How to Recover Default Permissions with a Parallel Installation (202965)

SYMPTOMS

When you attempt to secure a Microsoft Windows NT-based computer by changing the default NTFS file and folder permissions on the %SystemRoot% folder or the default system folders, some functions may be impaired (for example, the ability of a user or administrator to log on locally or to the network, to print, to gain access to logon scripts, or to gain access to other necessary functions).

RESOLUTION

If You Change Permissions So That No User Can Log on Locally

To restore permissions, install a parallel installation of Windows NT in a temporary folder, and then run Cacls.exe to restore permissions. For example, if permissions are set so that everyone has no permissions on drive C, you can use the "CACLS C:\ /T /E /G EVERYONE:F" command to give everyone Full Control permissions, and then an administrator can log on and run Fixacls.exe.

NOTE: You may need to use the /C switch to continue the process if an error occurs (for example, use the "CACLS C:\ /T /E /C /G EVERYONE:F" command).

In the case of computers running Microsoft Windows NT 4.0, you may be able to start Task Manager by pressing CTRL+ALT+DELETE. If you can start Task Manager:

In Task Manager, click New Task on the File menu.
In the Open box, type cmd.
At the command prompt, type cacls c:\ /t /e /g everyone:f.

REFERENCES

For additional information, please see the following articles in the Microsoft Knowledge Base:

167320 Fixacls.exe Not Available in Windows NT Server 4.0 Resource Kit

137155 Users Without System32 Permissions Cannot Logon

148437 Default NTFS Permissions in Windows NT