Notes about a couple of possible issues while using the SubInAcl tool

********************************

Important note - if you were referred to this blog post from this knowledge base article and are having trouble running SubInAcl or reset.cmd, please try the steps listed in my other blog post first - https://blogs.msdn.com/b/astebner/archive/2006/09/04/solving-setup-errors-by-using-the-subinacl-tool-to-repair-file-and-registry-permissions.aspx.

********************************

A while back, I posted some instructions for using a tool from the Windows Resource Kit named SubInAcl that can be used to update file, folder and registry permissions.  This tool can help fix some types of access denied errors that can be encountered while trying to install products, hotfixes and service packs on Windows.

Since that original post, I have heard from some people who have run into various types of problems while attempting to install and use the SubInAcl tool.  I wanted to post more details about a few of these scenarios in case other folks run into similar issues in the future.

Issue 1 - Running SubInAcl reports an error on some non-English operating systems

On some non-English operating systems, customers have reported seeing errors like the following when trying to use the command lines listed in my previous blog post:

LookupAccountName : HKEY_CURRENT_USER:administrators 1337 The security ID structure is invalid.

The reason for this error is that on some non-English operating systems, the name of the Administrators group is translated into the OS language.  If you are running SubInAcl on a non-English OS where the name of the Administrators group is translated, you will need to update each of the command lines for SubInAcl to specify the translated name of the Administrators group.

Issue 2 - SubInAcl.msi fails to install

I have heard from a few people who were not able to get the SubInAcl.msi installer to work correctly on their systems, which prevented them from being able to use the tool.  If you run into an error while installing SubInAcl.msi to install this tool, you can get a copy of the tool that does not require a full installation from an alternate location by using the following steps:

  1. Download SubInAcl.zip and save it to your local computer
  2. Extract the contents of the zip file to a local folder on your system
  3. Use the steps in the previous blog post to run SubInAcl from the extracted location with the following modifications:
    1. Skip step 1 - there is no need to download and install subinacl.msi because subinacl.zip contains the same files that would normally be installed by subinacl.msi
    2. Depending on where you extract the zip file to in step 2 above, you may need to edit reset.cmd and change the folder path that it is trying to run subinacl.exe from

Note - you should first attempt to install and run SubInAcl.msi before downloading and extracting this zip file.  This zip file is only intended for cases where for some reason, SubInAcl.msi will not install correctly - which unfortunately can sometimes happen because of one of the same issues that SubInAcl is designed to fix.

Issue 3 - How to get SubInAcl to create a log file

SubInAcl is a console application, which means that the output that it prints will be displayed in the console window by default.  For the command lines listed in my previous blog post, SubInAcl prints a lot of information, and if any errors occur, it will quickly scroll off the screen and you won't be able to see the details of the errors.

For a console application like SubInAcl, running it from a cmd prompt and putting a greater than sign and then the name of a file at the end of the command line (such as > %temp%\subinacl_output.txt) will cause the output to be redirected to a file.  I recently updated the command lines in that post and in the example script I posted on my file server to use this syntax to redirect the output to a file instead of printing it to the console.

Note - creating a log file as described above will not work if you run SubInAcl from the Windows start menu.  It has to be run from a cmd prompt in order to allow the log file to be created.

<update date="3/30/2009"> Fixed broken download links that are contained in this post. </update>

<update date="10/7/2014"> Added a note to the top of this post with alternate instructions for people who were referred to this blog post from this knowledge base article. </update>

<update date="4/14/2015"> Clarified the steps in Issue 2 </update>