"Reset File Permissions C:\" in Windows Repair Adds Full Control Permissions

[Khanny]

I'm on Windows 7 Ultimate running two user account one standard user (the one I'm on)  and one administrator (only used for right clicking --> Run as Administrator)

To reproduce (on C:\Program Files (x86)):

• using Windows Explorer goto the security tab advance button
• change "Program Files (x86)" folder owner to Administrators
• Goto permissions and remove all entries
• set Admins to full control and Users to read and execute and checked Replace permissions on child folder...
• All folders, sub folders and files Properties (in Security tab) now have only Administrators and Users listed
• Run "Reset File Permissions C:\" in Windows Repair and rebooted and ran same repair again
• Check "Program Files (x86)" folder permissions and it's reset to default (set attachment)
• Check sub folders and files permissions and it's reset too BUT 4 additional entries set to Full Control (see attachment)

I don't believe this is normal behavior because usually when I create shortcuts for program installed in Program Files, it prompt me that to create it in the Desktop but now it creates the shortcut within the folder.

[Boggin]

This is what mine look like in Win 7 Home Premium as default.

[Khanny]

Hey Boggin,

Is it after you ran "Reset File Permission" in Windows Repair?  May you check your sub-folder of "Program Files (x86)" folder to see if there's added permissions (like my foobar2000 folder)? 

Do you know a quick method removing current permissions set and restoring the default permissions for all folders under the system drive (C:)?

[Boggin]

Mine are without running WR and are as is without any been added.

Do you have restore points to before you started changing the permissions ?

This may be what WR uses to reset permissions but read on through the article if you have any problems.

http://answers.microsoft.com/en-us/windows/forum/windows_7-security/how-to-reset-all-user-permissions-to-default/9da312d2-c99b-4283-a275-e74d93dcc366?auth=1

And this graphical utility has been produced that seems to use a different .exe http://lallouslab.net/2013/08/26/resetting-ntfs-files-permission-in-windows-graphical-utility/

I tend to leave my system running as is but create an external system image before running any program that can make major changes to it and then I have a fall back.

[Khanny]

Does that mean those for extra permission (I highlighted in purple) are normally created with WR's reset file permission option?

Also, thanks for the links to reset all my permissions also.  I have an external image but it's really old.

[Boggin]

Not having run WR I cannot answer that.

I'll see if Shane can have a look at this and he should be able to explain better.

[Shane]

What version of my program are you running? My much older version did that, but in the newest it doesnt and even puts back the defaults.

Shane

[Khanny]

I just tested today today with the current version (3.7.4) and the problem of adding 4 additional <not inherited> entries still persist.

Not sure if this is relevant but I also noted my user account arrangement is unique.  I use my PC under a standard account (for day to day use) but click run as administrator when I need to install or modify settings.
See this post: http://www.wilderssecurity.com/threads/security-hardening-windows-7-64-bit-install.324004/#post-2056033 under: "Section 2 Access Control"

[Shane]

That is worth testing, the program is mean to run under an admin account as a standard user wont have the permissions for the repairs to run.

So when the permissions repairs run it first goes and sets full permissions for administrator and system and such to all the files and folders, it has to do this so that it has the permissions to restore the defaults. After that is ran the defaults are restored. This would only restore the defaults that are in the file, any extra folders and such would still have the full permissions set for administrator and system.

1 sec let me go double check the code.

Looks like I do have users set to full access, I changed this a while ago but this one section didnt get the change. So when the defaults are put back those are removed but only on those files and folders, not any new ones not in the defaults.

The best thing to do is to just remove users from it all togeather, of course the only downfall would be any permissions that need to set for standard users, but I dont think that happens very often, would be a lot better to just remove users from it, then it will only be these

TrustedInstaller
Administrators
System
ALL APPLICATION PACKAGES

Shane