Thoughts about setup and deployment issues, WiX, XNA, the .NET Framework and Visual Studio
All postings are provided AS IS with no warranties, and confer no rights. Additionally, views expressed herein are my own and not those of my employer, Microsoft.
A while back, I posted some instructions for using a tool from the Windows Resource Kit named SubInAcl that can be used to update file, folder and registry permissions. This tool can help fix some types of access denied errors that can be encountered while trying to install products, hotfixes and service packs on Windows.
Since that original post, I have heard from some people who have run into various types of problems while attempting to install and use the SubInAcl tool. I wanted to post more details about a few of these scenarios in case other folks run into similar issues in the future.
Issue 1 - Running SubInAcl reports an error on some non-English operating systems
On some non-English operating systems, customers have reported seeing errors like the following when trying to use the command lines listed in my previous blog post:
LookupAccountName : HKEY_CURRENT_USER:administrators 1337 The security ID structure is invalid.
The reason for this error is that on some non-English operating systems, the name of the Administrators group is translated into the OS language. If you are running SubInAcl on a non-English OS where the name of the Administrators group is translated, you will need to update each of the command lines for SubInAcl to specify the translated name of the Administrators group.
Issue 2 - SubInAcl.msi fails to install
I have heard from a few people who were not able to get the SubInAcl.msi installer to work correctly on their systems, which prevented them from being able to use the tool. If you run into an error while installing SubInAcl.msi to install this tool, you can get a copy of the tool that does not require a full installation from an alternate location by using the following steps:
Note - you should first attempt to install and run SubInAcl.msi before downloading and extracting this zip file. This zip file is only intended for cases where for some reason, SubInAcl.msi will not install correctly - which unfortunately can sometimes happen because of one of the same issues that SubInAcl is designed to fix.
Issue 3 - How to get SubInAcl to create a log file
SubInAcl is a console application, which means that the output that it prints will be displayed in the console window by default. For the command lines listed in my previous blog post, SubInAcl prints a lot of information, and if any errors occur, it will quickly scroll off the screen and you won't be able to see the details of the errors.
For a console application like SubInAcl, running it from a cmd prompt and putting a greater than sign and then the name of a file at the end of the command line (such as > %temp%\subinacl_output.txt) will cause the output to be redirected to a file. I recently updated the command lines in that post and in the example script I posted on my file server to use this syntax to redirect the output to a file instead of printing it to the console.
Note - creating a log file as described above will not work if you run SubInAcl from the Windows start menu. It has to be run from a cmd prompt in order to allow the log file to be created.
<update date="3/30/2009"> Fixed broken download links that are contained in this post. </update>
PingBack from http://blogs.msdn.com/astebner/archive/2006/09/04/solving-setup-errors-by-using-the-subinacl-tool-to-repair-file-and-registry-permissions.aspx
Here is the script which worked on Vista Buisness SP1 Spanish Version:
cd /d "%programfiles%\Windows Resource Kits\Tools"
subinacl /subkeyreg HKEY_CURRENT_USER /grant=administradores=f /grant=system=f /grant=restringido=r /grant=YOURUSERNAME=f /setowner=administradores > %temp%\subinacl_output.txt
subinacl /keyreg HKEY_CURRENT_USER /grant=administradores=f /grant=system=f /grant=restringido=r /grant=YOURUSERNAME=f /setowner=administradores >> %temp%\subinacl_output.txt
subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administradores=f /grant=system=f /grant=usuarios=r /grant=todos=r /grant=restringido=r /setowner=administradores >> %temp%\subinacl_output.txt
subinacl /keyreg HKEY_LOCAL_MACHINE /grant=administradores=f /grant=system=f /grant=usuarios=r /grant=todos=r /grant=restringido=r /setowner=administradores >> %temp%\subinacl_output.txt
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administradores=f /grant=system=f /grant=usuarios=r /setowner=administradores >> %temp%\subinacl_output.txt
subinacl /keyreg HKEY_CLASSES_ROOT /grant=administradores=f /grant=system=f /grant=usuarios=r /setowner=administradores >> %temp%\subinacl_output.txt
subinacl /subdirectories %programfiles%\ /grant=administradores=f /grant=system=f /grant=usuarios=e >> %temp%\subinacl_output.txt
subinacl /subdirectories %windir%\ /grant=administradores=f /grant=system=f /grant=usuarios=e >> %temp%\subinacl_output.txt
I'm not sure which versions of Windows allow CMD files to be run. I'm only familiar with batch files. So many may need to name the batch/command file RESET.BAT, instead.
If running the tool on a system that uses a ramdisk for the TEMP/TMP directories, you may need to redirect the log file to another drive. Change the RESET.BAT/CMD file to replace %temp% with C: or something like that. Otherwise the ram disk will store the log file, which could cause problems if the ram drive quickly fills up (and would mean no log file if your system crashes).
The author will be pleased to know how annoyed rivals of his Sooners are, that they're (we're) relying on a Sooner to fix our PCs. Noticed the crimson/white in the utility, too. Blech. ಠ_ಠ
Thank you very much, Aaron Stebner and dmendt(spanish version)