Windows Forum / Windows XP / Accessibility / October 2003
How to get full access to all contents?
|
|
Thread rating:  |
Dmitriy Kopnichev - 27 Oct 2003 09:48 GMT Hello I get "Windows cannot access the specified device, path, or file. You may not have appropriate permissions to access the item." when I double-click a file. I'm the only owner of the computer. How to get full access to all contents?
Kelly - 27 Oct 2003 09:59 GMT Without knowing more, see if this helps:
EXE and LNK Fix for Windows XP - Line 12 http://www.kellys-korner-xp.com/xp_tweaks.htm
To use the Regedit: Save the REG File to your hard disk. Double click it and answer yes to the import prompt. REG files can be viewed in Notepad by right clicking on the file and selecting Edit.
 Signature All the Best, Kelly
MS-MVP Win98/XP [AE-Windows® XP]
Troubleshooting Windows XP http://www.kellys-korner-xp.com
Top 10 Frequently Asked Questions and Answers http://www.kellys-korner-xp.com/top10faqs.htm
> Hello > I get "Windows cannot access the specified device, path, or file. You may > not have appropriate permissions to access the item." when I double-click a > file. I'm the only owner of the computer. How to get full access to all > contents? Dmitriy Kopnichev - 27 Oct 2003 10:09 GMT What should I choose on your page? What should I know?
> Without knowing more, see if this helps: > [quoted text clipped - 11 lines] > > file. I'm the only owner of the computer. How to get full access to all > > contents? Dmitriy Kopnichev - 27 Oct 2003 10:13 GMT I'm the Owner of the file and have full access, but the "Effective permissions" are all checked and grayed for me.
> Without knowing more, see if this helps: > [quoted text clipped - 11 lines] > > file. I'm the only owner of the computer. How to get full access to all > > contents? Roger Abell - 27 Oct 2003 16:04 GMT This means that you have full control and it is inherited from some higher directory. Are you sure that there is no Deny for some group, and if there is make sure your account is not a member of the group. Deny overrides a Grant.
 Signature Roger Abell Microsoft MVP (Windows Server System: Security) MCSE (W2k3,W2k,Nt4) MCDBA
> I'm the Owner of the file and have full access, but the "Effective > permissions" are all checked and grayed for me. [quoted text clipped - 15 lines] > > > file. I'm the only owner of the computer. How to get full access to all > > > contents? Dmitriy Kopnichev - 27 Oct 2003 22:07 GMT How to become sure that there is no Deny for any group. The file is EFS protected. But I can open other EFS protected files.
> This means that you have full control and it is inherited from > some higher directory. [quoted text clipped - 41 lines] > all > > > > contents? Roger Abell - 28 Oct 2003 01:30 GMT When you look at the file's properties Security dialog is anything checked for any group in the Deny column ? You must highlight each group listed one at a time and then look at what is Granted/Denied. An account that is only in Administrators group is actually also in other things to which there can be NTFS Grants/Denies, like Authenticated Users, Network, Interactive, Everyone. . . . Not having EFS authorization appears as if it is a NTFS permissions denial. You should use the cipher commandline utility to examine the thumbprint info of the file to see what accounts are allowed to decrypt it.
 Signature Roger Abell Microsoft MVP (Windows Server System: Security) MCSE (W2k3,W2k,Nt4) MCDBA
> How to become sure that there is no Deny for any group. The file is EFS > protected. But I can open other EFS protected files. [quoted text clipped - 45 lines] > > all > > > > > contents? Dmitriy Kopnichev - 28 Oct 2003 07:21 GMT There's only the Administrators group in the file's properties Security dialog. There is not anything checked for the group in the Deny column.
> When you look at the file's properties Security dialog > is anything checked for any group in the Deny column ? [quoted text clipped - 60 lines] > > > all > > > > > > contents? Dmitriy Kopnichev - 28 Oct 2003 07:32 GMT There's no a NTFS permissions denial. There's only "Windows cannot access the specified device, path, or file. You may not have appropriate permissions to access the item."
> When you look at the file's properties Security dialog > is anything checked for any group in the Deny column ? [quoted text clipped - 60 lines] > > > all > > > > > > contents? Dmitriy Kopnichev - 28 Oct 2003 08:24 GMT Could the NTFS permissions denial begin to appear because of joining a domain?
> When you look at the file's properties Security dialog > is anything checked for any group in the Deny column ? [quoted text clipped - 60 lines] > > > all > > > > > > contents? Roger Abell - 28 Oct 2003 12:53 GMT It could, but such is not normally the case.
 Signature Roger Abell Microsoft MVP (Windows Server System: Security) MCSE (W2k3,W2k,Nt4) MCDBA
> Could the NTFS permissions denial begin to appear because of joining a > domain? [quoted text clipped - 63 lines] > > > > all > > > > > > > contents? Dmitriy Kopnichev - 28 Oct 2003 08:29 GMT I tried to add myself and/or another user to "Users Who Can Transparently Access this File" and got an error "ERSADU Error in adding new user(s). Error code 5."
> When you look at the file's properties Security dialog > is anything checked for any group in the Deny column ? [quoted text clipped - 60 lines] > > > all > > > > > > contents? Roger Abell - 28 Oct 2003 12:54 GMT code 5 is probably access failure in this case since you do not have EFS capability to decrypt you are not allowed to modify who can decrypt
 Signature Roger Abell Microsoft MVP (Windows Server System: Security) MCSE (W2k3,W2k,Nt4) MCDBA
> I tried to add myself and/or another user to "Users Who Can Transparently > Access this File" and got an error [quoted text clipped - 65 lines] > > > > all > > > > > > > contents? Dmitriy Kopnichev - 29 Oct 2003 17:36 GMT This is my file. I'm the only computer owner.
> code 5 is probably access failure > in this case since you do not have EFS capability to decrypt [quoted text clipped - 79 lines] > > > > > all > > > > > > > > contents? Roger Abell - 30 Oct 2003 03:46 GMT You may own the machine and the files may be yours, but if it is encrypted and you cannot prove to the system that you are supposed to be able to decrypt it then it will not let you.
The only way to prove that you are supposed to be able to access the EFS encrypted file is to use an account that has loaded into it the decryption key that corresponds to the certificate that was used to encrypt the file.
When you renamed the machine, apparently starting down the road of denied access, something seems to have removed that capability. When you used cipher to look at the file it said that there was no user account allowed to decrypt it, instead indicating the machine was allowed to decrypt it. That, assuming you have reported accurately what you saw, is something with which I am unfamiliar, either as to why it got that way or how to get out of that situation.
 Signature Roger Abell Microsoft MVP (Windows Server System: Security) MCSE (W2k3,W2k,Nt4) MCDBA
> This is my file. I'm the only computer owner. > > code 5 is probably access failure [quoted text clipped - 84 lines] > > > > > > all > > > > > > > > > contents? Dmitriy Kopnichev - 30 Oct 2003 07:44 GMT I haven't removed any account. Isn't the "ME$(ME$@workgroup)" a user account? I used not the cipher, but "Encryption Details for" the file window in "Advanced Attributes" of the file window. I saved a Private key to a .pfx file before I was joined the domain and my computer was renamed by the domain administrators.
> You may own the machine and the files may be yours, > but if it is encrypted and you cannot prove to the system [quoted text clipped - 106 lines] > > > > > > > all > > > > > > > > > > contents? Dmitriy Kopnichev - 30 Oct 2003 08:42 GMT Will I retain access to needed network folders if I rename my computer back to ME (and click "Workgroup" in "Computer name changes" window) in "System Properties" window? This might help get access to the file.
> You may own the machine and the files may be yours, > but if it is encrypted and you cannot prove to the system [quoted text clipped - 106 lines] > > > > > > > all > > > > > > > > > > contents? Dmitriy Kopnichev - 28 Oct 2003 08:43 GMT Could the NTFS permissions denial begin to appear because of the computer renaming?
> When you look at the file's properties Security dialog > is anything checked for any group in the Deny column ? [quoted text clipped - 60 lines] > > > all > > > > > > contents? Roger Abell - 28 Oct 2003 12:55 GMT You are dealing with an EFS issue it appears. Did you try using cipher yet ?
 Signature Roger Abell Microsoft MVP (Windows Server System: Security) MCSE (W2k3,W2k,Nt4) MCDBA
> Could the NTFS permissions denial begin to appear because of the computer > renaming? [quoted text clipped - 63 lines] > > > > all > > > > > > > contents? Dmitriy Kopnichev - 28 Oct 2003 15:08 GMT The only user Name in "Users Who Can Transparently Access This File" in "Encryption Details for" the file is "ME$(ME$@workgroup)". The "Recovery Agent Name" is Administrator. "ME" was my computer name before renaming. The renaming was made for joining the domain. "Workgroup" was my workgroup name. There was not a Local user with "ME" name before joining the domain. The error message is the same when I try to open the file under the Local "Administrator" account. Importing a private key saved before joining the domain haven't helped.
> You are dealing with an EFS issue it appears. > Did you try using cipher yet ? [quoted text clipped - 68 lines] > > > > > all > > > > > > > > contents? Dmitriy Kopnichev - 28 Oct 2003 15:17 GMT I encrypted the containing folder under local account "2" before renaming the computer. The file was encrypted when was placed in the folder under local account "2" after renaming. The Private key was saved under local account "2" too.
> You are dealing with an EFS issue it appears. > Did you try using cipher yet ? [quoted text clipped - 68 lines] > > > > > all > > > > > > > > contents? Dmitriy Kopnichev - 27 Oct 2003 23:02 GMT I'm a member of the Administrators group only. The Administrators group has full access to the file.
> This means that you have full control and it is inherited from > some higher directory. [quoted text clipped - 41 lines] > all > > > > contents? Dmitriy Kopnichev - 27 Oct 2003 13:55 GMT What the EXE and LNK Fixes would do in my Windows XP? How to know If they would help?
> Without knowing more, see if this helps: > [quoted text clipped - 11 lines] > > file. I'm the only owner of the computer. How to get full access to all > > contents? Dmitriy Kopnichev - 27 Oct 2003 14:01 GMT The fixes didn't help.
> Without knowing more, see if this helps: > [quoted text clipped - 11 lines] > > file. I'm the only owner of the computer. How to get full access to all > > contents? Michael Solomon \(MS-MVP Windows Shell/User\) - 28 Oct 2003 22:11 GMT I don't know if you've seen this or if it will help but you might want to have a look at the following Knowledge Base Article: http://support.microsoft.com/default.aspx?scid=kb;en-us;308993&Product=winxp
-- Michael Solomon MS-MVP Windows Shell/User Backup is a PC User's Best Friend DTS-L.Org: http://www.dts-l.org/
> The fixes didn't help. > > Without knowing more, see if this helps: [quoted text clipped - 27 lines] > > > file. I'm the only owner of the computer. How to get full access to all > > > contents? Dmitriy Kopnichev - 29 Oct 2003 18:16 GMT "the following people can decrypt an encrypted file. Any user who was designated as a recovery agent" is written in the http://support.microsoft.com/default.aspx?scid=kb;en-us;308993&Product=winxp The user who was designated as a recovery agent is the Administrator. I tried to decrypt the file under the Administrator account and got the same error message "Error Applying Attributes An error occurred applying attributes to the file: Path:\Filename Access is denied" "Michael Solomon (MS-MVP Windows Shell/User)" <user@#notme.com> wrote in message news:uTjJagZnDHA.2536@tk2msftngp13.phx.gbl...
> I don't know if you've seen this or if it will help but you might want to > have a look at the following Knowledge Base Article: http://support.microsoft.com/default.aspx?scid=kb;en-us;308993&Product=winxp
> -- > Michael Solomon MS-MVP [quoted text clipped - 36 lines] > all > > > > contents? Michael Solomon \(MS-MVP Windows Shell/User\) - 29 Oct 2003 19:52 GMT This sounds like a file ownership issue related to NTFS. Note, file ownership and permissions supersede administrator rights. How you resolve it depends upon which version of XP you are running.
XP-Home
Unfortunately, XP Home using NTFS is essentially hard wired for "Simple File Sharing" at system level.
However, you can set XP Home permissions in Safe Mode. Reboot, and start hitting F8, a menu should eventually appear and one of the options is Safe Mode. Select it. Note, it will ask for the administrator's password. This is not your administrator account, rather it is the machine's administrator account for which users are asked to create a password during setup.
If you created no such password, when requested, leave blank and press enter.
Open Explorer, go to Tools and Folder Options, on the view tab, scroll to the bottom of the list, if it shows "Enable Simple File Sharing" deselect it and click apply and ok. If it shows nothing or won't let you make a change, move on to the next step.
Navigate to the files, right click, select properties, go to the Security tab, click advanced, go to the Owner tab and select the user that was logged on when you were refused permission to access the files. Click apply and ok. Close the properties box, reopen it, click add and type in the name of the user you just enabled. If you wish to set ownership for everything in the folder, at the bottom of the Owner tab is the following selection: "Replace owner on subcontainers and objects," select it as well.
Once complete, you should be able to do what you wish with these files when you log back on as that user.
XP-Pro
If you have XP Pro, temporarily change the limited account to administrative. First, go to Windows Explorer, go to Tools, select Folder Options, go to the View tab and be sure "Use Simple File Sharing" is not selected. If it is, deselect it and click apply and ok.
If you wish everything in a specific folder to be accessible to a user, right click the folder, select properties, go to the Security tab, click Advanced, go to the Owner tab, select the user you wish to have access, at the bottom of the box, you should see a check box for "Replace owner on subcontainers and objects," place a check in the box and click apply and ok.
The user should now be able to perform necessary functions on files in the folder even as a limited account. If not, make it an admin account again, right click the folder, select Properties, go to the Security tab and be sure the user is listed in the user list. If not, click add and type the user name in the appropriate box, be sure the user has all the necessary permissions checked in the permission list below the user list, click apply and ok.
That should do it and allow whatever access you desire for that folder even in a limited account.
-- Michael Solomon MS-MVP Windows Shell/User Backup is a PC User's Best Friend DTS-L.Org: http://www.dts-l.org/
> "the following people can decrypt an encrypted file. > Any user who was designated as a recovery agent" is written in the http://support.microsoft.com/default.aspx?scid=kb;en-us;308993&Product=winxp
> The user who was designated as a recovery agent is the Administrator. I > tried to decrypt the file under the Administrator account and got the same [quoted text clipped - 6 lines] > > I don't know if you've seen this or if it will help but you might want to > > have a look at the following Knowledge Base Article: http://support.microsoft.com/default.aspx?scid=kb;en-us;308993&Product=winxp
> > -- > > Michael Solomon MS-MVP [quoted text clipped - 38 lines] > > all > > > > > contents? Dmitriy Kopnichev - 30 Oct 2003 07:49 GMT My account isn't a limited account, but administrative. "Use Simple File Sharing" is disabled when joining a domain. My account has full control over the file. "Michael Solomon (MS-MVP Windows Shell/User)" <user@#notme.com> wrote in message news:u5JjS3knDHA.3316@TK2MSFTNGP11.phx.gbl...
> This sounds like a file ownership issue related to NTFS. Note, file > ownership and permissions supersede administrator rights. How you resolve [quoted text clipped - 64 lines] > > "the following people can decrypt an encrypted file. > > Any user who was designated as a recovery agent" is written in the http://support.microsoft.com/default.aspx?scid=kb;en-us;308993&Product=winxp
> > The user who was designated as a recovery agent is the Administrator. I > > tried to decrypt the file under the Administrator account and got the same [quoted text clipped - 7 lines] > to > > > have a look at the following Knowledge Base Article: http://support.microsoft.com/default.aspx?scid=kb;en-us;308993&Product=winxp
> > > -- > > > Michael Solomon MS-MVP [quoted text clipped - 40 lines] > > > all > > > > > > contents? Roger Abell - 30 Oct 2003 03:41 GMT I believe that we earlier resolved that it is not an NTFS permissions issue. Administrator is a recovery agent only in Windows 2000. Windows XP has no recovery agent until one is configured or the machine is joined to an Active Directory.
 Signature Roger Abell Microsoft MVP (Windows Server System: Security) MCSE (W2k3,W2k,Nt4) MCDBA
> "the following people can decrypt an encrypted file. > Any user who was designated as a recovery agent" is written in the http://support.microsoft.com/default.aspx?scid=kb;en-us;308993&Product=winxp
> The user who was designated as a recovery agent is the Administrator. I > tried to decrypt the file under the Administrator account and got the same [quoted text clipped - 6 lines] > > I don't know if you've seen this or if it will help but you might want to > > have a look at the following Knowledge Base Article: http://support.microsoft.com/default.aspx?scid=kb;en-us;308993&Product=winxp
> > -- > > Michael Solomon MS-MVP [quoted text clipped - 38 lines] > > all > > > > > contents? Michael Solomon \(MS-MVP Windows Shell/User\) - 30 Oct 2003 05:50 GMT I'm inclined to agree, Roger. Sometimes, however, when what is supposed to work doesn't, it's worth a shot to try something that might be a cause but isn't directly indicated. I didn't feel there was any harm in exploring the option though I'm not sure if he can even take ownership of encrypted files.
That said, something he had said about changing the computer or workgroup name, sorry I don't recall, triggered me to reconsider the possibility of a file ownership issue.
-- Michael Solomon MS-MVP Windows Shell/User Backup is a PC User's Best Friend DTS-L.Org: http://www.dts-l.org/
> I believe that we earlier resolved that it is not an > NTFS permissions issue. [quoted text clipped - 8 lines] > > "the following people can decrypt an encrypted file. > > Any user who was designated as a recovery agent" is written in the http://support.microsoft.com/default.aspx?scid=kb;en-us;308993&Product=winxp
> > The user who was designated as a recovery agent is the Administrator. I > > tried to decrypt the file under the Administrator account and got the same [quoted text clipped - 7 lines] > to > > > have a look at the following Knowledge Base Article: http://support.microsoft.com/default.aspx?scid=kb;en-us;308993&Product=winxp
> > > -- > > > Michael Solomon MS-MVP [quoted text clipped - 40 lines] > > > all > > > > > > contents? Roger Abell - 30 Oct 2003 12:43 GMT Sure, I understand, but we already covered that ground back toward the beginning of this (? he has started so many) thread.
 Signature Roger
"Michael Solomon (MS-MVP Windows Shell/User)" <user@#notme.com> wrote in message news:%23AfCJFqnDHA.2432@TK2MSFTNGP10.phx.gbl...
> I'm inclined to agree, Roger. Sometimes, however, when what is supposed to > work doesn't, it's worth a shot to try something that might be a cause but [quoted text clipped - 23 lines] > > > "the following people can decrypt an encrypted file. > > > Any user who was designated as a recovery agent" is written in the http://support.microsoft.com/default.aspx?scid=kb;en-us;308993&Product=winxp
> > > The user who was designated as a recovery agent is the Administrator. I > > > tried to decrypt the file under the Administrator account and got the [quoted text clipped - 8 lines] > > to > > > > have a look at the following Knowledge Base Article: http://support.microsoft.com/default.aspx?scid=kb;en-us;308993&Product=winxp
> > > > -- > > > > Michael Solomon MS-MVP [quoted text clipped - 41 lines] > > > > all > > > > > > > contents? Michael Solomon \(MS-MVP Windows Shell/User\) - 30 Oct 2003 21:41 GMT OK Roger, I think I got a little lost in this thread!:-)
-- Michael Solomon MS-MVP Windows Shell/User Backup is a PC User's Best Friend DTS-L.Org: http://www.dts-l.org/
> Sure, I understand, but we already covered that ground > back toward the beginning of this (? he has started so many) [quoted text clipped - 36 lines] > > > > "the following people can decrypt an encrypted file. > > > > Any user who was designated as a recovery agent" is written in the http://support.microsoft.com/default.aspx?scid=kb;en-us;308993&Product=winxp
> > > > The user who was designated as a recovery agent is the Administrator. > I [quoted text clipped - 11 lines] > > > to > > > > > have a look at the following Knowledge Base Article: http://support.microsoft.com/default.aspx?scid=kb;en-us;308993&Product=winxp
> > > > > -- > > > > > Michael Solomon MS-MVP [quoted text clipped - 42 lines] > > > > > all > > > > > > > > contents? Dmitriy Kopnichev - 30 Oct 2003 07:33 GMT "Data Recovery Agents For This File As Defined By Recovery Policy" is "Administrator" is written in "Encryption Details for" the file window in "Advanced Attributes" window.
> I believe that we earlier resolved that it is not an > NTFS permissions issue. [quoted text clipped - 4 lines] > > "the following people can decrypt an encrypted file. > > Any user who was designated as a recovery agent" is written in the http://support.microsoft.com/default.aspx?scid=kb;en-us;308993&Product=winxp
> > The user who was designated as a recovery agent is the Administrator. I > > tried to decrypt the file under the Administrator account and got the same [quoted text clipped - 7 lines] > to > > > have a look at the following Knowledge Base Article: http://support.microsoft.com/default.aspx?scid=kb;en-us;308993&Product=winxp
> > > -- > > > Michael Solomon MS-MVP [quoted text clipped - 40 lines] > > > all > > > > > > contents? anonymous@discussions.microsoft.com - 27 Oct 2003 18:12 GMT >-----Original Message----- >Hello [quoted text clipped - 4 lines] > >.
|
|
|