Administrator can’t see folders/files of user account

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

As the Administrator of an XP Home computer I am not able to view any
of the files of one of the User Accounts. I set up 3 Limited Accounts
at the same time, when the computer (HPzd7000) was new. When I use
Windows Explorer to view files, I can see all of the user files except
for folders and files for the account named "Brett", even though the
account type is Limited; I get an "Access is denied" message. If I
open My Computer, Brett’s files do not even appear in the listing of
folders and files; all other user accounts do.

Any ideas about why this occurs?

--
Posted using the http://www.windowsforumz.com interface, at author's request
Articles individually checked for conformance to usenet standards
Topic URL: http://www.windowsforumz.com/Security-Admin-istrator-folders-files-user-account-ftopict554977.html
Visit Topic URL to contact author (reg. req'd). Report abuse: http://www.windowsforumz.com/eform.php?p=1762986

 

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

AdamsDad wrote:
> As the Administrator of an XP Home computer I am not able to view any
> of the files of one of the User Accounts. I set up 3 Limited Accounts
> at the same time, when the computer (HPzd7000) was new. When I use
> Windows Explorer to view files, I can see all of the user files except
> for folders and files for the account named "Brett", even though the
> account type is Limited; I get an "Access is denied" message. If I
> open My Computer, Brett’s files do not even appear in the listing of
> folders and files; all other user accounts do.
>
> Any ideas about why this occurs?

Yes - Brett is smart - Brett removed the administrator from the access list
of Brett's files.
You can take ownership of the files and give Brett permissions back - but
unless you are smart too, Brett will know.

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

 

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

"" wrote:
> AdamsDad wrote:
> > As the Administrator of an XP Home computer I am not able to
> view any
> > of the files of one of the User Accounts. I set up 3
> Limited Accounts
> > at the same time, when the computer (HPzd7000) was new.
> When I use
> > Windows Explorer to view files, I can see all of the user
> files except
> > for folders and files for the account named "Brett", even
> though the
> > account type is Limited; I get an "Access is denied"
> message. If I
> > open My Computer, Brett’s files do not even appear in the
> listing of
> > folders and files; all other user accounts do.
> >
> > Any ideas about why this occurs?
>
> Yes - Brett is smart - Brett removed the administrator from
> the access list
> of Brett's files.
> You can take ownership of the files and give Brett permissions
> back - but
> unless you are smart too, Brett will know.
>
> --
> Shenan Stanley
> MS-MVP
> --
> How To Ask Questions The Smart Way
> http://www.catb.org/~esr/faqs/smart-questions.html

OK SS,

I went to Safe Mode and added Administrator and AdamsDad to the
Limited account, rebooted, but still have the same problem...no access
to files and folders. I have checked back in Safe Mode to assure the
permissions are still there; they are.

So now what ???

--
Posted using the http://www.windowsforumz.com interface, at author's request
Articles individually checked for conformance to usenet standards
Topic URL: http://www.windowsforumz.com/Security-Admin-istrator-folders-files-user-account-ftopict554977.html
Visit Topic URL to contact author (reg. req'd). Report abuse: http://www.windowsforumz.com/eform.php?p=1763841

 

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

AdamsDad wrote:
> As the Administrator of an XP Home computer I am not able to
> view any of the files of one of the User Accounts. I set up 3
> Limited Accounts at the same time, when the computer (HPzd7000) was new.
> When I use Windows Explorer to view files, I can see all of the user
> files except for folders and files for the account named "Brett", even
> though the account type is Limited; I get an "Access is denied"
> message. If I open My Computer, Brett’s files do not even appear in the
> listing of folders and files; all other user accounts do.
>
> Any ideas about why this occurs?

Shenan wrote:
> Yes - Brett is smart - Brett removed the administrator from
> the access list of Brett's files.
> You can take ownership of the files and give Brett permissions
> back - but unless you are smart too, Brett will know.

AdamsDad wrote:
> I went to Safe Mode and added Administrator and AdamsDad to the
> Limited account, rebooted, but still have the same problem...no access
> to files and folders. I have checked back in Safe Mode to assure the
> permissions are still there; they are.
>
> So now what ???

You did not take ownership. Access Denied (in this case) has nothing to do
with you being in a certain group (although you must be in the
administrators group to take ownership) and all about who owns the files and
who has Read/Execute permissions on the files/folders.

How to Take Ownership of a File or Folder in Windows XP
http://support.microsoft.com/kb/308421

How to disable simplified sharing & set permissions
on a shared folder in Windows XP
http://support.microsoft.com/kb/307874

Research - wonderful thing. =)

Remember - as I said - if you TAKE OWNERSHIP of the files and do not grant
Brett access back to the files - Brett will know - and if they are smart -
they will still know unless you take further steps to not only take
ownership, but give the administrator permissions and then grant Brett back
ownership of the files. Luckily you have XP Home, so Brett cannot keep you
from snooping easily without a third party application to encrypt their
files.

Perhaps there are a few other things you should look at:

How To Create a Custom Default User Profile
http://support.microsoft.com/kb/319974

HOW TO: Create and Configure User Accounts in Windows XP
http://support.microsoft.com/kb/279783

HOW TO: Set, View, Change, or Remove Special Permissions for Files and
Folders in Windows XP
http://support.microsoft.com/kb/308419

Doug's Windows XP Security Console
http://www.dougknox.com/xp/utils/xp_securityconsole.htm

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

 

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

"AdamsDad" wrote:
> OK SS,
>
> I went to Safe Mode and added Administrator and AdamsDad to
> the Limited account, rebooted, but still have the same
> problem...no access to files and folders. I have checked back
> in Safe Mode to assure the permissions are still there; they
> are.
>
> So now what ???

Shenan,

Now I can view the files in Brett’s account, but he can no longer
access his account. When he logs on, a box come up with the message:
"Windows cannot log you on because your profile cannot be loaded.
See administrator..."

Additionally, how do I give permission back to this account. I am
assuming this is causing the log on problems. The "permissions"
link you listed from Microsoft is for setting up the sharing files
across a network.

John

 

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

AdamsDad wrote:
> Now I can view the files in Brett’s account, but he can no longer
> access his account. When he logs on, a box come up with the message:
> "Windows cannot log you on because your profile cannot be loaded.
> See administrator..."
>
> Additionally, how do I give permission back to this account. I am
> assuming this is causing the log on problems. The "permissions"
> link you listed from Microsoft is for setting up the sharing files
> across a network.

I warned you it would be bad.. Brett was smart enough to change the
permissions.. You likely shouldn't have messed with it until you understood
what you were doing.

The links I gave included file and directory permissions and taking
ownership as well.. Both inter-connected and necessary - not just for
sharing across a network, but even for accessing files on the local NTFS
formatted drive. You need to use the link I will repeat to figure out how
to gran FULL CONTROL of the proper directories back to Brett (who now knows
what you have done, likely eh?)

Essentially you have to give Brett FULL CONTROL to ALL the files and folders
under Brett's folder in C:\Documents and Settings.. Every single file and
folder.

HOW TO: Set, View, Change, or Remove Special Permissions for Files and
Folders in Windows XP
http://support.microsoft.com/kb/308419

And to give Brett ownership again will require a third party utility or
logon as admin, repoint Brett's profile elsewhere by renaming Brett's
current profile directory, logout as admin, login by Brett, take ownership
of Brett's files and folders(assuming Brett is an administrator), logout as
brett, reboot, logon as admin, delete newly created profile directory for
Brett, rename Brett's old profile directory to the name of the directory you
just deleted, logout as admin, logon as Brett.

One utility to GIVE ownership (instead of going through the
logon/logoff/reboot/logon/logoff thing..) is "subinacl"...

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

 

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

"" wrote:
> AdamsDad wrote:
> > Now I can view the files in Brett’s account, but he can no
> longer
> > access his account. When he logs on, a box come up with the
> message:
> > "Windows cannot log you on because your profile cannot be
> loaded.
> > See administrator..."
> >
> > Additionally, how do I give permission back to this account.
> I am
> > assuming this is causing the log on problems. The
> "permissions"
> > link you listed from Microsoft is for setting up the sharing
> files
> > across a network.
>
> I warned you it would be bad.. Brett was smart enough to
> change the
> permissions.. You likely shouldn't have messed with it until
> you understood
> what you were doing.
>
> The links I gave included file and directory permissions and
> taking
> ownership as well.. Both inter-connected and necessary - not
> just for
> sharing across a network, but even for accessing files on the
> local NTFS
> formatted drive. You need to use the link I will repeat to
> figure out how
> to gran FULL CONTROL of the proper directories back to Brett
> (who now knows
> what you have done, likely eh?)
>
> Essentially you have to give Brett FULL CONTROL to ALL the
> files and folders
> under Brett's folder in C😀ocuments and Settings.. Every
> single file and
> folder.
>
> HOW TO: Set, View, Change, or Remove Special Permissions for
> Files and
> Folders in Windows XP
> http://support.microsoft.com/kb/308419
>
> And to give Brett ownership again will require a third party
> utility or
> logon as admin, repoint Brett's profile elsewhere by renaming
> Brett's
> current profile directory, logout as admin, login by Brett,
> take ownership
> of Brett's files and folders(assuming Brett is an
> administrator), logout as
> brett, reboot, logon as admin, delete newly created profile
> directory for
> Brett, rename Brett's old profile directory to the name of the
> directory you
> just deleted, logout as admin, logon as Brett.
>
> One utility to GIVE ownership (instead of going through the
> logon/logoff/reboot/logon/logoff thing..) is "subinacl"...
>
> --
> Shenan Stanley
> MS-MVP
> --
> How To Ask Questions The Smart Way
> http://www.catb.org/~esr/faqs/smart-questions.html

Well, it’s been a few days of searching, reading and getting a grasp
of how to make the necessary repairs with out further compromising my
system. I have been reading the doc’s for subinacl and doing a
little "non-destructive" testing. It’s been quite a while since I
have used the command line, so it’s a little slow going.

In my attempt to test subinacl, I found this site:
http://www.windowsitpro.com/Windows/Article/ArticleID/26362/26362.html
which recommends displaying a files ACL by using this command -
subinacl /verbose=1 /file c:testfile.txt /display. I can get this to
work only if c:testfile.txt is in the same directory as subinacl.
Whenever I add a directory before the file name (like C😀ocuments and
SettingsJohnMy Documentstestfile.txt) I get an error from subinacl.
Is there some special syntax I am missing/forgetting in the command
line?

I feel that subinacl is a powerful program that could further mess up
my system if I’m not careful.

--
Posted using the http://www.windowsforumz.com interface, at author's request
Articles individually checked for conformance to usenet standards
Topic URL: http://www.windowsforumz.com/Security-Admin-istrator-folders-files-user-account-ftopict393737.html
Visit Topic URL to contact author (reg. req'd). Report abuse: http://www.windowsforumz.com/eform.php?p=1302070

 

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

AdamsDad wrote:
> Well, it’s been a few days of searching, reading and getting a grasp
> of how to make the necessary repairs with out further compromising my
> system. I have been reading the doc’s for subinacl and doing a
> little "non-destructive" testing. It’s been quite a while since I
> have used the command line, so it’s a little slow going.
>
> In my attempt to test subinacl, I found this site:
> http://www.windowsitpro.com/Windows/Article/ArticleID/26362/26362.html
> which recommends displaying a files ACL by using this command -
> subinacl /verbose=1 /file c:testfile.txt /display. I can get this to
> work only if c:testfile.txt is in the same directory as subinacl.
> Whenever I add a directory before the file name (like C😀ocuments and
> SettingsJohnMy Documentstestfile.txt) I get an error from subinacl.
> Is there some special syntax I am missing/forgetting in the command
> line?
>
> I feel that subinacl is a powerful program that could further mess up
> my system if I’m not careful.

Long filenames/directory names require quotations marks..

"C:\Documents and Settings\john\My Documents\testfile.txt"

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

 

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

"AdamsDad" wrote:
> Well, it's been a few days of searching, reading and getting a
> grasp of how to make the necessary repairs with out further
> compromising my system. I have been reading the doc's for
> subinacl and doing a little
> "non-destructive" testing. It's been quite a while since I
> have used the command line, so it's a little slow going.
>
> In my attempt to test subinacl, I found this site:
> http://www.windowsitpro.com/Windows/Article/ArticleID/26362/26362.html
> which recommends displaying a files ACL by using this command
> - subinacl /verbose=1 /file c:testfile.txt /display. I can
> get this to work only if c:testfile.txt is in the same
> directory as subinacl. Whenever I add a directory before the
> file name (like C😀ocuments and SettingsJohnMy
> Documentstestfile.txt) I get an error from subinacl. Is
> there some special syntax I am missing/forgetting in the
> command line?
>
> I feel that subinacl is a powerful program that could further
> mess up my system if I'm not careful.

After much reading and some trial and error, I have now changed the
owner of Brett’s files to "Brett", using subinacl. As the
administrator, i can now view these files from my log in account,
however, Brett is no longer able to see or open any of his files.
When he logs in, all he sees is the desktop background but no files.
If we go to My Computer, all of the files are inaccessable. Am I
still missing something?

When I run in safe mode and look at the properties, "security" tab of
the directory in question, I see the following:

Administrators (DOMAINAdministrator)
Brett (DOMAINBrett)
SYSTEM

Under the "Advanced" button I see:
Permissions tab-
Administrators (DOMAINAdministrator)
Brett (DOMAINBrett)
SYSTEM

Owner tab-
Administrators (DOMAINAdministrators)

When I looked at the other user accounts on my system, I see similar
permissions and ownership. How can I return the "Brett" account to
normal functionality?