Thoughts about setup and deployment issues, WiX, XNA, the .NET Framework and Visual Studio
All postings are provided AS IS
with no warranties, and confer no rights. Additionally, views expressed
herein are my own and not those of my employer, Microsoft.
Important note - if you were referred to this blog post from this knowledge base article and are having trouble running SubInAcl or reset.cmd, please try the steps listed in my other blog post first - http://blogs.msdn.com/b/astebner/archive/2006/09/04/solving-setup-errors-by-using-the-subinacl-tool-to-repair-file-and-registry-permissions.aspx.
A while back, I posted some instructions for using a tool from the Windows Resource Kit named SubInAcl that can be used to update file, folder and registry permissions. This tool can help fix some types of access denied errors that can be encountered while trying to install products, hotfixes and service packs on Windows.
Since that original post, I have heard from some people who have run into various types of problems while attempting to install and use the SubInAcl tool. I wanted to post more details about a few of these scenarios in case other folks run into similar issues in the future.
Issue 1 - Running SubInAcl reports an error on some non-English operating systems
On some non-English operating systems, customers have reported seeing errors like the following when trying to use the command lines listed in my previous blog post:
LookupAccountName : HKEY_CURRENT_USER:administrators 1337 The security ID structure is invalid.
LookupAccountName : HKEY_CURRENT_USER:administrators 1337 The security ID structure is invalid.
The reason for this error is that on some non-English operating systems, the name of the Administrators group is translated into the OS language. If you are running SubInAcl on a non-English OS where the name of the Administrators group is translated, you will need to update each of the command lines for SubInAcl to specify the translated name of the Administrators group.
Issue 2 - SubInAcl.msi fails to install
I have heard from a few people who were not able to get the SubInAcl.msi installer to work correctly on their systems, which prevented them from being able to use the tool. If you run into an error while installing SubInAcl.msi to install this tool, you can get a copy of the tool that does not require a full installation from an alternate location by using the following steps:
Note - you should first attempt to install and run SubInAcl.msi before downloading and extracting this zip file. This zip file is only intended for cases where for some reason, SubInAcl.msi will not install correctly - which unfortunately can sometimes happen because of one of the same issues that SubInAcl is designed to fix.
Issue 3 - How to get SubInAcl to create a log file
SubInAcl is a console application, which means that the output that it prints will be displayed in the console window by default. For the command lines listed in my previous blog post, SubInAcl prints a lot of information, and if any errors occur, it will quickly scroll off the screen and you won't be able to see the details of the errors.
For a console application like SubInAcl, running it from a cmd prompt and putting a greater than sign and then the name of a file at the end of the command line (such as > %temp%\subinacl_output.txt) will cause the output to be redirected to a file. I recently updated the command lines in that post and in the example script I posted on my file server to use this syntax to redirect the output to a file instead of printing it to the console.
Note - creating a log file as described above will not work if you run SubInAcl from the Windows start menu. It has to be run from a cmd prompt in order to allow the log file to be created.
<update date="3/30/2009"> Fixed broken download links that are contained in this post. </update>
<update date="10/7/2014"> Added a note to the top of this post with alternate instructions for people who were referred to this blog post from this knowledge base article. </update>
<update date="4/14/2015"> Clarified the steps in Issue 2 </update>
Hi Luke - Are you running from an elevated cmd prompt too? To do that, you need to go to c:\windows\system32, find cmd.exe, right-click on it and choose Run as Administrator.
I followed the instructions carefully and installed on my Windows 7 machine. When I ran the reset.cmd, I got the following message in the DOS window:
'subinacl' is not recognized as an internal or external command, operable program or batch file.
Press any key to continue . . .
What did I do wrong?
Also, I installed subinacl.msi in the Windows\system32 folder. I do not have a c:\Program Files (x86)\Windows Resource Kits\... folder. When I ran reset.cmd from any location, either the Desktop or system32 folder, I go the "subinacl' is not recognized as an internal or external command, operable program or batch file." error message.
Hi C. D. Harris - If you install subinacl to a non-default location, you will need to update reset.cmd to use the non-default location when it tries to run it. Alternatively, you can uninstall subinacl and re-install it to the default location and reset.cmd should work as-is.
Seem to have the same problems as C D Harris on 23 July. Been working on this computer for a customer for 3 days now. What's the answer here? I'm getting the error that the program is not recognized as internal or external command. Re-read the instructions again. removed program, re-installed program - same error. SO,,, I read Aaron Stebner above "If you install to a non-default location WHAT Aaron?? Has this truly worked for you and others?
Hi John Corey - I'm sorry for the hassles you're encountering while trying to use subinacl.exe and reset.cmd. The reset.cmd script that is linked in this blog post works correctly when I run it on my computers. It expects to find subinacl.exe at c:\Program Files (x86)\Windows Resource Kits\Tools\subinacl.exe (if your OS is 64-bit) or c:\Program Files\Windows Resource Kits\Tools\subinacl.exe (if your OS is 32-bit). If you don't have subinacl.exe at that location on your computer, then you can do one of the following:
1. Copy subinacl.exe to that location
2. Modify your copy of reset.cmd to use a different location for subinacl.exe
3. Write your own script to run subinacl.exe instead of using reset.cmd
Hi Aaron. I've been trying to figure this out for quite a while. Although, I can't seem to get it right. Still getting "subinacl' is not recognized as an internal or external command, operable program or batch file." error message. Does it matter if I am running SP1 on my Win7 OS?
Hi Abrham - No, it doesn't matter what version of Windows you are running on. That error means that reset.cmd cannot find subinacl.exe at the location it expects to find it at. It expects to find subinacl.exe at c:\Program Files (x86)\Windows Resource Kits\Tools\subinacl.exe (if your OS is 64-bit) or c:\Program Files\Windows Resource Kits\Tools\subinacl.exe (if your OS is 32-bit). If you don't have subinacl.exe at that location on your computer, then you can do one of the following:
Hi Aaron, I too have the problem that C.D. Harris shows. I moved reset.cmd to the tools folder and double click, and it runs. If try to run from anywhere else it doesn't. If I try to run as administrator from the tools folder (or anywhere else) it will not run and comes up with the same error. A heads up, the microsoft document that links to this page instructs to install subinacl in the windows\system32 folder, does not say where to put reset.cmd.
Hi Lee - If you download subinacl.msi from www.microsoft.com/.../details.aspx and install that, it will give you a default install location of c:\Program Files (x86)\Windows Resource Kits\Tools\subinacl.exe (if your OS is 64-bit) or c:\Program Files\Windows Resource Kits\Tools\subinacl.exe (if your OS is 32-bit). I don't know of any reason why you would need to install it to c:\windows\system32. What exact page do you see instructions that say to install subinacl to c:\windows\system32?
Reset.cmd is a script that runs subinacl.exe with several different command lines. I wrote it as a convenience to try to make it easier to run subinacl.exe, but you don't have to use it if it is causing problems for you. Instead, you can look at subinacl.htm (which is the help documentation that gets installed when you install subinacl.msi) and run your own subinacl.exe command lines.
Reset.cmd does not need to be put in any specific folder in order for you to run it. However, it does assume that subinacl.exe is installed to the default location of c:\Program Files (x86)\Windows Resource Kits\Tools\subinacl.exe (if your OS is 64-bit) or c:\Program Files\Windows Resource Kits\Tools\subinacl.exe (if your OS is 32-bit). If subinacl.exe is not installed in that location on your PC, you will need to update reset.cmd accordingly or it will not work.
This is the page: support.microsoft.com/.../968003. I installed to c:\Program Files (x86)\Windows Resource Kits\Tools after first installing to c:windows\system32. I understand that the reset is calling for subinacl from the tools folder, just that I can't get to run as administrator. I am having update issues, and the listed page is one that comes up when researching this error code:0x80070005.
Hi Lee - Thanks for sending the link. I'm not sure why that knowledge base article says to install subinacl to the system32 directory. In general, it isn't recommended to install applications there, and it runs correctly from the default location in Program Files.
What I usually do is open an elevated cmd prompt by going to c:\windows\system32, right-clicking on cmd.exe and choosing Run as Administrator. Then I run reset.cmd and subinacl.exe from the elevated cmd prompt.
I was having the same problems as C D Harris in getting reset.cmd to run, wherever I placed it. As a last resort, I right-clicked on it and, instead of selecting Run as Administrator, I selected Open. I assumed this would open in Notepad so I could include a line setting the current directory to the folder containing subinacl.exe. Instead, it ran reset.cmd successfully.
Incidentally, it fixed my problems with Windows Update.
Hi Neil Lomas - I'm surprised to hear that just choosing Open allowed subinacl.exe to run correctly on your computer. That tool requires elevated privileges in order to run correctly. I usually recommend opening an elevated cmd prompt and running reset.cmd or subinacl.exe from there. You can find steps for how to do that at blogs.msdn.com/.../solving-setup-errors-by-using-the-subinacl-tool-to-repair-file-and-registry-permissions.aspx.
I to had the same problem as many others regarding errors when running the reset.cmd file. Rather than right click and 'run as administrator' try double clicking the reset.cmd file