Aaron Stebner's WebLog

Thoughts about setup and deployment issues, WiX, XNA, the .NET Framework and Visual Studio

Solving setup errors by using the SubInACL tool to repair file and registry permissions

Solving setup errors by using the SubInACL tool to repair file and registry permissions

Rate This

A while back, I wrote a blog post about a .NET Framework 2.0 beta 2 installation problem that was caused by incorrect access control list (ACL) permissions on some registry hives.  In that post, I described how to use a tool in the Windows Resource Kit named SubInACL to reset file and registry ACLs to help solve this problem.

Ever since I wrote that post, I have run into installation errors for several other products that have been solved by using the SubInACL tool.  Therefore, I wanted to write a standalone set of instructions for how and when to use the SubInACL tool because the previous blog post is specific to the .NET Framework 2.0 setup and does not always appear in search results when people run into this kind of a problem and search the Internet for assistance.

How to download and run SubInACL

Here are some steps that can be used to download and run the SubInACL tool to repair file and registry permissions that are often needed to successfully install programs on Windows, particularly for MSI-based (Windows Installer) setups:

  1. Download the SubInACL tool and install it.  By default it will install to c:\Program Files\Windows Resource Kits\Tools
  2. If you are running Windows Vista, click on the Start menu, choose All Programs, then Accessories, then right-click on the item named Command Prompt and choose Run as administrator
  3. If you are running an OS other than Windows Vista, go to the Start menu, choose Run, type cmd and click OK
  4. In the cmd prompt, type notepad reset.cmd and click yes to open Notepad.exe and create a new text file named reset.cmd
  5. Copy and paste the following contents into reset.cmd (or download it from this location on my file server and rename it from reset.cmd.txt to reset.cmd):

    @echo off
    title Resetting ACLs...

    setlocal

    echo.
    echo Determine whether we are on an 32 or 64 bit machine
    echo.

    if "%PROCESSOR_ARCHITECTURE%"=="x86" if "%PROCESSOR_ARCHITEW6432%"=="" goto x86

    set ProgramFilesPath=%ProgramFiles(x86)%

    goto startResetting

    :x86

    set ProgramFilesPath=%ProgramFiles%

    :startResetting

    echo.

    if exist "%ProgramFilesPath%\Windows Resource Kits\Tools\subinacl.exe" goto filesExist

    echo ***ERROR*** - Could not find file %ProgramFilesPath%\Windows Resource Kits\Tools\subinacl.exe. Double-check that SubInAcl is correctly installed and re-run this script.
    goto END

    :filesExist

    pushd "%ProgramFilesPath%\Windows Resource Kits\Tools"

    echo.
    echo Resetting ACLs...
    echo (this may take several minutes to complete)
    echo.
    echo IMPORTANT NOTE: For this script to run correctly, you must change
    echo the values named YOURUSERNAME to be the Windows user account that
    echo you are logged in with.
    echo.
    echo ==========================================================================
    echo.
    echo.
    subinacl.exe /subkeyreg HKEY_CURRENT_USER /grant=administrators=f /grant=system=f /grant=restricted=r /grant=YOURUSERNAME=f /setowner=administrators > %temp%\subinacl_output.txt
    echo.
    echo.
    subinacl.exe /keyreg HKEY_CURRENT_USER /grant=administrators=f /grant=system=f /grant=restricted=r /grant=YOURUSERNAME=f /setowner=administrators >> %temp%\subinacl_output.txt
    echo.
    echo.
    subinacl.exe /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f /grant=system=f /grant=users=r /grant=everyone=r /grant=restricted=r /setowner=administrators >> %temp%\subinacl_output.txt
    echo.
    echo.
    subinacl.exe /keyreg HKEY_LOCAL_MACHINE /grant=administrators=f /grant=system=f /grant=users=r /grant=everyone=r /grant=restricted=r /setowner=administrators >> %temp%\subinacl_output.txt
    echo.
    echo.
    subinacl.exe /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f /grant=system=f /grant=users=r /setowner=administrators >> %temp%\subinacl_output.txt
    echo.
    echo.
    subinacl.exe /keyreg HKEY_CLASSES_ROOT /grant=administrators=f /grant=system=f /grant=users=r /setowner=administrators >> %temp%\subinacl_output.txt
    echo.
    echo.
    echo System Drive...
    subinacl.exe /subdirectories %ProgramFilesPath%\ /grant=administrators=f /grant=system=f /grant=users=e >> %temp%\subinacl_output.txt
    echo.
    echo.
    echo Windows Directory...
    subinacl.exe /subdirectories %windir%\ /grant=administrators=f /grant=system=f /grant=users=e >> %temp%\subinacl_output.txt
    echo.
    echo.
    echo ==========================================================================
    echo.
    echo FINISHED.
    echo.
    echo Press any key to exit . . .
    pause >NUL

    popd

    :END

    endlocal

     
  6. Change the values named YOURUSERNAME to be the Windows user account that you are logged in with.

    Note:  The YOURUSERNAME value should match the name of your user folder at c:\Documents and Settings (or c:\users on Windows Vista and higher).  You can also find the value to use for YOURUSERNAME by launching Task Manager and looking at the user name listed in the User Name column of the Processes tab.

  7. Save and close reset.cmd. 
  8. In the cmd prompt, type reset.cmd and press enter to run the SubInACL tool.  This tool will take several minutes to run, and it requires that the user account you are using has administrator privileges on the system.  This is why it is necessary to run it from an elevated cmd prompt on Windows Vista.  Step 2 above can be used to start an elevated cmd prompt on Windows Vista.
  9. After reset.cmd completes, try to install the product that previously failed to install correctly on your system.

Note: There are a couple of scenarios where installing or running SubInAcl can fail.  For example, some non-English versions of Windows have the name of the Administrators group translated to another language, and the command lines listed above will fail in that case.  I have posted workarounds for the issues that I know of in this separate blog post.

Also note: Running the above command lines will cause SubInAcl to create a log file named %temp%\subinacl_output.txt.  If you see any errors reported in the cmd prompt after running SubInAcl, you can look in this log file for more detailed information about what file(s), folder(s) or registry value(s) are causing the errors.  To open this log file, you can click on the Start menu, choose Run, type notepad %temp%\subinacl_output.txt and click OK.

When looking at this log file, you may see some errors reported with error code 5.  That error code means Access Denied, and it is typically caused by Windows or some other program running on your system that is holding files, folders or registry values in use so that SubInAcl is unable to update the permissions for them.  Most of the time, that type of error in the SubInAcl output can be safely ignored, but you may need to try to reboot and then manually fix the permissions for these files, folders or registry keys as a workaround.

When is SubInACL useful

I have found that the SubInACL tool is most useful when a setup package fails with error code 5 or 0x5 or 0x80070005.  All of these error codes mean Access Denied, and this type of error code is often caused by missing ACLs for the Administrators group or the built-in System account.  The Windows Installer service runs with System account permissions in most cases.  If the System account does not have sufficient permissions to access the file system or parts of the registry, an MSI-based setup package will fail with an Access Denied error.

SubInACL can also help resolve Internet Explorer script errors caused by incorrect access control permissions for specific user accounts on the system.

Example of a setup failure that was fixed by SubInACL

A customer contacted me with a problem installing Visual Studio 2005.  I looked at the main Visual Studio log file located at %temp%\dd_vsinstall80.txt, and I found that Windows Installer 3.1 setup was failing.  Then, I looked at the Windows Installer 3.1 setup log file located at %windir%\KB893803v2.log.  It showed the following error:

30.844: DoRegistryUpdates:UpdSpInstallFromInfSection Failed for MSI.Reg.Install: 0x5
30.844: DoInstallation:DoRegistryUpdates failed
30.875: Access is denied.

I had the customer run the above steps to use the SubInACL tool to update the file and registry ACLs on their system, and then they were able to install Windows Installer 3.1 and Visual Studio 2005 with no further problems.

<update date="11/15/2006"> Updated subinacl command lines to include recursive ACL updating for folders and files under %windir% </update>

<update date="3/22/2007"> Updated the steps to make them easier to follow by moving the directory change into the batch file. </update>

<update date="9/25/2007"> Updated the notes to indicate that some Internet Explorer script errors can be resolved with this tool as well. </update>

<update date="5/30/2008"> Updated command lines based on customer feedback regarding their experiences on Windows Vista. </update>

<update date="6/16/2008"> Updated command lines to cause SubInAcl to create a log file in the %temp% directory in case it is needed for troubleshooting afterwards. </update>

<update date="6/17/2008"> Added a link to a blog post where I describe a couple of workarounds for problems that can occur while trying to install and/or run SubInAcl. </update>

<update date="6/20/2008"> Updated command line to include a backslash after %SystemDrive% in the 2nd to last command. </update>

<update date="6/24/2008"> Updated wording of link to the post for troubleshooting SubInAcl errors to try to make it more visible. </update>

<update date="7/29/2008"> Updated directory ACL command lines to not affect the Documents and Settings sub-folders. </update>

<update date="3/12/2009"> Fixed broken link to reset.cmd. </update>

<update date="4/7/2009"> Added clarification about how to determine the correct value to substitute for YOURUSERNAME in the sample SubInAcl script. </update>

<update date="5/18/2009"> Added clarification about where to run reset.cmd after creating it. </update>

 

  • Hey thanks for writing the guide, but when I run the reset.cmd it always says it is not an internal or external command. Please Help!

  • Hi CaptainN - That error message means that the file reset.cmd is not in the directory that you ran the command from.  Please double-check that you ran the steps exactly as they are listed above in this blog post and that the file reset.cmd is located in the directory that you are running the command from in your cmd prompt.

  • Hello!

    I can't run this script but I think I tried everything, I get these messages:

    C:\Program Files\Windows Resource Kits\Tools>cd /d "C:\Program Files\Windows Res

    ource Kits\Tools"

    C:\Program Files\Windows Resource Kits\Tools>subinacl /subkeyreg HKEY_CURRENT_US

    ER /grant=rendszergazdák=f /grant=system=f /grant=restricted=r /grant=HM=f /set

    owner=rendszergazd├ík  1>C:\Users\HM2ECF~1\AppData\Local\Temp\subinacl_output.tx

    t

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=rendszergazd

    C:\Program Files\Windows Resource Kits\Tools>subinacl /keyreg HKEY_CURRENT_USER

    /grant=rendszergazdák=f /grant=system=f /grant=restricted=r /grant=HM=f /setown

    er=rendszergazd├ík  1>>C:\Users\HM2ECF~1\AppData\Local\Temp\subinacl_output.txt

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=rendszergazd

    C:\Program Files\Windows Resource Kits\Tools>subinacl /subkeyreg HKEY_LOCAL_MACH

    INE /grant=rendszergazdák=f /grant=system=f /grant=users=r /grant=everyone=r /g

    rant=restricted=r /setowner=rendszergazd├ík  1>>C:\Users\HM2ECF~1\AppData\Local\

    Temp\subinacl_output.txt

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=rendszergazd

    C:\Program Files\Windows Resource Kits\Tools>subinacl /keyreg HKEY_LOCAL_MACHINE

    /grant=rendszergazdák=f /grant=system=f /grant=users=r /grant=everyone=r /gran

    t=restricted=r /setowner=rendszergazd├ík  1>>C:\Users\HM2ECF~1\AppData\Local\Tem

    p\subinacl_output.txt

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=rendszergazd

    C:\Program Files\Windows Resource Kits\Tools>subinacl /subkeyreg HKEY_CLASSES_RO

    OT /grant=rendszergazdák=f /grant=system=f /grant=users=r /setowner=rendszergaz

    d├ík  1>>C:\Users\HM2ECF~1\AppData\Local\Temp\subinacl_output.txt

    Elapsed Time: 00 00:00:00

    Done:        0, Modified        0, Failed        0, Syntax errors        1

    Last Syntax Error:WARNING : /grant=rendszergazd

    ...

    I have win7 64bit(hungarian), I run this cmd with administrator(rendszergazdák) privilege.

  • Hi Marcell - It looks like the SubInAcl tool doesn't like the name for the Administrators group that you're passing in via the command line.  Does it work if you use the English word Administrators instead of the translated word?  If not, then I'm not sure what else to suggest because I don't see any information about how to correct this type of error in the readme that is installed with the SubInAcl tool.  You might need to use some other way of resetting the permissions on your computer instead of SubInAcl in that case.

  • Hello, Aaron!

    Thank you, for the fast reply!

    I tried it with "administrators" also, I get the same error:

    onedrive.live.com/redir

    I want to install Visual C++ without reinstalling my windows. What else can you suggest if SubInAcl doesn't work for me?

    I have already tried these solutions:

    -Read every post on the VC++ forum connetion with setup installation failure with 0x80070005 code

    -I tried to give full permission throught explorer, on C:\ProgramData\Package Cache (But I can't remove write block somehow, even if I have all the permissions)

    -I deleted my anti virus programs.

    -Downloaded different type of VC++ and verified the ISO file.

    -Tried to change the Character Coding in CMD, with CHCP (437|850|1250|1252|1253)(neither made me the "á" letter)

    -Ran the installer as administrators, and cmd also.

    -Tried this but It couldn't help also: support.microsoft.com/.../program_install_and_uninstall

    -I removed .Net 4.5.1 (I saw it somewhere it can help, idk...)

    I also tried to change things on the other ways, but I think I couldn't get aware of their proper using:

    -regini.exe (didn't get what to change exactly)

    -Tried to change manually throught regedit.exe, but I didn't know what to change exactly. :S

    When I try to install VC++, I get the following error during install:

    onedrive.live.com/redir

    I have some little observations, I can't install, neither uninstall these programs VC++ 2012/2013. It appears in my control panel-> progams, but somehow I get the same error at uninstalling.

    I hope you can determine something from these, if you need any more information, just ask, I try to do my best.

  • Hello!

    I gone too far at manually editing my regitry, and I lost lot of thing from my windows now, I don't have sound, can't uninstall or reinstall microsoft offices, and they don't start, and so on... neither Visual C++ works.

    Now I reinstall my windows, I can't bare this ***... :(

    It took more then 10 hours already. I hate microsoft now very much.

    Anyhow, thank you for your help Aaron Stebner. I hope, I don't have to do this again on the new windows.

    Marcell

  • Hi Marcell - I'm very sorry to hear that you ran into these issues and needed to re-install Windows to resolve them.

    If you run into any Visual Studio installation issues in the future, please use the tool described at blogs.msdn.com/.../6458047.aspx to collect all of your setup log files, upload the file named %temp%\vslogs.cab that this tool will create to a file server (such as http://onedrive.live.com), and then reply back here and provide a link that I can use to download your log files and take a closer look.

    Also, here are some links to more information about how to manually update file and registry permissions in case you need them in the future:

    support.microsoft.com/.../310426

    support.microsoft.com/.../308419

    I always recommend making a backup of your registry prior to making any changes in case you run into any problems.  You can find instructions for doing this at windows.microsoft.com/.../back-up-registry.

  • après aoir fait ce que vous avez dit dans vos explications voici ce qu'il me répond :

    microsoft windows xp (version 5.1.2600)

    <c>copyright 1985-2001 microsoft corp

    'subinacl' n'est pas reconnu en tant que commande interne ou externe, un programme exécutable ou un fichier de commandes.

    que faire ? car je n'arrive pas à installer avast free.

    à bientôt et merci d'avance de votre aide.

    mail : jean.arsene@neuf.fr

  • Hi LTF123 - That error most likely means that SubInAcl isn't installed at the expected location or you didn't change directories to the directory that SubInAcl is installed to.  I'd suggest double-checking both of those issues.

  • Aaron:

    Since i had problems to reinstall my NVIDIA video card, i applied the subinacl solution that you suggested. It resolved the problem, but now i have a black screen to run IE9 and when i run an MS Office application, it says: "this action is only valid for products that are currently

    installed". Please help me.

    The subincl script that i executed was:

    subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrador=f /grant=system=f /grant=myuser=f /setowner=administrador > %temp%\subinacl_output.txt

    subinacl /keyreg HKEY_CURRENT_USER /grant=administrador=f /grant=system=f  /grant=myuser=f /setowner=administrador >> %temp%\subinacl_output.txt

    subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrador=f /grant=system=f /setowner=administrador >> %temp%\subinacl_output.txt

    subinacl /keyreg HKEY_LOCAL_MACHINE /grant=administrador=f /grant=system=f /grant=usuarios=r  /setowner=administrador >> %temp%\subinacl_output.txt

    subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrador=f /grant=system=f /grant=usuarios=r /setowner=administrador >> %temp%\subinacl_output.txt

    subinacl /keyreg HKEY_CLASSES_ROOT /grant=administrador=f /grant=system=f /grant=usuarios=r /setowner=administrador >> %temp%\subinacl_output.txt

    subinacl /subdirectories %ProgramFilesPath%\ /grant=administrador=f /grant=system=f /grant=usuarios=e >> %temp%\subinacl_output.txt

    subinacl /subdirectories %windir%\ /grant=administrador=f /grant=system=f /grant=usuarios=e  >> %temp%\subinacl_output.txt

  • Hi Oscar - I'm sorry for the hassles you're running into here.  For the IE issue, I'd suggest trying to upgrade to a newer version of IE to see if that helps.  For the Office issue, I'd suggest trying to repair Office to see if that helps, and if it doesn't help, then I'd suggest trying to uninstall + re-install it.

  • Hi, Aaron. IE runs OK with "Administrator" user. I have the probleme only wit myuser. So, the problem is about privileges.

    Can you inpect the script that i executed to help me, please?

    Thanks.

  • Hi Oscar - I'm sorry, but I don't know what specific settings IE uses, and there isn't any specific logic to change permissions for IE settings in the subinacl script in this blog post.  If you know what specific settings are causing problems with IE, you can try to manually update the permissions using regedit.exe (for registry keys) or Windows Explorer (for files/folders).

  • I tried this one on xp sp3 it didnt work ,i dont no where to save reset.cmd and that username i didnt understand

    please help i want to load sql 2005 .netframe 2.0 not installing

  • Hi NARAYAN - In general, I don't recommend using tools like SubInAcl unless you're confident that you know what the tool is doing and have backed things up so that you can revert the changes if needed.

    Instead of trying to use this tool, can you please use the tool described at blogs.msdn.com/.../6458047.aspx to collect all of your setup log files, upload the file named %temp%\vslogs.cab that this tool will create to a file server (such as http://onedrive.live.com), and then reply back here and provide a link that I can use to download your log files and take a closer look and see if I can figure out why the .NET Framework is failing to install on your computer?

Page 19 of 21 (310 items) «1718192021
Leave a Comment
  • Please add 1 and 4 and type the answer here:
  • Post