Aaron Stebner's WebLog

Thoughts about setup and deployment issues, WiX, XNA, the .NET Framework and Visual Studio

Notes about a couple of possible issues while using the SubInAcl tool

Notes about a couple of possible issues while using the SubInAcl tool

Rate This
  • Comments 59

********************************

Important note - if you were referred to this blog post from this knowledge base article and are having trouble running SubInAcl or reset.cmd, please try the steps listed in my other blog post first - http://blogs.msdn.com/b/astebner/archive/2006/09/04/solving-setup-errors-by-using-the-subinacl-tool-to-repair-file-and-registry-permissions.aspx.

********************************

A while back, I posted some instructions for using a tool from the Windows Resource Kit named SubInAcl that can be used to update file, folder and registry permissions.  This tool can help fix some types of access denied errors that can be encountered while trying to install products, hotfixes and service packs on Windows.

Since that original post, I have heard from some people who have run into various types of problems while attempting to install and use the SubInAcl tool.  I wanted to post more details about a few of these scenarios in case other folks run into similar issues in the future.

Issue 1 - Running SubInAcl reports an error on some non-English operating systems

On some non-English operating systems, customers have reported seeing errors like the following when trying to use the command lines listed in my previous blog post:

LookupAccountName : HKEY_CURRENT_USER:administrators 1337 The security ID structure is invalid.

The reason for this error is that on some non-English operating systems, the name of the Administrators group is translated into the OS language.  If you are running SubInAcl on a non-English OS where the name of the Administrators group is translated, you will need to update each of the command lines for SubInAcl to specify the translated name of the Administrators group.

Issue 2 - SubInAcl.msi fails to install

I have heard from a few people who were not able to get the SubInAcl.msi installer to work correctly on their systems, which prevented them from being able to use the tool.  If you run into an error while installing SubInAcl.msi to install this tool, you can get a copy of the tool that does not require a full installation from an alternate location by using the following steps:

  1. Download SubInAcl.zip and save it to your local computer
  2. Extract the contents of the zip file to a local folder on your system
  3. Use the steps in the previous blog post to run SubInAcl from the extracted location

Note - you should first attempt to install and run SubInAcl.msi before downloading and extracting this zip file.  This zip file is only intended for cases where for some reason, SubInAcl.msi will not install correctly - which unfortunately can sometimes happen because of one of the same issues that SubInAcl is designed to fix.

Issue 3 - How to get SubInAcl to create a log file

SubInAcl is a console application, which means that the output that it prints will be displayed in the console window by default.  For the command lines listed in my previous blog post, SubInAcl prints a lot of information, and if any errors occur, it will quickly scroll off the screen and you won't be able to see the details of the errors.

For a console application like SubInAcl, running it from a cmd prompt and putting a greater than sign and then the name of a file at the end of the command line (such as > %temp%\subinacl_output.txt) will cause the output to be redirected to a file.  I recently updated the command lines in that post and in the example script I posted on my file server to use this syntax to redirect the output to a file instead of printing it to the console.

Note - creating a log file as described above will not work if you run SubInAcl from the Windows start menu.  It has to be run from a cmd prompt in order to allow the log file to be created.

<update date="3/30/2009"> Fixed broken download links that are contained in this post. </update>

<update date="10/7/2014"> Added a note to the top of this post with alternate instructions for people who were referred to this blog post from this knowledge base article. </update>

 

  • Hi Bradyn - That error most likely means that SubInAcl.exe isn't installed at the expected location or you didn't change directories in the command prompt to the directory that SubInAcl is installed to before running reset.cmd.  I'd suggest double-checking both of those issues.

  • Hi Aaron - I am having the same problem as Bradyn in that when I ran the SubinAcl tool I got the same error message repeated four times

    "'subinacl' is not recognized as an internal or external command, operable program or hatch file."

    What is the location the file should have been installed? Could you also clarify what you meant by changing directories in the command prompt before running rest.cmd

  • Hi Alan and Bradyn - The comment I made about changing directories was based on an older version of reset.cmd.  I updated that script a while back to fix that issue, so you shouldn't need to worry about that anymore.  I just uploaded a new version of reset.cmd.txt with some additional error logging that should help narrow down why you're seeing this error.  Can you please give it a try and see what it reports?

    SubInAcl should be installed to c:\Program Files (x86)\Windows Resource Kits\Tools\subinacl.exe (if your OS is 64-bit) or c:\Program Files\Windows Resource Kits\Tools\subinacl.exe (if your OS is 32-bit).

  • Hi Aaron,

    Could you tell me where i can find how is translated user group? My system is in polish. I could find easly that in my system "administratos" translate to "administratorzy" and that works, but I couldn't translate others. Apparently, by looking at spanish version in second post, I have also "users", "everyone", and "restricted". I've tried what I thought should be translated version, but it didn't actually work. I'm sure there is some very easy way to find out.

  • Hi Garpagan - I don't know a definitive way to find those values on all versions of Windows.  I think some of the strings are left in English in some non-English versions of Windows, so you might want to try that first.  If that doesn't work, then I think you can find the values by going to regedit.exe, right-clicking on a registry value, choosing Permissions and looking at the options that appear there.

  • SubinAcl reports many failures.

  • Hi Paul - What kind of failures are you seeing?

  • In Windows XP SP3 Shadow, that is a mix of english and spanish version, it worked using the english version but changing restricted to restringido and everyone to todos.

  • Still not working! :(

  • In answer to earlier question about 'subinacl' is not recognized as an internal or external command, operable program or hatch file. You say "SubInAcl should be installed to c:\Program Files (x86)\Windows Resource Kits\Tools\subinacl.exe (if your OS is 64-bit) or c:\Program Files\Windows Resource Kits\Tools\subinacl.exe (if your OS is 32-bit)." However there is no directory of that name on my Windows 7. How do I get it?

  • Hi Colin - You need to download and install SubInAcl from www.microsoft.com/.../details.aspx in order to get that file.

  • Hi Trad - I can try to help, but you need to provide more detailed information.  What isn't working for you, and what exact error messages are you seeing on your computer currently?

  • FWIW - I got the "'subinacl' is not recognized as an internal or external command,

    operable program or hatch file." error as well.  When I moved my Reset.cmd file into the directory where subinacl was installed & ran it from there, it ran.

  • Hi Tammy - I'm not sure why you needed to copy reset.cmd to the same directory as subinacl.exe.  Reset.cmd runs correctly for me on my systems regardless of where it is located, assuming that you installed subinacl.exe to the default path when you ran subinacl.msi.  The default location is c:\Program Files (x86)\Windows Resource Kits\Tools\subinacl.exe (if your OS is 64-bit) or c:\Program Files\Windows Resource Kits\Tools\subinacl.exe (if your OS is 32-bit).

  • I'm trying to run this to fix windows update access denied on a pc.  I'm running it under and administrator account (even created a new one to try).  I'm getting that lots of failed entries when it has the red at the time and also "5 Access is denied" when it lists keys in white text.  

    I'm on win7 home 64 bit. Any ideas?

Page 2 of 4 (59 items) 1234
Leave a Comment
  • Please add 2 and 2 and type the answer here:
  • Post