Aaron Stebner's WebLog

Thoughts about setup and deployment issues, WiX, XNA, the .NET Framework and Visual Studio

Notes about a couple of possible issues while using the SubInAcl tool

Notes about a couple of possible issues while using the SubInAcl tool

Rate This
  • Comments 93


Important note - if you were referred to this blog post from this knowledge base article and are having trouble running SubInAcl or reset.cmd, please try the steps listed in my other blog post first - http://blogs.msdn.com/b/astebner/archive/2006/09/04/solving-setup-errors-by-using-the-subinacl-tool-to-repair-file-and-registry-permissions.aspx.


A while back, I posted some instructions for using a tool from the Windows Resource Kit named SubInAcl that can be used to update file, folder and registry permissions.  This tool can help fix some types of access denied errors that can be encountered while trying to install products, hotfixes and service packs on Windows.

Since that original post, I have heard from some people who have run into various types of problems while attempting to install and use the SubInAcl tool.  I wanted to post more details about a few of these scenarios in case other folks run into similar issues in the future.

Issue 1 - Running SubInAcl reports an error on some non-English operating systems

On some non-English operating systems, customers have reported seeing errors like the following when trying to use the command lines listed in my previous blog post:

LookupAccountName : HKEY_CURRENT_USER:administrators 1337 The security ID structure is invalid.

The reason for this error is that on some non-English operating systems, the name of the Administrators group is translated into the OS language.  If you are running SubInAcl on a non-English OS where the name of the Administrators group is translated, you will need to update each of the command lines for SubInAcl to specify the translated name of the Administrators group.

Issue 2 - SubInAcl.msi fails to install

I have heard from a few people who were not able to get the SubInAcl.msi installer to work correctly on their systems, which prevented them from being able to use the tool.  If you run into an error while installing SubInAcl.msi to install this tool, you can get a copy of the tool that does not require a full installation from an alternate location by using the following steps:

  1. Download SubInAcl.zip and save it to your local computer
  2. Extract the contents of the zip file to a local folder on your system
  3. Use the steps in the previous blog post to run SubInAcl from the extracted location with the following modifications:
    1. Skip step 1 - there is no need to download and install subinacl.msi because subinacl.zip contains the same files that would normally be installed by subinacl.msi
    2. Depending on where you extract the zip file to in step 2 above, you may need to edit reset.cmd and change the folder path that it is trying to run subinacl.exe from

Note - you should first attempt to install and run SubInAcl.msi before downloading and extracting this zip file.  This zip file is only intended for cases where for some reason, SubInAcl.msi will not install correctly - which unfortunately can sometimes happen because of one of the same issues that SubInAcl is designed to fix.

Issue 3 - How to get SubInAcl to create a log file

SubInAcl is a console application, which means that the output that it prints will be displayed in the console window by default.  For the command lines listed in my previous blog post, SubInAcl prints a lot of information, and if any errors occur, it will quickly scroll off the screen and you won't be able to see the details of the errors.

For a console application like SubInAcl, running it from a cmd prompt and putting a greater than sign and then the name of a file at the end of the command line (such as > %temp%\subinacl_output.txt) will cause the output to be redirected to a file.  I recently updated the command lines in that post and in the example script I posted on my file server to use this syntax to redirect the output to a file instead of printing it to the console.

Note - creating a log file as described above will not work if you run SubInAcl from the Windows start menu.  It has to be run from a cmd prompt in order to allow the log file to be created.

<update date="3/30/2009"> Fixed broken download links that are contained in this post. </update>

<update date="10/7/2014"> Added a note to the top of this post with alternate instructions for people who were referred to this blog post from this knowledge base article. </update>

<update date="4/14/2015"> Clarified the steps in Issue 2 </update>



  • PingBack from http://blogs.msdn.com/astebner/archive/2006/09/04/solving-setup-errors-by-using-the-subinacl-tool-to-repair-file-and-registry-permissions.aspx

  • Here is the script which worked on Vista Buisness SP1 Spanish Version:

    cd /d "%programfiles%\Windows Resource Kits\Tools"

    subinacl /subkeyreg HKEY_CURRENT_USER /grant=administradores=f /grant=system=f /grant=restringido=r /grant=YOURUSERNAME=f /setowner=administradores > %temp%\subinacl_output.txt

    subinacl /keyreg HKEY_CURRENT_USER /grant=administradores=f /grant=system=f /grant=restringido=r /grant=YOURUSERNAME=f /setowner=administradores >> %temp%\subinacl_output.txt

    subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administradores=f /grant=system=f /grant=usuarios=r /grant=todos=r /grant=restringido=r /setowner=administradores >> %temp%\subinacl_output.txt

    subinacl /keyreg HKEY_LOCAL_MACHINE /grant=administradores=f /grant=system=f /grant=usuarios=r /grant=todos=r /grant=restringido=r /setowner=administradores >> %temp%\subinacl_output.txt

    subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administradores=f /grant=system=f /grant=usuarios=r /setowner=administradores >> %temp%\subinacl_output.txt

    subinacl /keyreg HKEY_CLASSES_ROOT /grant=administradores=f /grant=system=f /grant=usuarios=r /setowner=administradores >> %temp%\subinacl_output.txt

    subinacl /subdirectories %programfiles%\ /grant=administradores=f /grant=system=f /grant=usuarios=e >> %temp%\subinacl_output.txt

    subinacl /subdirectories %windir%\ /grant=administradores=f /grant=system=f /grant=usuarios=e >> %temp%\subinacl_output.txt

  • I'm not sure which versions of Windows allow CMD files to be run. I'm only familiar with batch files. So many may need to name the batch/command file RESET.BAT, instead.

    If running the tool on a system that uses a ramdisk for the TEMP/TMP directories, you may need to redirect the log file to another drive. Change the RESET.BAT/CMD file to replace %temp% with C: or something like that. Otherwise the ram disk will store the log file, which could cause problems if the ram drive quickly fills up (and would mean no log file if your system crashes).

    The author will be pleased to know how annoyed rivals of his Sooners are, that they're (we're) relying on a Sooner to fix our PCs. Noticed the crimson/white in the utility, too. Blech. ಠ_ಠ

  • Thank you very much, Aaron Stebner and dmendt(spanish version)

  • i am getting error pipe line being closed in visual studio ultimated 2012 and others can anyone help

  • Hi John - What is the exact text of the error message that you see?  Also, do you see it when you install VS 2012, or when you are trying to use VS 2012 after setup completes?

    It might help to post a question about your scenario on the VS forum at social.msdn.microsoft.com/.../home.

  • Greeting with peace..

    Sir Aaron, do all these steps work with windows 7?

    I'm using windows 7, tried these steps couple of time, the aps i wish to set it up still couldnt be installed.

    the error message comes out each time when the installer bar nearly get to the finishing line.

    thanks for the great entry.

  • Hi ABEEE - Yes, these steps should work on Windows 7.  This tool doesn't solve all possible setup problems though.  What is the exact error you see when trying to install the applications on your computer, and do you have any log files from the failing installs that I could take a look at to try to figure out the root cause of the failures?

  • I am having error 1603 installing turbotax. tried full control, msconfig selective startup, fixed .net framework still the error is there. please help i need to install it

  • Hi Turbotax - Error code 1603 is a generic error that means that setup failed, but it doesn't give any more detailed information about why it failed.  I'd suggest contacting TurboTax technical support to see if they can help you examine the setup log files created by TurboTax setup and narrow down the cause of the failure further.

  • Hi,

    Does Subincl work in windows 2008 platform ?

    I have tried and got a bug. I am unable to fix that.

  • Hi Das - I don't know of any reason why SubInAcl wouldn't work on Windows Server 2008. What exact error are you seeing when you try it?

  • Hello Aaron,

    I tried on windows 2008 enterprise edition. Below is one of the few bugs I'm posting:

    The system cannot find message text for message number 0x2350 in the message fil

    e for Application.

    The system cannot find message text for message number 0x2334 in the message fil

    e for Application.

    C:\Users\user2>systeminfo |more

    : Server1234

    : Microsoftr Windows Serverr 2008 Enterprise


    : Microsoft Corporation


    : Multiprocessor Free

    : Windows User


    : 92516-082-2500885-76665

    : 1/7/2011, 6:14:05 AM

    : 5/25/2014, 6:50:58 PM

    : VMware, Inc.

    : VMware Virtual Platform

    : x64-based PC

    I tried this in command. Also another bug is like the no options come in My Computer>Properties

    It is blank except it shows the computer name.

  • Hi Das - The errors about missing message text could mean that the file that contains those messages is missing from your computer, or it could mean that a couple of specific messages do not have valid error text.  In either case, those are not fatal errors and you can probably safely ignore them.

    I haven't seen a problem before like the one you describe with options missing from My Computer | Properties.  For that issue, I'd suggest posting a question on the Windows Server forums at social.technet.microsoft.com/.../home to see if someone there can help provide a workaround or a fix.

  • Hey man, I had to get the SubinAcl tool to help fix a problem with my computer. I got this error message and was wondering if you could help?

    'subinacl' is not recognized as an internal or external command,

    operable program or hatch file.

Page 1 of 7 (93 items) 12345»
Leave a Comment
  • Please add 6 and 4 and type the answer here:
  • Post