Notes about a couple of possible issues while using the SubInAcl tool


********************************

Important note – if you were referred to this blog post from this knowledge base article and are having trouble running SubInAcl or reset.cmd, please try the steps listed in my other blog post first – http://blogs.msdn.com/b/astebner/archive/2006/09/04/solving-setup-errors-by-using-the-subinacl-tool-to-repair-file-and-registry-permissions.aspx.

********************************

A while back, I posted some instructions for using a tool from the Windows Resource Kit named SubInAcl that can be used to update file, folder and registry permissions.  This tool can help fix some types of access denied errors that can be encountered while trying to install products, hotfixes and service packs on Windows.

Since that original post, I have heard from some people who have run into various types of problems while attempting to install and use the SubInAcl tool.  I wanted to post more details about a few of these scenarios in case other folks run into similar issues in the future.

Issue 1 – Running SubInAcl reports an error on some non-English operating systems

On some non-English operating systems, customers have reported seeing errors like the following when trying to use the command lines listed in my previous blog post:

LookupAccountName : HKEY_CURRENT_USER:administrators 1337 The security ID structure is invalid.

The reason for this error is that on some non-English operating systems, the name of the Administrators group is translated into the OS language.  If you are running SubInAcl on a non-English OS where the name of the Administrators group is translated, you will need to update each of the command lines for SubInAcl to specify the translated name of the Administrators group.

Issue 2 – SubInAcl.msi fails to install

I have heard from a few people who were not able to get the SubInAcl.msi installer to work correctly on their systems, which prevented them from being able to use the tool.  If you run into an error while installing SubInAcl.msi to install this tool, you can get a copy of the tool that does not require a full installation from an alternate location by using the following steps:

  1. Download SubInAcl.zip and save it to your local computer
  2. Extract the contents of the zip file to a local folder on your system
  3. Use the steps in the previous blog post to run SubInAcl from the extracted location with the following modifications:
    1. Skip step 1 – there is no need to download and install subinacl.msi because subinacl.zip contains the same files that would normally be installed by subinacl.msi
    2. Depending on where you extract the zip file to in step 2 above, you may need to edit reset.cmd and change the folder path that it is trying to run subinacl.exe from

Note – you should first attempt to install and run SubInAcl.msi before downloading and extracting this zip file.  This zip file is only intended for cases where for some reason, SubInAcl.msi will not install correctly – which unfortunately can sometimes happen because of one of the same issues that SubInAcl is designed to fix.

Issue 3 – How to get SubInAcl to create a log file

SubInAcl is a console application, which means that the output that it prints will be displayed in the console window by default.  For the command lines listed in my previous blog post, SubInAcl prints a lot of information, and if any errors occur, it will quickly scroll off the screen and you won’t be able to see the details of the errors.

For a console application like SubInAcl, running it from a cmd prompt and putting a greater than sign and then the name of a file at the end of the command line (such as > %temp%\subinacl_output.txt) will cause the output to be redirected to a file.  I recently updated the command lines in that post and in the example script I posted on my file server to use this syntax to redirect the output to a file instead of printing it to the console.

Note – creating a log file as described above will not work if you run SubInAcl from the Windows start menu.  It has to be run from a cmd prompt in order to allow the log file to be created.

<update date=”3/30/2009″> Fixed broken download links that are contained in this post. </update>

<update date=”10/7/2014″> Added a note to the top of this post with alternate instructions for people who were referred to this blog post from this knowledge base article. </update>

<update date=”4/14/2015″> Clarified the steps in Issue 2 </update>

 

 

Comments (107)

  1. dmendt says:

    Here is the script which worked on Vista Buisness SP1 Spanish Version:

    cd /d "%programfiles%Windows Resource KitsTools"

    subinacl /subkeyreg HKEY_CURRENT_USER /grant=administradores=f /grant=system=f /grant=restringido=r /grant=YOURUSERNAME=f /setowner=administradores > %temp%subinacl_output.txt

    subinacl /keyreg HKEY_CURRENT_USER /grant=administradores=f /grant=system=f /grant=restringido=r /grant=YOURUSERNAME=f /setowner=administradores >> %temp%subinacl_output.txt

    subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administradores=f /grant=system=f /grant=usuarios=r /grant=todos=r /grant=restringido=r /setowner=administradores >> %temp%subinacl_output.txt

    subinacl /keyreg HKEY_LOCAL_MACHINE /grant=administradores=f /grant=system=f /grant=usuarios=r /grant=todos=r /grant=restringido=r /setowner=administradores >> %temp%subinacl_output.txt

    subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administradores=f /grant=system=f /grant=usuarios=r /setowner=administradores >> %temp%subinacl_output.txt

    subinacl /keyreg HKEY_CLASSES_ROOT /grant=administradores=f /grant=system=f /grant=usuarios=r /setowner=administradores >> %temp%subinacl_output.txt

    subinacl /subdirectories %programfiles% /grant=administradores=f /grant=system=f /grant=usuarios=e >> %temp%subinacl_output.txt

    subinacl /subdirectories %windir% /grant=administradores=f /grant=system=f /grant=usuarios=e >> %temp%subinacl_output.txt

  2. Rusty Shack says:

    I'm not sure which versions of Windows allow CMD files to be run. I'm only familiar with batch files. So many may need to name the batch/command file RESET.BAT, instead.

    If running the tool on a system that uses a ramdisk for the TEMP/TMP directories, you may need to redirect the log file to another drive. Change the RESET.BAT/CMD file to replace %temp% with C: or something like that. Otherwise the ram disk will store the log file, which could cause problems if the ram drive quickly fills up (and would mean no log file if your system crashes).

    The author will be pleased to know how annoyed rivals of his Sooners are, that they're (we're) relying on a Sooner to fix our PCs. Noticed the crimson/white in the utility, too. Blech. ಠ_ಠ

  3. Ivan Ferrer says:

    Thank you very much, Aaron Stebner and dmendt(spanish version)

  4. john says:

    i am getting error pipe line being closed in visual studio ultimated 2012 and others can anyone help

  5. Hi John – What is the exact text of the error message that you see?  Also, do you see it when you install VS 2012, or when you are trying to use VS 2012 after setup completes?

    It might help to post a question about your scenario on the VS forum at social.msdn.microsoft.com/…/home.

  6. ABEEE says:

    Greeting with peace..

    Sir Aaron, do all these steps work with windows 7?

    I'm using windows 7, tried these steps couple of time, the aps i wish to set it up still couldnt be installed.

    the error message comes out each time when the installer bar nearly get to the finishing line.

    thanks for the great entry.

  7. Hi ABEEE – Yes, these steps should work on Windows 7.  This tool doesn't solve all possible setup problems though.  What is the exact error you see when trying to install the applications on your computer, and do you have any log files from the failing installs that I could take a look at to try to figure out the root cause of the failures?

  8. Turbotax says:

    I am having error 1603 installing turbotax. tried full control, msconfig selective startup, fixed .net framework still the error is there. please help i need to install it

  9. Hi Turbotax – Error code 1603 is a generic error that means that setup failed, but it doesn't give any more detailed information about why it failed.  I'd suggest contacting TurboTax technical support to see if they can help you examine the setup log files created by TurboTax setup and narrow down the cause of the failure further.

  10. Das says:

    Hi,

    Does Subincl work in windows 2008 platform ?

    I have tried and got a bug. I am unable to fix that.

  11. Hi Das – I don't know of any reason why SubInAcl wouldn't work on Windows Server 2008. What exact error are you seeing when you try it?

  12. Das says:

    Hello Aaron,

    I tried on windows 2008 enterprise edition. Below is one of the few bugs I'm posting:

    The system cannot find message text for message number 0x2350 in the message fil

    e for Application.

    The system cannot find message text for message number 0x2334 in the message fil

    e for Application.

    C:Usersuser2>systeminfo |more
    Server1234
    Microsoftr Windows Serverr 2008 Enterprise
    :
    Microsoft Corporation
    :
    Multiprocessor Free
    Windows User
    :
    92516-082-2500885-76665
    1/7/2011, 6:14:05 AM
    5/25/2014, 6:50:58 PM
    VMware, Inc.
    VMware Virtual Platform
    x64-based PC

    I tried this in command. Also another bug is like the no options come in My Computer>Properties

    It is blank except it shows the computer name.

  13. Hi Das – The errors about missing message text could mean that the file that contains those messages is missing from your computer, or it could mean that a couple of specific messages do not have valid error text.  In either case, those are not fatal errors and you can probably safely ignore them.

    I haven't seen a problem before like the one you describe with options missing from My Computer | Properties.  For that issue, I'd suggest posting a question on the Windows Server forums at social.technet.microsoft.com/…/home to see if someone there can help provide a workaround or a fix.

  14. Bradyn says:

    Hey man, I had to get the SubinAcl tool to help fix a problem with my computer. I got this error message and was wondering if you could help?

    'subinacl' is not recognized as an internal or external command,

    operable program or hatch file.

  15. Hi Bradyn – That error most likely means that SubInAcl.exe isn't installed at the expected location or you didn't change directories in the command prompt to the directory that SubInAcl is installed to before running reset.cmd.  I'd suggest double-checking both of those issues.

  16. Alan says:

    Hi Aaron – I am having the same problem as Bradyn in that when I ran the SubinAcl tool I got the same error message repeated four times

    "'subinacl' is not recognized as an internal or external command, operable program or hatch file."

    What is the location the file should have been installed? Could you also clarify what you meant by changing directories in the command prompt before running rest.cmd

  17. Hi Alan and Bradyn – The comment I made about changing directories was based on an older version of reset.cmd.  I updated that script a while back to fix that issue, so you shouldn't need to worry about that anymore.  I just uploaded a new version of reset.cmd.txt with some additional error logging that should help narrow down why you're seeing this error.  Can you please give it a try and see what it reports?

    SubInAcl should be installed to c:Program Files (x86)Windows Resource KitsToolssubinacl.exe (if your OS is 64-bit) or c:Program FilesWindows Resource KitsToolssubinacl.exe (if your OS is 32-bit).

  18. Garpagan says:

    Hi Aaron,

    Could you tell me where i can find how is translated user group? My system is in polish. I could find easly that in my system "administratos" translate to "administratorzy" and that works, but I couldn't translate others. Apparently, by looking at spanish version in second post, I have also "users", "everyone", and "restricted". I've tried what I thought should be translated version, but it didn't actually work. I'm sure there is some very easy way to find out.

  19. Hi Garpagan – I don't know a definitive way to find those values on all versions of Windows.  I think some of the strings are left in English in some non-English versions of Windows, so you might want to try that first.  If that doesn't work, then I think you can find the values by going to regedit.exe, right-clicking on a registry value, choosing Permissions and looking at the options that appear there.

  20. Paul says:

    SubinAcl reports many failures.

  21. Hi Paul – What kind of failures are you seeing?

  22. Atila says:

    In Windows XP SP3 Shadow, that is a mix of english and spanish version, it worked using the english version but changing restricted to restringido and everyone to todos.

  23. Trad says:

    Still not working! 🙁

  24. Colin says:

    In answer to earlier question about 'subinacl' is not recognized as an internal or external command, operable program or hatch file. You say "SubInAcl should be installed to c:Program Files (x86)Windows Resource KitsToolssubinacl.exe (if your OS is 64-bit) or c:Program FilesWindows Resource KitsToolssubinacl.exe (if your OS is 32-bit)." However there is no directory of that name on my Windows 7. How do I get it?

  25. Hi Colin – You need to download and install SubInAcl from http://www.microsoft.com/…/details.aspx in order to get that file.

  26. Hi Trad – I can try to help, but you need to provide more detailed information.  What isn't working for you, and what exact error messages are you seeing on your computer currently?

  27. Tammy says:

    FWIW – I got the "'subinacl' is not recognized as an internal or external command,

    operable program or hatch file." error as well.  When I moved my Reset.cmd file into the directory where subinacl was installed & ran it from there, it ran.

  28. Hi Tammy – I'm not sure why you needed to copy reset.cmd to the same directory as subinacl.exe.  Reset.cmd runs correctly for me on my systems regardless of where it is located, assuming that you installed subinacl.exe to the default path when you ran subinacl.msi.  The default location is c:Program Files (x86)Windows Resource KitsToolssubinacl.exe (if your OS is 64-bit) or c:Program FilesWindows Resource KitsToolssubinacl.exe (if your OS is 32-bit).

  29. Luke says:

    I'm trying to run this to fix windows update access denied on a pc.  I'm running it under and administrator account (even created a new one to try).  I'm getting that lots of failed entries when it has the red at the time and also "5 Access is denied" when it lists keys in white text.  

    I'm on win7 home 64 bit. Any ideas?

  30. Hi Luke – Are you running from an elevated cmd prompt too?  To do that, you need to go to c:windowssystem32, find cmd.exe, right-click on it and choose Run as Administrator.

  31. C D Harris says:

    I followed the instructions carefully and installed on my Windows 7 machine.  When I ran the reset.cmd, I got the following message in the DOS window:

    'subinacl' is not recognized as an internal or external command, operable program or batch file.

    'subinacl' is not recognized as an internal or external command, operable program or batch file.

    'subinacl' is not recognized as an internal or external command, operable program or batch file.

    'subinacl' is not recognized as an internal or external command, operable program or batch file.

    =========================

    Finished.

    =========================

    Press any key to continue . . .

    What did I do wrong?

  32. C. D. Harris says:

    Also, I installed subinacl.msi in the Windowssystem32 folder.  I do not have a c:Program Files (x86)Windows Resource Kits… folder.  When I ran reset.cmd from any location, either the Desktop or system32 folder, I go the "subinacl' is not recognized as an internal or external command, operable program or batch file." error message.

  33. Hi C. D. Harris – If you install subinacl to a non-default location, you will need to update reset.cmd to use the non-default location when it tries to run it.  Alternatively, you can uninstall subinacl and re-install it to the default location and reset.cmd should work as-is.

  34. John Corey says:

    Seem to have the same problems as C D Harris on 23 July. Been working on this computer for a customer for 3 days now. What's the answer here? I'm getting the error that the program is not recognized as internal or external command. Re-read the instructions again. removed program, re-installed program – same error. SO,,, I read Aaron Stebner above "If you install to a non-default location WHAT Aaron?? Has this truly worked for you and others?

  35. Hi John Corey – I'm sorry for the hassles you're encountering while trying to use subinacl.exe and reset.cmd.  The reset.cmd script that is linked in this blog post works correctly when I run it on my computers.  It expects to find subinacl.exe at c:Program Files (x86)Windows Resource KitsToolssubinacl.exe (if your OS is 64-bit) or c:Program FilesWindows Resource KitsToolssubinacl.exe (if your OS is 32-bit).  If you don't have subinacl.exe at that location on your computer, then you can do one of the following:

    1.  Copy subinacl.exe to that location

    2.  Modify your copy of reset.cmd to use a different location for subinacl.exe

    3.  Write your own script to run subinacl.exe instead of using reset.cmd

  36. Abrham says:

    Hi Aaron. I've been trying to figure this out for quite a while. Although, I can't seem to get it right. Still getting "subinacl' is not recognized as an internal or external command, operable program or batch file." error message. Does it matter if I am running SP1 on my Win7 OS?

  37. Hi Abrham – No, it doesn't matter what version of Windows you are running on.  That error means that reset.cmd cannot find subinacl.exe at the location it expects to find it at.  It expects to find subinacl.exe at c:Program Files (x86)Windows Resource KitsToolssubinacl.exe (if your OS is 64-bit) or c:Program FilesWindows Resource KitsToolssubinacl.exe (if your OS is 32-bit).  If you don't have subinacl.exe at that location on your computer, then you can do one of the following:

    1.  Copy subinacl.exe to that location

    2.  Modify your copy of reset.cmd to use a different location for subinacl.exe

    3.  Write your own script to run subinacl.exe instead of using reset.cmd

  38. Lee says:

    Hi Aaron, I too have the problem that C.D. Harris shows. I moved reset.cmd to the tools folder and double click, and it runs. If try to run from anywhere else it doesn't. If I try to run as administrator from the tools folder (or anywhere else) it will not run and comes up with the same error. A heads up, the microsoft document that links to this page instructs to install subinacl in the windowssystem32 folder, does not say where to put reset.cmd.

  39. Hi Lee – If you download subinacl.msi from http://www.microsoft.com/…/details.aspx and install that, it will give you a default install location of c:Program Files (x86)Windows Resource KitsToolssubinacl.exe (if your OS is 64-bit) or c:Program FilesWindows Resource KitsToolssubinacl.exe (if your OS is 32-bit).  I don't know of any reason why you would need to install it to c:windowssystem32.  What exact page do you see instructions that say to install subinacl to c:windowssystem32?

    Reset.cmd is a script that runs subinacl.exe with several different command lines.  I wrote it as a convenience to try to make it easier to run subinacl.exe, but you don't have to use it if it is causing problems for you.  Instead, you can look at subinacl.htm (which is the help documentation that gets installed when you install subinacl.msi) and run your own subinacl.exe command lines.

    Reset.cmd does not need to be put in any specific folder in order for you to run it.  However, it does assume that subinacl.exe is installed to the default location of c:Program Files (x86)Windows Resource KitsToolssubinacl.exe (if your OS is 64-bit) or c:Program FilesWindows Resource KitsToolssubinacl.exe (if your OS is 32-bit).  If subinacl.exe is not installed in that location on your PC, you will need to update reset.cmd accordingly or it will not work.

  40. Lee says:

    Hi Aaron,

    This is the page: support.microsoft.com/…/968003. I installed to c:Program Files (x86)Windows Resource KitsTools after first installing to c:windowssystem32. I understand that the reset is calling for subinacl from the tools folder, just that I can't get to run as administrator.  I am having update issues, and the listed page is one that comes up when researching this error code:0x80070005.

    Thanks,

    Lee

  41. Hi Lee – Thanks for sending the link.  I'm not sure why that knowledge base article says to install subinacl to the system32 directory.  In general, it isn't recommended to install applications there, and it runs correctly from the default location in Program Files.

    What I usually do is open an elevated cmd prompt by going to c:windowssystem32, right-clicking on cmd.exe and choosing Run as Administrator.  Then I run reset.cmd and subinacl.exe from the elevated cmd prompt.

  42. Neil Lomas says:

    Hi Aaron,

    I was having the same problems as C D Harris in getting reset.cmd to run, wherever I placed it. As a last resort, I right-clicked on it and, instead of selecting Run as Administrator, I selected Open. I assumed this would open in Notepad so I could include a line setting the current directory to the folder containing subinacl.exe. Instead, it ran reset.cmd successfully.

    Incidentally, it fixed my problems with Windows Update.

    Neil

  43. Hi Neil Lomas – I'm surprised to hear that just choosing Open allowed subinacl.exe to run correctly on your computer.  That tool requires elevated privileges in order to run correctly.  I usually recommend opening an elevated cmd prompt and running reset.cmd or subinacl.exe from there.  You can find steps for how to do that at blogs.msdn.com/…/solving-setup-errors-by-using-the-subinacl-tool-to-repair-file-and-registry-permissions.aspx.

  44. paddypaddy says:

    I to had the same problem as many others regarding errors when running the reset.cmd file. Rather than right click and 'run as administrator' try double clicking the reset.cmd file

  45. Cherre says:

    Many thanks Aaron for your blog – I have found it very useful.  I also saved my SubInAcl to C:/windows/system32 as per the microsoft instructions and my reset.cmd in my C: folder.  It ran well.  My only issues are fails due to not being able to make registry changes in my zonealarm security files, which I would expect, and I need to now go and see how this impacts on correcting my windows update problem I was experiencing.

  46. Allen says:

    Thank you for the script.  It ran and it looked like it fixes a bunch of entries but 7 Windows Vista Home Premium SP-2 x64 updates, including .NET, continue to fail to install. I am logged in as administrator, I have disabled Kaspersky (and I disabled auto-run at boot), and even renamed the SoftwareDistribution folder.  Rebooted a couple of times and updates still fail to install. The same 7 files failed to update since August 18, according to the update history. Any other suggestions?

  47. Hi Allen – I'd suggest trying to reset your Windows Update components using the information in the knowledge base article at support2.microsoft.com/…/971058.

    If that doesn't help, then I'd suggest posting a question on the Windows 7 forum at answers.microsoft.com/…/windows_7 and hopefully someone there can help you troubleshoot this update installation issue further.

  48. Ross says:

    Hello. I'm getting Windows Update Error 80070005. From the Windows support (support.microsoft.com/…/968003), it says that I fix the error using Subinacl.

    I followed the steps : installed Subinacl to default directory, made a reset.cmd using notepad as stated, then ran the the reset.cmd as administrator.

    Now, my problem is the same as some of the others stated here which was "Subinacl is not recognized as internal or external command, operable program or batch file."

    I hope you can point out specifically where I went wrong and how I could successfully run the program. I still dont have the idea on how, from reading the previous posts/comments.

  49. Hi Ross – I'm sorry for the hassles that you're running into.  Instead of using the steps listed in that knowledge base article, I'd suggest using the steps in my blog post at blogs.msdn.com/…/solving-setup-errors-by-using-the-subinacl-tool-to-repair-file-and-registry-permissions.aspx.  I don't know why the knowledge base article recommends installing subinacl to the system32 directory, but that is typically not recommended for any software installation, and the steps in my other blog post will walk you through installing subinacl to the default location and creating a reset.cmd script that calls it from there instead.

    Hopefully this helps.

  50. Ross says:

    Hello again. Thanks for the response.

    Subinacl finally ran for me, all I needed was change the content of reset.cmd as everything else is like what I did beforehand.

    Just a question because I'm a bit worried, is it normal seeing large numbers (>1000) under "Failed" while in progress of resetting? what do those numbers under Failed mean?

  51. Hi Ross – It is normal to see some failures (because of registry keys in use by other programs on your computer, etc).  I don't think there should be that many failures though.  It is hard to say without seeing the full output though.  Can you create a log file that contains all of the output, upload it to a file server (such as http://onedrive.live.com), upload your log there, and then post a link here so I can download it and take a quick look?

  52. Ross says:

    I'm not really sure how to make a log file using cmd so I just did the old copy and paste to a .txt file. Sorry about that. Anyway, here's the link : http://1drv.ms/1vM0g3R

  53. Hi Ross – You can ignore the failures for HKEY_CURRENT_USER.  The large number of failures for HKEY_LOCAL_MACHINE and HKEY_CLASSES_ROOT are worrisome though, especially since the errors that are reported are access denied errors (which is what that subinacl script is specifically designed to fix).  I'd suggest double-checking to make sure that you're running the script with elevated permissions (using the Run as Administrator option described in the knowledge base article).

    If you're still seeing access denied errors even when running as an administrator, then you might need to try a different technique for changing the registry permissions on your computer instead of using subinacl.exe.  Steps like the ones at http://www.howtogeek.com/…/take-ownership-of-or-assign-full-permission-for-a-registry-key-in-windows-7 might help you if you need to do this.

  54. Jim says:

    All my hassles started when I updated to Windows 8.1  Most of my graphics programs would not function (video editor and such) so I used my OEM partition and sent it back to Windows 8.  All my programs worked fine but when I went to grab a few apps I got the 0x80070005 error or was told my system did not meet the criteria (Intel i5, 16GB ram, 1TB HD)  Tried running this fix and no luck, same errors as the others when it runs:

    'subinacl' is not recognized as an internal or external command, operable program or batch file.

    'subinacl' is not recognized as an internal or external command, operable program or batch file.

    'subinacl' is not recognized as an internal or external command, operable program or batch file.

    'subinacl' is not recognized as an internal or external command, operable program or batch file.

    Tried your variations and its just the same old same old error.  I guess I am doomed to never update Windows or get an app from the app store.  

    I can download programs from the web and they worked just fine.

  55. Hi Jim – If you follow the steps that are posted at blogs.msdn.com/…/solving-setup-errors-by-using-the-subinacl-tool-to-repair-file-and-registry-permissions.aspx, you should not see this error.  Please make sure you're following the steps exactly as they are written there.

    One important note – if you already installed subinacl to system32 because the knowledge base article said to do that, please uninstall it before trying the steps in my other blog post.  If you don't, you won't be able to install it to the default location like my steps say to do.

  56. Nataliya says:

    Hey guys. In order to recognize subinacl you need to add a path (where subinacl.exe is installed in my case C:Program Files (x86)Windows Resource KitsTools) to Environmental Variables 'Path'. You can find it under Advanced system settings->Advanced-> Environmental Variables->System variables. Find variable Path, then click edit and add C:Program Files (x86)Windows Resource KitsTools;

    After that run your Reset.cmd.

  57. Snehal Danane says:

    Internal error 2503

  58. Hi Snehal Danane – I need more information in order to be able to help here.  What exactly were you doing when you saw that error?  Also, do you see any additional explanatory text along with the error number, or is that number all that is displayed?

  59. Gordon says:

    Access denied error when attempting backup from WIN 7 to external hard drive.  Followed your blog instructions to the letter. Ran your reset.cmd script as instructed.  Thousands and thousands of failures!  WHEW!!!!!!!!!!  output file is 1.47GB – took about 16 minutes to run.  I have captured, using snipping tool, the command line dialogue in a .jpg file.  Would you like to see it?  How can I send it to you?  While waiting for your response I will restart and retry to backup.

  60. Hi Gordon – You can upload the .jpg to a file server (such as http://onedrive.live.com) and post a link that I can use to download it.

  61. PaPero says:

    I've tried all of the suggestions outlined above and still got the 'subinacl' is not recognized as an internal or external command, operable program or batch file message. What DID work for me was this method I found.

    1. Disable Windows Update

    a. Click on start

    b. Click on all programs

    c. Click on accessories

    d. Click on Run

    e. Type services.msc and press ok

    f. Right click on "Windows Update"

    g. Click on stop (Windows Update is now disabled)

    1. Rename Software Distribution folder

    a. Navigate to: C:/Windows/

    b. Find the folder named: “SoftwareDistribution”

    c. Rename that folder to something like “SoftwareDistribution.old”

    d. Create a new folder called “SoftwareDistribution”

    1. Enable Windows Update

    a. Click on start

    b. Click on all programs

    c. Click on accessories

    d. Click on Run

    e. Type services.msc and press ok

    f. Right click on windows update

    g. Click on start

    If you are unable to find Software Distribution Folder, follow these

    steps before #2 above.

    1. From the explorer window press the Alt key to view the file menu.
    2. Click Tools

    3. Select Folder Options

    4. Select the View tab

    5. Select “Show hidden files and folders”

    6. Remove the selection from “Hide protected operating system files”

    7. Click OK

    Restart your PC and you should be good to go!

  62. Gabe says:

    I've been having problems installing a display driver for my NVIDIA GT220 video card.  I've tried doing a manual install using the file downloaded from NVIDIA and Windows Update which generates the 80070005 error code. I ran (as Administrator) the subinacl command and it generated so many errors the log file was too large (about 3.6 GB) that I couldn't open it with Notepad or any other Wordprocessor that I have. I rebooted and ran the subinacl again but got the same results. Any suggestions on what to try next?

  63. Gabe says:

    I forgot to mention I'm using Windows 7 Pro 64 bit with Service Pack 1 installed.

  64. Hi Gabe – You can manually change file/folder permissions by using Windows Explorer and registry permissions by using regedit.exe.  I'd first suggest trying to narrow down exactly what file, folder or registry key is causing the 80070005 error that you're seeing when trying to install this NVIDIA package.  Typically, you can find that information from the setup log file, and most of the time, setup programs create log files in %temp%.

    Once you narrow down what is causing the access denied error, you can update the permissions by using these steps:

    If it is a file/folder – support.microsoft.com/…/308419

    If it is a registry key – support.microsoft.com/…/310426

    Both of the above links refer to Windows XP, but the instructions are the same for newer versions of Windows too.

  65. Rodrigo says:

    My main concern is the amount of failed objects that could not be changed. Any ideas if the failed errors are due to permissions already in place?

  66. Hi Rodrigo – I'm not sure what the root cause of the failed objects is.  I'd need to see the log file to be able to narrow this down further.  One possible cause is the issue described at brianpeek.com/…/weird-vista-registry-issue where all permissions are removed from a registry key + sub-keys.

  67. Andy S says:

    Hey Aaron,

    I've ran in to this problem today after trying to install an update. I'm running Windows 8.1 and have followed all your instructions here and downloaded your reset file but I'm still having problems. I've taken a screenshot of what's happening when I run the reset file: drive.google.com/…/view

    I'd be very grateful if you can offer any further suggestions :o)

  68. Hi Andy S – In the screenshot you uploaded, the cmd prompt is running from the c:windowssystem32 directory.  The error listed there means that subinacl.exe is not installed to the c:windowssystem32 directory.  You need to use the cd command to change directories to the folder that subinacl.exe is installed to.  If you did a default install, subinacl.exe will be installed to c:Program Files (x86)Windows Resource KitsTools.

    The example reset.cmd in the blog post at blogs.msdn.com/…/solving-setup-errors-by-using-the-subinacl-tool-to-repair-file-and-registry-permissions.aspx shows how to do this if you're not sure how to do that.

  69. Laszlo K says:

    Hello,

    I'm trying run SubinACL on a Hungarian Windows 8.1 Pro system but when I replace administrators with the hungarian name which would be rendszergazdák returns the error 1337 because of the accent int name. So I tried to save the file UTF-8(no-bom) and also in ANSI but both way I got the error than I tried put the name between quation marks but I got the same error, how can use the Hungarian name of the administrators group?

  70. Hi Laszlo K – I haven't tried it, but I think you should be able to use the SID instead of the group name to work around this issue.  The SID for the Administrators group is S-1-5-32-544, and you can find information about how to use SIDs with subinacl by looking at the help document subinacl.htm that gets installed to the same location as subinacl.exe.

  71. Laszlo K says:

    Thank you for your help! It worked like charm. I simply replaced the usergoup name with the SID and than it run, but sadly it didn't solved my problem and now I'm changing permissions one-by-one on some of the keys looking up the correct values on another PC.

  72. David King says:

    Hi All,

    I left the following feedback on support.microsoft.com/…/968003

    I noticed a link there for this page, and thought that feedback might help some of your viewers

    The Feedback:

    I would fix the FAULT in the instructions!

    On Windows 8.1 64 bit:-

    When I direct the msi installer to install to "C:WindowsSystem32" as per the instructions in this article, …

    the file's subinacl.exe, subinacl.htm and tooldownloadreadme.htm are actually installed in the directory "C:WindowsSysWOW64"

    This means that subinacl.exe is nout found in the '%PATH%' when attempting to execute the subsequent Restore.cmd batch file.

    I fixed this for myself by installing the msi to default "C:Program Files (x86)Windows Resource KitsTools", and then copying the required file's into "C:WindowsSystem32"

    No problem for me but you might wish to amend your instructions for other less technical people!

    Best wishes, David King, 🙂

  73. David King says:

    Hi All Again,

    Sorry, I should have typed "Reset.cmd" rather than "Restore.cmd" in my prior post, 2 Jun 2015 12:29 AM, above.

    Also, just to clarify, this addressed the following error when executing the "Reset.cmd" batch file, (and as reported by prior posters).

       'subinacl' is not recognized as an internal or external command, operable program or batch file.

    Best Wishes, David King, 🙂

  74. Hi David King – Thanks for your feedback.  I found some people at Microsoft who were able to update the instructions in the KB article at support.microsoft.com/…/968003, and as of today, it no longer says to install SubInAcl to the system32 directory.  Hopefully this will help avoid some of this type of confusion in the future.

  75. Julian Balmford says:

    Running Windows 10 Enterprsie x64 Build #10130 and having the defender download erro. Running your Script is generating thousands of "Syntax errors" although the script is a 100% copy of that provided at:support.microsoft.com/…/968003 and suggestions would be gratefully recieved?

    Many thanks, Julian Balmford

  76. Hi Julian Balmford – Just to double-check, did you run the script as an administrator by right-clicking and choosing to run as administrator?

    If so, then can you send an example of the syntax error that you're seeing and I'll see if I can try to help figure out what is causing them?

  77. Demian says:

    Hi Aaron,

    i belive the script is useable in every language by replacing then names with the SIDs.

    support.microsoft.com/…/243330

    e.g. administrators -> S-1-5-32-544

    Thanks a lot, Demian

  78. Hi Demian – I think you're right.  Thank you for posting this information.

  79. Demian says:

    I made the script run with the SIDs. Unfortunately it could not fix the Err 80070005 for the windows 10 upgrade.

  80. Hi Demian – I'm sorry to hear that you're still having issues with your Windows 10 upgrade.  Unfortunately, SubInAcl isn't able to fix 100% of the possible access denied errors.  I'd suggest posting a question on the Windows 10 forum at answers.microsoft.com/…/windows_10 to see if someone there can provide some additional troubleshooting suggestions for your scenario.

  81. Maureen says:

    non-tech newbie here, am also having problems updating to win10 from hp laptop with win8.1 I ran the scannow command and found no problems and then downloaded your  SubinAci and ran the reset as admin as you said. When it completes it just disappears so am wondering how to find the text to see if it has any errs listed?

    Thnks,maureen

  82. Hi Maureen – Instead of right-clicking on reset.cmd and choosing to run it as administrator, you can run c:windowssystem32cmd.exe as an administrator and then run reset.cmd from there.  That way the cmd window will stay open after reset.cmd finishes.  You can also run reset.cmd > %temp%subinacl_output.txt and it will print all of the output to a text file instead of printing it to the cmd window.

  83. Maureen Duncan says:

    Thanks Aaron, am off to see if I can figure out what and how to do what you just said. I am only person on this laptop and signed in as Admin so irritates me why I wouldn't have access to any updates. To this NON-Tech person it sounds crazy.

  84. Uwe says:

    After completition of Reset.cmd I got exactly 57506 Failed updates on the HKEY_LOCAL_MACHINE hive and exactly 28463 Failed updates on the HKEY_CLASSES_ROOT hive. On the HKEY_CURRENT_USER and on the C:Windows directory I got exactly 0 Failed updates. In all cases I got exactly 0 Syntax errors.

    Because the script shows the last failed updates (for the HKEY_LOCAL_MACHINE hive HKEY_LOCAL_MACHINESYSTEMCurrentControlSetservicesxmlprovParametersSchemaGroupsUserhttp://www.microsoft.com/…/mspeapuserpropertiesv1 and for the HKEY_CLASSES_ROOT hive HKEY_CLASSES_ROOT{2C256447-3F0D-4CBB-9D12-575BB20CDA0A}ProgID) I can give the exact reason why at least these updates failed: The owner of these keys is TrustedInstaller, not Administratoren (I have the german version of Windows 7 Professional, that's why Administratoren, not administrators). With this owner it is not possible to grant full access to the Administratoren group. I looked a bit around in other registry keys and saw that many of them also have the owner TrustedInstaller what makes me assume that this owner is the general cause of the 57506+28463 Failures.

    It is no problem to change the owner of the keys but of course I must ask myself why Reset.cmd did not already do that. After searching Microsoft forums I found the terrible posting of dskrobow on January 22, 2013 (answers.microsoft.com/…/514192d0-697d-4cdb-b2e9-5a0429321a4f): "I also changed the owner of the hive from TrustedInstaller to the Administrator group–BIG MISTAKE … When I closed regedit, I could no longer start it up again. The 'run as Administrator' option was gone from the context menu. I could no longer open windows explorer, control panel, Internet Explorer, etc."

    So it seems that it's not a good idea to simply change the owners of registry keys to the Administratoren group. On the other hand I don't want to go on with errors. I assume that you don't get any error when you run Reset.cmd on your computer. Am I right? So you should have in all of your registry keys the owner administrators.

    I should mention that my computer was infected by malware that installed a couple of software pieces on my computer. That's why it is possible that these keys belong to malware that has been removed in the meantime. But this is only a very rough idea. I don't know that at all! I don't know how to check if these keys belong to my system or not.

    What should I do now? Should I change the owners of the failed keys? The posting of dskrobow shows me that it is very likely that I will run into problems after that. Should I continue with errors? I assume that you don't get any error on your computer after Reset.cmd has completed. Should I delete the failed keys? I'm afraid that this will cause the biggest problems. Should I do anything else?

    Please help.

    Thanks, Uwe

  85. Hi Uwe – Running subinacl will typically result in some errors on all PCs.  I don't think you need to worry about trying to eliminate all of the errors that it reports.  Instead, I would focus on trying to fix the exact problem that led you to try running subinacl in the first place.  For example, was there a specific application you were trying to run that reported access denied?  If so, I'd suggest checking to see if it works after you ran subinacl, and if so, don't make any further permission changes or delete any registry keys unless you have problems running other applications on your PC.

  86. Kay says:

    On a multi-year quest (on and off!) to rid myself of 80070005 error code when trying to update Windows 7 on my Lenovo Thinkpad. Have not updated in 3 years ! Wont allow me to update to Windows 10 either. Just ran subinacl, which did not work. Any idea for next step? Would be very grateful! Thanks. Kay

  87. Taner says:

    I tried two different scripts of subinacl, but none worked.

    I still get the same error code 80070005.

  88. Hi Kay – SubInAcl isn't able to fix all possible causes of access denied errors.  I'd suggest trying the Windows Update troubleshooter at windows.microsoft.com/…/troubleshoot-problems-installing-updates.

    You might also be able to manually update the permissions on the file/folder/registry key that is causing this access denied error if you can determine which exact item is causing the error.  For Windows updates, there will sometimes be more information about the cause of errors in the log files at %windir%winsxslogs or %windir%WindowsUpdate.log.

  89. Hi Taner – You might be able to manually update the permissions on the file/folder/registry key that is causing this access denied error if you can determine which exact item is causing the error.  What are you trying to do when you see this error – install Windows Updates, install an application, run an application, etc?

  90. michivie says:

    hi aaron,

    what a nice script at all.

    referring to "Issue 1 – Running SubInAcl reports an error on some non-English operating systems"

    do you know perhaps the correct Translation for "restricted" to german weorking in registry ?

    all other Translations i did with Google-translator, but in this case no Suggestion/Translation is working.

    "eingeschränkt","eingeschraenkt","begeschränkt","begeschraenkt"

    greetings from vienna

    michi    

  91. Hi Michivie – I don't know the correct translation, but you might want to try using the suggestion in the comment above from Demian and use the account's SID instead of the name.  You can find SID information in this knowledge base article – support.microsoft.com/…/243330.

  92. SuperUser says:

    This works with the German version of Windows 7 32bit Professional…

    @echo off

    title Resetting ACLs…

    setlocal

    echo.

    echo Determine whether we are on an 32 or 64 bit machine

    echo.

    if "%PROCESSOR_ARCHITECTURE%"=="x86" if "%PROCESSOR_ARCHITEW6432%"=="" goto x86

    set ProgramFilesPath=%ProgramFiles(x86)%

    goto startResetting

    :x86

    set ProgramFilesPath=%ProgramFiles%

    :startResetting

    echo.

    if exist "%ProgramFilesPath%Windows Resource KitsToolssubinacl.exe" goto filesExist

    echo ***ERROR*** – Could not find file %ProgramFilesPath%Windows Resource KitsToolssubinacl.exe. Double-check that SubInAcl is correctly installed and re-run this script.

    goto END

    :filesExist

    pushd "%ProgramFilesPath%Windows Resource KitsTools"

    echo.

    echo Resetting ACLs…

    echo (this may take several minutes to complete)

    echo.

    echo IMPORTANT NOTE: For this script to run correctly, you must change

    echo the values named YOURUSERNAME to be the Windows user account that

    echo you are logged in with.

    echo.

    echo ==========================================================================

    echo.

    echo.

    subinacl.exe /subkeyreg HKEY_CURRENT_USER /grant=Administrator=f /grant=system=f /grant=Gast=r /grant=YOURUSERNAME=f /setowner=Administrator > %temp%subinacl_output.txt

    echo.

    echo.

    subinacl.exe /keyreg HKEY_CURRENT_USER /grant=Administrator=f /grant=system=f /grant=Gast=r /grant=YOURUSERNAME=f /setowner=Administrator >> %temp%subinacl_output.txt

    echo.

    echo.

    subinacl.exe /subkeyreg HKEY_LOCAL_MACHINE /grant=Administrator=f /grant=system=f /grant=benutzer=r /grant=jeder=r /grant=Gast=r /setowner=Administrator >> %temp%subinacl_output.txt

    echo.

    echo.

    subinacl.exe /keyreg HKEY_LOCAL_MACHINE /grant=Administrator=f /grant=system=f /grant=benutzer=r /grant=jeder=r /grant=Gast=r /setowner=Administrator >> %temp%subinacl_output.txt

    echo.

    echo.

    subinacl.exe /subkeyreg HKEY_CLASSES_ROOT /grant=Administrator=f /grant=system=f /grant=benutzer=r /setowner=Administrator >> %temp%subinacl_output.txt

    echo.

    echo.

    subinacl.exe /keyreg HKEY_CLASSES_ROOT /grant=Administrator=f /grant=system=f /grant=benutzer=r /setowner=Administrator >> %temp%subinacl_output.txt

    echo.

    echo.

    echo System Drive…

    subinacl.exe /subdirectories %ProgramFilesPath% /grant=Administrator=f /grant=system=f /grant=benutzer=e >> %temp%subinacl_output.txt

    echo.

    echo.

    echo Windows Directory…

    subinacl.exe /subdirectories %windir% /grant=Administrator=f /grant=system=f /grant=benutzer=e >> %temp%subinacl_output.txt

    echo.

    echo.

    echo ==========================================================================

    echo.

    echo FINISHED.

    echo.

    echo Press any key to exit . . .

    pause >NUL

    popd

    :END

    endlocal

  93. Trixie&0re0 says:

    Copied and ran script from http://cid-27e6a35d1a492af7.skydrive.live.com/self.aspx/Blog%7C_Tools/reset.cmd.txt you listed above. Where exactly will I find this logfile? Sorry, I cannot find it. I am running the reset.cmd because I am having difficulty with the windows update. When I run the update troubleshooter, I get 2 errors. One is “Service registration is missing or corrupt” and the other is windows update error 0x80070005; These are listed as not fixed but if I go to details they are listed as fixed. In trying to clarify, I got to your page. I seemed to get a lot of errors in running subinACL so I ran again with your script to get a log, but have been unable to find this log. Thanks for your help.

    1. Hi Trixie – To generate a log, you need to open an administrator cmd prompt and then run reset.cmd > %temp%\subinacl_log.txt. The > sign will redirect output from the cmd prompt window to the file that you specify afterwards.

  94. Trixie&0re0 says:

    PS related to previous post, I am running win7 64 home premium.

  95. Steven Zaharakis says:

    Seems I am one of the many who can’t fix the 80070005 error code. I have installed countless fixes manually and tried many things. I have tried the process above twice as administrator and still can’t fix it. I am simply trying to fix the fact that Windows Update constantly shows as “checking for updates”. This only happened after SP1 and some fixes were installed. Shocked that something this simple on Windows 7 has no simple fix.

    1. Hi Steven Zaharakis – For Windows Update issues, I’d suggest posting a question on one of the Windows forums at http://answers.microsoft.com/en-us/windows to see if someone there has any additional suggestions for you to try.

  96. John says:

    I have downloaded and installed SubInACL tool. It installed in the correct directory, however when I run the reset.cmd script it tells me that it cannot find subinacl.exe in C:\Program Files (x86)\Windows Resource Kits\Tools

    I have verified the file is there. Any ideas??

    1. Hi John – I think this might be caused by a formatting issue when copying and pasting the reset.cmd commands. I just tried copying and pasting them from https://blogs.msdn.microsoft.com/astebner/2006/09/04/solving-setup-errors-by-using-the-subinacl-tool-to-repair-file-and-registry-permissions/, and the quotation mark characters are being converted from standard quotes to formatted open and closed quotes, and those formatted quotes aren’t recognized when running the script. You can see if that is the issue in your scenario by opening your reset.cmd in notepad and changing the formatted open and closed quotes to standard quotes and then saving and re-running the script.

  97. Ronny Barrientos says:

    Esto es lo que debería ir en el RUN.CMD en windows 7 SP1 en español:

    @echo off

    setlocal

    echo.
    echo Determine whether we are on an 32 or 64 bit machine
    echo.

    if “%PROCESSOR_ARCHITECTURE%”==”x86” if “%PROCESSOR_ARCHITEW6432%”==”” goto x86

    set ProgramFilesPath=%ProgramFiles(x86)%

    goto startResetting

    :x86

    set ProgramFilesPath=%ProgramFiles%

    :startResetting

    echo.

    if exist “%ProgramFilesPath%\Windows Resource Kits\Tools\subinacl.exe” goto filesExist

    echo ***ERROR*** – Could not find file %ProgramFilesPath%\Windows Resource Kits\Tools\subinacl.exe. Double-check that SubInAcl is correctly installed and re-run this script.
    goto END

    :filesExist

    pushd “%ProgramFilesPath%\Windows Resource Kits\Tools”

    subinacl.exe /subkeyreg HKEY_LOCAL_MACHINE /grant=administradores=f /grant=system=f
    subinacl.exe /subkeyreg HKEY_CURRENT_USER /grant=administradores=f /grant=system=f
    subinacl.exe /subkeyreg HKEY_CLASSES_ROOT /grant=administradores=f /grant=system=f
    subinacl.exe /subdirectories %windir% /grant=administradores=f /grant=system=f

    echo FINISHED.
    echo.
    echo Press any key to exit . . .
    pause >NUL

    popd

    :END

    endlocal

    1. Ronny Barrientos says:

      oops, en lugar de RUN.CMD quise decir RESET.CMD

    2. Hi Ronny Barrientos – Thank you for posting these instructions for Spanish versions of Windows 7. For other folks reading this in the future, you can also use the account SID instead of the translated names of groups like Administrators. You can find a list of commonly used SID values in the knowledge base article at https://support.microsoft.com/en-us/kb/243330.

  98. PM says:

    I ran the SubInACL Tool for my Windows 7 PC. It ran a while then stopped, giving the message” SetKerne 1ObjectSecurity Error : 5 Access is Denied”. I still cannot get Windows Updates and I am still getting the message “Windows Help and Support Can’t Start”.
    Any helpful ideas?
    Thanks,
    Paul

    1. Hi PM – I’d recommend posting a question on the Windows 7 forum at http://answers.microsoft.com/en-us/windows/forum/windows_7http://answers.microsoft.com/en-us/windows/forum/windows_7 to see if someone there can suggest some ideas for you to try to solve this problem on your PC.

  99. Hi Aaron,
    Just wanted to send a comment that I had problems running the reset.cmd. I was getting the following errors as posted on 10/12/14:
    ‘subinacl’ is not recognized as an internal or external command, operable program or batch file.

    ‘subinacl’ is not recognized as an internal or external command, operable program or batch file.

    ‘subinacl’ is not recognized as an internal or external command, operable program or batch file.

    ‘subinacl’ is not recognized as an internal or external command, operable program or batch file.

    =========================

    Finished.

    =========================
    After reading David King’s comment on 6/2/15, I moved the subinacl files from the resources tool folder to system32 folder; & the command ran with no problems. I was getting the 0x8007005 error when I was trying to run the hide windows 10 update diagnostic. After the command ran successfully, I was able to run the diagnostic & hide the driver updates. Thanks to both David King & you, Aaron for finding the fix to this dreadful error. Dom

  100. NICLIN says:

    je veux ouvrir.un compte administrateur