SP3 system & it successfully installed without any error. Looking at the services, I found out that the McAfee Framework service has been stopped & being disabled which cause my McAfee Agent to fail. I have tried to start the service but it wont as it prompt that "service marked by deletion".

    I have tried the instruction you have provided but is seems it cant resolve the issue. Btw, I installed fresh Windows XP for testing if my old windows setup has problem but it looks like there is something in this system that makes the service be disabled upon installation.

    Hope you can help me with this matter.

    THanks.

  405. Snoy says:

    adding up it seems like the McAfee Framework Service & McAfee Registry disappear once I restart the system.

    Let me know if you have encounter same issue in the past.

    Btw, my installer is working fine as it can be used to other system without any problem encounter after installation.

  406. Hi Snoy – I'm sorry, but I'm not familiar with the McAfee issue that you're describing.  It doesn't sound like something that subinacl.exe would be able to fix though.  I'd recommend searching on McAfee's web site to see if they have any documented known issues, workarounds, or patches for this type of issue.

  407. Snoy says:

    Hi Aaron, thanks for your reply. It is just seems odd that this issue occur in a fresh windows system installed. BTW, i have tested the subinacle.exe & as what you have said, it cannot fix the issue.

    But I think your information is great 🙂

    Thanks again

  408. TBB says:

    Is it possible that GWX is the cause of this, in fresh windows installations?

    I had problems with Windows 7 that I noticed about 2-3 weeks after the GWX update. Because of this I moved to Windows 8. (I didn't want any problems to arise and I had already a copy of it anyway.) After this I had an update of GWX and one of W8.1 (I don't know what was installed first) and the same problem occured again.

    The reason I'm suspecting it to be GWX is because it behaves like malware. From the start you can't delete sheduled tasks or remove it from the taskbar without some edits in the registry (this was the way I found this, error 5, problem again). Also, this seems to be quite rare when you do a search, but at the same time it happened twice to me and once in a completely fresh windows installation (not an upgrade).

    Now the only possible way to go around this issue, assuming that the cause is GWX, is by making sure GWX doesn't get installed when you're reinstalling Windows or by moving to Windows 10 In other words, an OS that spies on you and causes microsoft support to explode in an epic fashion because of all the complaints. Too many times because of serious crashes. I'm honestly expecting a lot of rollbacks from Windows 10 (I'm aiming for 10-15%). My dad is already one of them (his PC was my experiment 😉 )

  409. TBB says:

    Don't mind my previous post. I just tested this on a Virtual Machine and found out that a fresh copy without access to the internet during and after the installation already has thousands of RegSetKeySecurity errors (I must have typed that a million times by now).

    This means that it's normal to have thousands of these errors and I didn't know that (I'm assuming because Windows is not open source?).

    So for anybody not knowing this: Windows 8 is suposed to have a lot of RegSetKeySecurity errors (5), unless you're a computer (group: SYSTEM).

  410. Mark says:

    Try http://www.sevenforums.com  or  www.tenforums.com.

    I had a problem installing Visual Studio 2015 community and it would fail on registry entry permission. The entry had no permissions!  I had to manually add local account to and then go to advanced to change owner.  I finally was able to install VS 2015 with no errors. phew .  I almost considered using SubInACL.

    Microsoft really needs a reset registry command.

  411. Hi Mark – The issue you describe where the registry entry had no permissions at all sounds similar to the issue at brianpeek.com/…/weird-vista-registry-issue.  There is a way to restore default security permissions on Windows (support.microsoft.com/…/313222), but I'm not sure if it solves this particular issue or not.

    Also, side note, I typically recommend the official Microsoft Windows forums at answers.microsoft.com/…/windows for this type of issue.

  412. Mark says:

    From Vista to Windows 2015, are still having permission problems.  I've seen possible culprits UAC, OneDrive and even Homegroup.  I'm almost ready to bite the bullet and do a clean install.

  413. Mark says:

    I'm still having permission problem with CurrentVersionInstallerUserDataS-1-5-18Components

    How do I run SubInACL to fix the permissions? And will they change the entries that have no permissions?

  414. Hi Mark – There are a couple of options to fix this type of issue listed at the bottom of the post at brianpeek.com/…/weird-vista-registry-issue.

    Alternatively, you can manually update registry permissions by using regedit.exe.  There are steps for doing that at support.microsoft.com/…/310426.  That article says that it applies to Windows XP and Windows Server 2003, but the steps are equivalent in regedit.exe in newer versions of Windows too.

  415. Mark says:

    I'm all set VS 2015 installs and repairs on Windows 10 with no issues.

    VS 2008 doesn't install 100% on Windows 10. I think there are some compatibility problems but no permission issues.  Search for Visual Studio 2008 uninstall tool. That works.

  416. vijay kumar saxena says:

    Visual Studio 2015 permission solution if possible please mail to me or online update. Thanks

  417. Hi vijay kumar saxena – You'll need to provide more details about your scenario in order for folks to be able to help further.  What exact error are you seeing, and what are you doing with Visual Studio that causes the error to appear?

    If your issue occurs while installing Visual Studio, then can you please use the tool described at blogs.msdn.com/…/6458047.aspx to collect all of your setup log files, upload the file named %temp%vslogs.cab that this tool will create to a file server (such as http://onedrive.live.com), and then reply back here and provide a link that I can use to download your log files and take a closer look?

    Also, please note that there is a Visual Studio setup forum that might contain additional information about how to solve this type of problem – social.msdn.microsoft.com/…/home.

  418. Sonya Jazzercise owner says:

    All this sounds like French to me. i have downloaded the subinacl but am unsure of the process. Is there someone who can take over my pc and run this for me? I am desperate to get Itunes back on my PC. I use it for my job.

  419. Hi Sonya Jazzercise owner – If you don't feel comfortable following the steps listed at the top of this blog post, then I'd recommend working with a local computer repair technician or someone like that who can help you walk through the steps in person.

  420. YoMama...IsNiceLady says:

    Hats off to you for running a blog that is good enough to have Microsoft linking to it, while not running any banner ads to cover the hosting costs from the traffic MS sends your way, and providing timely responses for 8 YEARS to whatever people post.

    and the tool is nice 😉

  421. Tableau Online Training says:

    Thanks to this post , saved my time…

     

  422. BenO says:

    Many thanks for this blog post- I greatly appreciate it. Worked well after a co-worker's WIN7 Pro PC got infected with a virus and malware. A number of services would not run, due to Access Denied 0x8007005 errors. Good work!

  423. brett says:

    i am running windows 7 and have tried running all of the programs to reset my acls and most of the reseting fails

    i am not sure why but i have done everything i can to make this work. i am on a 64 bit system

    i am trying to update to windows 10 and have been unable to

    please any help would be amazing

  424. Hi Brett – For Windows 10 upgrade issues, I'd recommend posting a question on the Windows 10 forum at answers.microsoft.com/…/windows_10 and hopefully someone there will be able to provide additional troubleshooting suggestions for you to try out on your PC.

  425. Zod says:

    Helped me following your directions word for word. Windows 10 user happy! Was trying to download Origins for a game and would always stop at the same place. Finally stumbled upon your excellent guide and problem solved. Thank you !

  426. Peter says:

    Hello,

    i have a big problem with the reset.cmd….

    i'll try it often, but everytime there is a problem. What can i do? Here is my list.

    Please help me.

    Determine whether we are on an 32 or 64 bit machine

    Resetting ACLs…

    (this may take several minutes to complete)

    IMPORTANT NOTE: For this script to run correctly, you must change

    the values named Peter to be the Windows user account that

    you are logged in with.

    ==========================================================================

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume

    nts – HKEY_CURRENT_USER

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume

    nts – HKEY_CURRENT_USER

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume

    nts – HKEY_LOCAL_MACHINE

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume

    nts – HKEY_LOCAL_MACHINE

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume

    nts – HKEY_CLASSES_ROOT

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume

    nts – HKEY_CLASSES_ROOT

    System Drive…

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume

    nts – C:Program

    Windows Directory…

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume

    nts – C:Windows

    ==========================================================================

    FINISHED.

    Press any key to exit . . .

    Thank for help!!

  427. Hi Peter – I'm not sure what would cause the warnings that you're seeing on your PC.  Maybe there was some kind of copy and paste issue when you created your version of reset.cmd?  Can you upload the exact file that you ran on your PC to a file server (such as http://onedrive.live.com) so I can download it and double-check the command lines listed in there?

  428. Peter says:

    Hej Aaron,

    i load i up here: onedrive.live.com/redir

    Thank you very much for help!

  429. Peter says:

    Sorry, it was only the half link…

    onedrive.live.com/redir

  430. Hi Peter – I am not sure how to explain these errors.  Your copy of the script looks the same as the one I uploaded except you filled in your user name in place of the place-holder YOURUSERNAME value.  It seems to be complaining about the Administrators group name – is your version of Windows a non-English version that has the name of the Administrators translated?  If so, you should be able to update the script to use the SID instead of the group name.  You can find a list of SIDs for common Windows groups at support.microsoft.com/…/243330.

  431. Yuen says:

    dude i mistake copy paste to cmd. straight, is it will be okay, i mean without copy paste to notepad ??? after that i realize so i take second chance and do it right…

  432. Hi Yuen – The commands listed in this blog post won't run correctly if you copy and paste all of the text into a cmd prompt instead of creating a script and running the script.  There is logic to figure out the location of the Program Files folder and set a variable that is used by later commands, which will only work if you're running the commands from a script.

  433. TomH says:

    When I run reset.cmd I get the error message “Could not find file C:\Program Files (x86)\Windows Resource Kits\Tools\subinacl.exe. Double check that subinacl is correctly installed and re-run this script.”

    Subinacl.exe seemed to install without problems when I ran the msi file. I have double checked and subinaclacl.exe does exist in the correct directory. The file is dated 11/06/2004 and is 284KB in size.

    I created the Reset.cmd file by copying and pasting so there be no spelling mistakes. I found 2 occurrences of YOURUSERNAME which I changed to my account name.

    I hope that this is sufficient info.

    1. Hi TomH – I’m sorry, but I don’t know how to explain this behavior. The script is just checking for the existence of C:\Program Files (x86)\Windows Resource Kits\Tools\subinacl.exe, and I don’t know how that would fail if the file does exist at that location. If you want, you can try to update your copy of reset.cmd to remove that existence check and see if the rest of the script works correctly afterwards.

      1. TomH says:

        Thanks for the reply. Before I proceed could you please clarify where the SubInACL file should be. The msi seems to have placed it in a directory in Programs Files (x86), which I understand is for 32-bit programs. My PC is Win 7 64-bit. Should I try moving the Windows Resource Kits folder or is there a 64-bit version in the Windows download site that I have somehow managed not to download?

    2. AJ says:

      I copied the reset.cmd to same directory as subinacl.exe, removed the file exist check from reset.cmd and ran it.

  434. Hi TomH – The SubInAcl tool is a 32-bit tool and it is installed by a 32-bit MSI, so it will be installed to the 32-bit Program Files directory. On a 64-bit OS, the path should be C:\Program Files (x86)\Windows Resource Kits\Tools\subinacl.exe. On a 32-bit OS, the path should be C:\Program Files\Windows Resource Kits\Tools\subinacl.exe.

  435. Sheibi says:

    If you guys get the “internal or external” error on command prompt, just put the reset.cmd file in the default location that shows in the command prompt, FOR EXAMPLE in my case when I opened the command prompt the default location was “C:\Windows\system32” so i copied the “reset.cmd” in system32 folder & then when I entered the command “reset.cmd” it started the process.! Thanks..

  436. Tugrul TUBER says:

    Seventh line has more than once Double quotes.
    Please remove it.

    1. Hi Tugrul TUBER – I assume you’re referring to this line, correct?

      if “%PROCESSOR_ARCHITECTURE%”==”x86″ if “%PROCESSOR_ARCHITEW6432%”==”” goto x86

      If so, the double quotes at the end are intentional. This logic is checking to see if the PROCESSOR_ARCHITEW6432 is set to the empty string (or in other words, that the environment variable isn’t set).

      1. Redleh says:

        Just to let you know something about quotes. When copying the script directly from the page to notepad it may change the standard straight (let’s call it “vertical”) quotes to italic quotes. In my case the initial check failed until I changed. I also noticed that for some reason it replaced one of the quotes with a question mark. I just fixed by comparing the original code from the MS website and voila.

  437. Joe A says:

    This is a great script, but it appears the some functionality is achieved through one of the tools built in to the tweaking.com program here:

    http://www.tweaking.com/content/page/windows_repair_all_in_one.html

  438. kamol roy says:

    I cant setup visual studio .

    1. Hi kamol roy – I’ll need more information in order to be able to diagnose this type of problem. What version of Visual Studio are you trying to install, and what is the exact error message that you see? Also, can you please use the tool described at http://blogs.msdn.com/astebner/archive/2007/11/21/6458047.aspx to collect all of your setup log files and send me the file named %temp%\vslogs.cab that this tool will create so I can take a closer look?

  439. carbonterry says:

    Hello0,
    I get the message that the program could not be found even though it is properly installed in the correct location. Thoughts?

    1. Hi carbonterry – I think this might be caused by a formatting issue when copying and pasting the reset.cmd commands. I just tried copying and pasting them from https://blogs.msdn.microsoft.com/astebner/2006/09/04/solving-setup-errors-by-using-the-subinacl-tool-to-repair-file-and-registry-permissions/, and the quotation mark characters are being converted from standard quotes to formatted open and closed quotes, and those formatted quotes aren’t recognized when running the script. You can see if that is the issue in your scenario by opening your reset.cmd in notepad and changing the formatted open and closed quotes to standard quotes and then saving and re-running the script.

      1. beckythesooh says:

        Thank you. You have just saved a life.

  440. Jaakko Lehtniemi says:

    Hello.
    I’m having problems with Windows Update getting stuck and eating up all processor capacity.
    I tried to run the reset procedure as instructed, but it just flashes on the screen and doesn’t seem to do anything.
    My Computer has Windows 7 Sp 1 Home Premium.
    regards,
    Jaakko

    1. Hi Jaakko Lehtniemi – I’m not sure SubInAcl will be helpful for the Windows Update issue you’re describing. I’d recommend posting a question on the Windows 7 forum at http://answers.microsoft.com/en-us/windows/forum/windows_7 to see if someone there can suggest some ideas for you to try to solve this problem on your PC.

  441. Doug says:

    Be careful copying and pasting. I found that IE is too helpful by setting double-quotes as so-called “smart quotes” instead of straight double-quotes.

  442. Debbos says:

    I ran this in the hope it might fix a problem with Device Manager which was preventing access to minor peripherals. Google suggestions said that there could be a problem with permissions in the registry. Realise it’s not quite what subinacl is designed for but figured it couldn’t do any harm to try.

    reset.cmd ran about 20 mins and produced errors in the 10’s of 1000’s on the red banded display for each segment + a 35Mb output file. After it ended, there was still a whirling circle round my cursor which Task Manager revealed was umpteen werkmgr Win error reporting processes running. This went on for hours and rebooting made no difference, the werkmgr processes came back.

    I had made a complete registry backup but it wouldn’t restore. Restore almost finished then came up with an error message about lack of permission. I can’t restore from the daily backup as the external HDD’s aren’t recognised any more.

    On Win 7 64 bit. My bad, just a warning that things can go horribly wrong.