SBS2011 Windows directory permissions messed up by AV

I have a SBS2011 in production and about a week ago our Anti-Virus detected about 5000 infected files. It said it successfully cleaned those files and removed the threat but since then there's been some problems.
When I would log in with my normal Network Administrator Role user account and try to execute any program I would get an error stating the "Digital Signature was invalid". I Logged in as the Built-in Administrator and ran SFC /scannow and
that appears to have resolved that problem.
However, when I browse into the Windows Directory I notice there are several hundred files in C:\Windows, C:Windows\System32, and C:\Windows\SysWOW64 that have a padlock Icon. When I examine the permissions on those files The Security Tab of the files Properties
says:
"No permissions have been assigned for this object.
Warning: this is a potential security risk because anyone who can access this object can take ownership of it. The object’s owner should assign permissions as soon as possible."
How can I reset the permissions on all of the .exe files within the C:\Windows directory back to what they should be?

Kidwon,
the command line tool is ICACLS.
https://technet.microsoft.com/en-us/library/cc753525.aspx
You may need first build a list of the files in question from a working win srv 2008 r2.
Jan

Similar Messages

New computer + manual transfer of files = permissions mess!

Hello everyone,
Bear with me, my situation is lengthy to explain, possibly because I don't have the right words to describe it.
I've got a difficult situation I can't figure out. Let me start by saying, I don't know the Terminal very well, as I suspect that fixing my problem will definitely involve the Terminal. I know just enough to be dangerous (or to copy and paste!)
I had an old laptop running 10.6, and have a new laptop now running 10.8.4. Rather than use the Migration Assistant, I felt I wanted a clean start, a new user profile, etc, so I started from scratch. I should add that the new laptop has two internal drives, one that houses the OS, the other that is meant to store my (user generated) files. Also, for abbreviations' sake-- old computer, my username was called OldUser, and new computer my username is now NewUser.
I moved thousands of files on to my new computer's file storage volume (called "Data"), only to discover that any file I open, when I try to save, says this:
The document “example.rtf” could not be saved. The file is locked. Do you want to save your changes to it anyway? [Save Anyway] [Cancel]
There's also an accompanying tool tip that shows up next to the file's name (at the top of the open document) that says:
The document could not be autosaved. You don't have permission.
It doesn't matter what kind of document I open up, they all say this same thing.
All these troubled files reside here: /Volumes/Data/Old laptop files/Desktop. Files that are NOT in this directory, but are elsewher in the same volume "Data" behave just fine, (and no, just by adding a new file into the Old Laptop Files/Desktop directory doesn't "corrupt" it at this point.)
I have looked at the permissions of some of these troubled files, (File > Get Info) and discovered something I hadn't seen before. It looks like this:
everyone:    Custom
NewUser:     Read & Write
admin:       Read & Write
everyone:    Read & Write
The reason I say "I'd never seen it before" is because instead of the usual three categories, Owner/group/other, there's that fourth one at the top that says "custom."
The rest of the permissions, I set to "Read/Write" by recursively using the chmod command to set the file permissions to 777. (This is one command line trick I do know). But it didn't work!
At this point, I'm really stuck, because I lack the file permissions/command line vocabularly to even be able to google my question! Help?!
Thanks in advance for any tips/help!

Back up all data. Don't continue unless you're sure you can restore from a backup, even if you're unable to log in.
This procedure will unlock all your user files (not system files) and reset their ownership and access-control lists to the default. If you've set special values for those attributes on any of your files, they will be reverted. In that case, either stop here, or be prepared to recreate the settings if necessary. Do so only after verifying that those settings didn't cause the problem. If none of this is meaningful to you, you don't need to worry about it.
Step 1
If you have more than one user account, and the one in question is not an administrator account, then temporarily promote it to administrator status in the Users & Groups preference pane. To do that, unlock the preference pane using the credentials of an administrator, check the box marked Allow user to administer this computer, then reboot. You can demote the problem account back to standard status when this step has been completed.
Triple-click the following line on this page to select it. Copy the selected text to the Clipboard (command-C):
{ sudo chflags -R nouchg,nouappnd ~ $TMPDIR.. ; sudo chown -R $UID:staff ~ $_ ; sudo chmod -R u+rwX ~ $_ ; chmod -R -N ~ $_ ; } 2> /dev/null
Launch the Terminal application in any of the following ways:
☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.
Paste into the Terminal window (command-V). You'll be prompted for your login password. Nothing will be displayed when you type it. You may get a one-time warning to be careful. If you don’t have a login password, you’ll need to set one before you can run the command. If you see a message that your username "is not in the sudoers file," then you're not logged in as an administrator.
The command will take a noticeable amount of time to run. Wait for a new line ending in a dollar sign (“$”) to appear, then quit Terminal.
Step 2 (optional)
Take this step only if you have trouble with Step 1 or if it doesn't solve the problem.
Boot into Recovery. When the OS X Utilities screen appears, select
Utilities ▹ Terminal
from the menu bar. A Terminal window will open.
In the Terminal window, type this:
res
Press the tab key. The partial command you typed will automatically be completed to this:
resetpassword
Press return. A Reset Password window will open. You’re not going to reset a password.
Select your boot volume ("Macintosh HD," unless you gave it a different name) if not already selected.
Select your username from the menu labeled Select the user account if not already selected.
Under Reset Home Directory Permissions and ACLs, click the Reset button.
Select
 ▹ Restart
from the menu bar.

To build the organization's Active Directory permissions are what we need

To build the organization's Active Directory permissions are what we need

what is your actual question? Can you be more specific?
Santhosh Sivarajan | Houston, TX | www.sivarajan.com
ITIL,MCITP,MCTS,MCSE (W2K3/W2K/NT4),MCSA(W2K3/W2K/MSG),Network+,CCNA
Windows Server 2012 Book - Migrating from 2008 to Windows Server 2012
Blogs: Blogs
Twitter: Twitter
LinkedIn: LinkedIn
Facebook: Facebook
Microsoft Virtual Academy:
Microsoft Virtual Academy
This posting is provided AS IS with no warranties, and confers no rights.

Wrong home directory permissions for new users

Hi everyone.
I reinstalled my laptop the other day and ran into a rather strange problem: after a system update new users had their permissions totally screwed. It took me 3-4 reinstalls to notice, as i was also playing with lvm2 &co. Anyway, on fresh installations from either 2008.06 or 2009.02, everything works fine. As soon as i update to the latest package versions (including 2.6.29 kernel) and create a new user, permissions on the new home directory are screwed up to the point where the user can't access it.
Old directory permissions:
drwx------ 33 jasn users 4,0K 17. Apr 13:21 jasn
drwx------ 2 root root 16K 17. Apr 12:15 lost+found
New directory permissions:
drw-rw--w- 2 jasm users 4,0K 17. Apr 13:43 jasm
drwx------ 33 jasn users 4,0K 17. Apr 13:21 jasn
drwx------ 2 root root 16K 17. Apr 12:15 lost+found
Logging in to "jasm" results in
No directory, logging in with HOME=/
[jasm@host /]$
The whole mess can be fixed by changing the permissions on the home directory, but all that can't be on purpose, can it? I also don't know which package update (if it even was caused by one) causes this behaviour and if this only happens to me, so i didn't file a bug report.
Has anyone already seen this? I solved it after 1.5 days of puzzled (and strangely unsuccessful) googling and reinstalling, so perhaps someone who runs into the same problem can use this to fix it.
Last edited by JASN (2009-04-17 17:09:34)

umask is not really the correct thing to do in this case, as this resets the permissions for every file the user creates. Afaik, the umask setting has to be installed on every machine via the launchd-user.conf file (to contain simply: umask 002) (or whatever is appropriate for your facility), as umask is a property of the process, not the connection.
What might work better for your problem is make the homedirs world and group non-readable. That way the user creates files within their homedirs and anywhere below, but everyone else can't read them regardless of the files' permissions because the directory itself is unreadable.

Permissions messed up 10.8.3

I updated to 10.8.3 on my iMac (7,1). I tried to enter some metadata into an iTune file(TV show) and found that I was locked because I only had read access. I checked my Info on the internal drive and found this:
system- Read & Write
wheel- Read only
everyone- Read only
Normally I see an Admin entry with my short user name in parenthesis. I repaired permissions and ran the following Unix commands I found in other threads in Terminal to no avail:
sudo chflags 0 /Volumes/*
sudo chmod a+x /Volumes/*
sudo chmod -N /Volumes/*
Granted I don't know what the previous commands really mean but they seemed to help other people. I thought about manually adding my Admin in Users & Permissions but thought they may cause even more problems.

Repairing permissions in Disk Utility will have no effect.
Back up all data. Don't continue unless you're sure you can restore from a backup, even if you're unable to log in.
This procedure will unlock all your user files (not system files) and reset their ownership and access-control lists to the default. If you've set special values for those attributes on any of your files, they will be reverted. In that case, either stop here, or be prepared to recreate the settings if necessary. Do so only after verifying that those settings didn't cause the problem. If none of this is meaningful to you, you don't need to worry about it.
Step 1
If you have more than one user account, and the one in question is not an administrator account, then temporarily promote it to administrator status in the Users & Groups preference pane. To do that, unlock the preference pane using the credentials of an administrator, check the box marked Allow user to administer this computer, then reboot. You can demote the problem account back to standard status when this step has been completed.
Triple-click the following line to select it. Copy the selected text to the Clipboard (command-C):
{ sudo chflags -R nouchg,nouappnd ~ $TMPDIR.. ; sudo chown -Rh $UID:staff ~ $_ ; sudo chmod -R u+rwX ~ $_ ; chmod -R -N ~ $_ ; } 2> /dev/null
Launch the Terminal application in any of the following ways:
☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.
Paste into the Terminal window (command-V). You'll be prompted for your login password, which won't be displayed when you type it. You may get a one-time warning to be careful. If you don’t have a login password, you’ll need to set one before you can run the command. If you see a message that your username "is not in the sudoers file," then you're not logged in as an administrator.
The command will take a noticeable amount of time to run. Wait for a new line ending in a dollar sign (“$”) to appear, then quit Terminal.
Step 2 (optional)
Step 1 should give you usable permissions in your home folder. This step will restore special attributes set by OS X on some user folders to protect them from unintended deletion or renaming. You can skip this step if you don't consider that protection to be necessary, and if everything is working as expected after step 1.
Boot into Recovery by holding down the key combination command-R at startup. Release the keys when you see a gray screen with a spinning dial.
When the OS X Utilities screen appears, select
Utilities ▹ Terminal
from the menu bar. A Terminal window will open.
In the Terminal window, type this:
res
Press the tab key. The partial command you typed will automatically be completed to this:
resetpassword
Press return. A Reset Password window will open. You’re not going to reset a password.
Select your boot volume ("Macintosh HD," unless you gave it a different name) if not already selected.
Select your username from the menu labeled Select the user account if not already selected.
Under Reset Home Directory Permissions and ACLs, click the Reset button.
Select
 ▹ Restart
from the menu bar.

Cisco Jabber for windows directory issue

Hello ,
i have cucm 9x and cup 9.x ,
Cisco jabber is showing directory but its all user from MS out look User not LDAP user and also user and on Jabber client connection window Directory is showing not connected .
please advise .

J4W does NOT use the directory info that you configure in CUCM as a UC service, it relies on the domain info from the machine you're logging in as default, or the config from the .xml file.
If you cannot connect to the directory, make sure there's nothing blocking the communication, and that your configuration is correct.

PS CS6 has a different set of installed fonts than my old PS CS4. How do I get my old fonts back? Don't like most of the CS6 fonts. Dell Precision, Windows 7. Does PS use the fonts in the Windows directory or does it use its own? A lot of my preferre

PS CS6 has a different set of installed fonts than my old PS CS4. How do I get my old fonts back? Don't like most of the newer CS6 fonts. Dell Precision, Windows 7. Does PS use the fonts in the Windows directory or does it use its own? If so, where are they in the directory? A lot of my preferred fonts show in the Windows directory but not in Photoshop, which does not display them within the program. Please help. If I get free fonts (NOT CC fonts) from elsewhere, where do I put them for Photoshop[ CS6 to use them? Thanks.

All versions of Photoshop get their fonts from your OS. Just install any missing font wherever Windows keeps fonts.
I don't do windows myself.

Okay i had to install Itunes onto my new OS because window's Vista messed up on me and i can't get any of my old purchases back from my account such as music and movies any ideas on how to get them back (i do not have the folder that contains old items)

Okay i had to install Itunes onto my new OS because window's Vista messed up on me and i can't get any of my old purchases back from my account such as music and movies any ideas on how to get them back (i do not have the folder that contains old items from the last itunes or anything from that OS because it had a virus and i just wanted windows 7)

Downloading past purchases from the App Store, iBookstore, and iTunes Store
Hope this helps,
JD

NFS or FTP to Pick files from Windows Directory

Hi All,
I am working of File to File Scenario. PI needs to pick a file placed in Windows Directory. I have configured the scenario as NFS and given the proper Folder path and file name. PI is not able to Pick the file. It is saying "Configured Directory Does not Exists".
Both PI (HP Unix) and Windows systems are in same network. Do I need to use FTP for this scenario? Is there any way to access the files in Windows Directory using NFS protocol?
Thanks.

Hi Achuth,
Ask you BASIS person to create one shared folder in PI Server(HP Unix) and use that directory in channel.
thanks,
madhu

ItunesU videos not playing in Itunes but play ok if you download to laptop's drive and run them from windows directory

I'm having a problem playing some ItunesU videos, some play okay, some just show black screen and don't play, others show a still image but then doesn't play when trying to view them from itunes store. The audio files play with no issues.
I am using windows 7.
However, if I download the videos that don't play to the laptop's drive and run them from the windows directory they play okay. I don't want to have to download videos to see if they are something I'd like to watch.
Just for reference, an example of a video that plays okay is by UC Berkeley Math 16A 001, Fall 2011. Another is Introduction to Robotics by MIT.
An example that just shows blank screen is Stanford's Iphone & Ipad development, Fall 2011, both HD and SD versions.
While an example of a video that just shows the initial image but doesn't play is Harvard's Statistics 110. If you adjust the time of the video, the video moves to that part of the video but only shows the image at that time, ex. at 13:02, but doesn't play.
I've tried reinstalling quicktime first, then itunes. I've also tried putting directdraw in safe mode, but the problem videos still won't play.
Could it be some setting, since it plays when the file is downloaded but won't play straight from itunes store online (ie. pressing the play button beside the video in the itunes list).
Help pls.

You might have more luck asking on a general Windows troubleshooting site, but my guess would be an invalid or old audio or CD driver (or firmware in the drive). You might try checking those to make sure you have the correct and most current drivers.

Finding the windows directory

With the LabVIEW application builder, I can choose to put a file, such as an
..ini file, into the windows directory.
Now, I need to read the file in my program, but I can't find a variable
available that returns the windows directory, so I'm just using a path
constant C:\Windows. But I know I can't continue using this, because the
windows directory for Windows NT, or 2000, will be C:\WinNT.
Can anybody tell me how to access the windows directory?
Thanks
Slade Squire

Hi Slade,
follow this link: http://zone.ni.com/devzone/explprog.nsf/webmain/EBF11DD1F0FEAEF3862566790072A983?opendocument&node=DZ53008_US
In the Winsys.llb you have the vi Get Windows Path.vi
Good luck,
Alberto

[SOLVED] warning: directory permissions differ on var/log/wicd/

Hi,
I've seen several posts about this but I couldn't really figure out what's the appropriate action. Well, anyway I get the following error message when doing a pacman -Syu
warning: directory permissions differ on var/log/wicd/
filesystem: 1363 package: 755
Is it a bug? Should I change the filepermission of the directory, and if so to what?
Last edited by OMGitsUGOD (2009-09-18 10:38:32)

This is sort of related,
http://bbs.archlinux.org/viewtopic.php?pid=432588
or at least thats the post at the end has the same file permisions as I have in /var/log/wicd.
$ ls -la /var/log/ | grep wicd
d-wxrw--wt 2 root root 4096 2009-08-27 07:58 wicd
I'm pretty bad at this stuff, but isn't this rather 1361 than 1363, or am I totally wrong? And why not allow theowner to read the file?
Last edited by OMGitsUGOD (2009-09-17 08:43:32)

GDM update: directory permissions differ on /var/log/gdm/

Hello,
Running Arch 64Bits kernel 3.9.9-1 with systemd and i got the following warning during a gdm update today:
(1/6) upgrading libgdm [######################] 100%
(2/6) upgrading gdm [######################] 100%
warning: directory permissions differ on /var/log/gdm/
filesystem: 711 package: 1770
Why would gdm need some 1770 permissions for log files? Looks pretty suspicious to me, especially the sticky bit thing. What did i miss?
PS: BTW the update is successful (it's a warning afterall, not an error)
Thanks
EDIT:
Looks like the opposite situation than 3 years ago:
https://bbs.archlinux.org/viewtopic.php?id=94681
https://bugs.archlinux.org/task/19294
EDIT2: here's what i have in /var/log:
msytux666 var # ls -la
total 64
drwxr-xr-x 14 root root 4096 Jul 6 15:34 .
drwxr-xr-x 20 root root 4096 Jul 16 20:24 ..
-rwxrwxrwx 1 root root 4192 Jun 19 11:27 .com.zerog.registry.xml
drwxr-xr-x 7 root root 4096 Jul 7 00:07 abs
drwxr-xr-x 8 root root 4096 Jun 16 17:28 cache
drwxr-xr-x 3 root root 4096 Jun 17 19:07 db
drwxr-xr-x 2 root root 4096 May 31 20:40 empty
drwxrwxr-x 2 root games 4096 May 31 20:40 games
drwx--x--x 2 gdm gdm 4096 Jun 15 14:23 gdm
drwxr-xr-x 26 root root 4096 Jul 16 01:13 lib
drwxr-xr-x 2 root root 4096 May 31 20:40 local
lrwxrwxrwx 1 root root 11 May 31 20:40 lock -> ../run/lock
drwxr-xr-x 6 root root 4096 Jul 18 00:33 log
lrwxrwxrwx 1 root root 10 May 31 20:40 mail -> spool/mail
drwxr-xr-x 2 root root 4096 May 31 20:40 opt
lrwxrwxrwx 1 root root 6 May 31 20:40 run -> ../run
drwxr-xr-x 6 root root 4096 Jun 16 17:28 spool
drwxrwxrwt 8 root root 4096 Jul 18 00:33 tmp
gdm is owned by gdm, so why would it needs 1770 permissions?
EDIT3:
After further research i appear the way gdm is installed may matter.
Well i installed gdm through pacman and always update it with pacman as well. Never manually compiled/make_install'd it nor used abs for it.
Last edited by BGK (2013-07-19 21:37:13)

Okay I'm confused ...
Commit:https://projects.archlinux.org/svntogit … 92c38d536d
@@ -68,8 +68,7 @@ package_gdm() {
cd $pkgbase-$pkgver
make DESTDIR="$pkgdir" install
- chmod 1770 "$pkgdir/var/log/gdm"
- chmod 700 "$pkgdir/var/lib/gdm/.config/dconf"
+ chmod 711 "$pkgdir/var/log/gdm"
rm -r "$pkgdir/var/run" "$pkgdir/var/gdm"
### Split libgdm
so that takes away the 1770 permissions, and replaces them with 711.
@@ -5,6 +5,7 @@ post_install() {
getent passwd gdm > /dev/null 2>&1 || usr/sbin/useradd -c 'Gnome Display Manager' -u 120 -g gdm -d /var/lib/gdm -s /sbin/nologin gdm
passwd -l gdm > /dev/null
chown -R gdm:gdm /var/lib/gdm > /dev/null
+ chown root:gdm /var/log/gdm > /dev/null
glib-compile-schemas /usr/share/glib-2.0/schemas
gtk-update-icon-cache -q -t -f /usr/share/icons/hicolor
however:
chown root:gdm /var/log/gdm > /dev/null
.. is where I get confused. This command makes root and the group gdm the new owners of /var/log/gdm, or did I go wrong somewhere?

Newly Created Sub-Directories Don't Have Parent Directory Permissions

Hoping someone may be able to shed some light on this.
Background:
Running 10.4.11 as a file server on a PPC G5 in a small creative office. We have a handful of users accessing via AFP. No other services are running.
I'm using Workgroup Manager as admin tool.
Top level directory has permissions set to Read & Write for Owner, Group & Everyone.
Issue:
When an authenticated user creates a new directory on the server, the new directory does not honor the parent directory permissions for all three user tiers.
Rather, in getting info, the owner is momentarily set to the user who created the directory with read & write, then switches to (unknown) with r&w. The group is momentarily correct and then switches to (unknown) despite the creating user being part of a specific group, and has Read only permissions.
Everyone has Read only permissions.
If a user attempts to fix permissions on a directory they just created, they are unable to do so.
So, throughout the course of the day, I am bombarded with "I don't have permissions...", wherein, i use remote access to hit Workgroup Manager and do a global propagation down of the parent directories permissions to allow access. Until someone else makes a directory
This can't possibly be right. Newly created directories should be set to the parent directory permissions, if i'm not mistaken.
Anyone? Any insight?
Michael B.

oh yes.. you are right... its accessible in
http:://rishtey.local/default_1.html
successfully... thanks for that... first of all
now issue is: when i access http://rishtey.local/test.php which contains just a tag to display php info only...
instead of rendering this php file, it just save the file in the download folder.
what could be the issue with it?

How do I get directory permissions to replicate downward?

I am trying to modify some directory permissions, but have noticed that the parent directories permissions do not by default replicate downward. How can I change this so that once the parent folder has been modified, it is reflected into the children directories

Do a Get Info (command - I) on the parent, unlock if required. set the permissions you want, then go to the gear and select to Apply to Enclosed items.
I type too slow.

SBS2011 Windows directory permissions messed up by AV

Similar Messages

Maybe you are looking for