Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've done something stupid. I tried to lock down the access rights to a disk using the security properties at disk level. However, in the process, I've locked myself out as Administrator. I can and have seized ownership of the disk, and then I can view the security properties of the disk. Howver if I try to edit and change them for administrators I get "An error occured while applying security information to: E:\ Access Denied". UAC is set to never notify. The disk is also inaccessable with an elevated command prompt. Same message "Access Denied".

Security settings as follows: CREATOR OWNER - No settings SYSTEM - All deny MY_USERNAME - All allow Administrators - All allow Users - All deny

I guess I cannot get access because I am in the users group. Can I solve this without removing myself from the Users group? I prefer not to do that because it is an Active Directory group in the Users group which I am in over which I have no control.

share|improve this question
    
You should be able to take ownership over the object. Once you do that, you can set the ACL to whatever you want. –  allquixotic Jun 12 '13 at 14:07
    
Okay. What I hoped I didn't have to do worked. 1. Remove the AD group 'Authenticated Users' from the local machine Users group. 2. Set rights for Users as an adminsitrator and owner to access. 3. Add Authenticated Users back to the local machine Users group. No other way out in this dead-lock. –  Martijn Burger Jun 12 '13 at 15:26
1  
Deny ACLs take precedence over allow ACLs. If you have a DENY all, then you will never be able to access anything. You should almost never be using an explicit DENY ACL on Windows. Simply don't add acls that allow access, and depend on the implicit deny. –  Zoredache Jun 12 '13 at 20:16
    
Thanks zoredache! Found that out the hard way. :) –  Martijn Burger Jun 12 '13 at 22:51

1 Answer 1

Okay. What I hoped I didn't have to do worked. 1. Remove the AD group 'Authenticated Users' from the local machine Users group. 2. Set rights for Users as an adminsitrator and owner to access. 3. Add Authenticated Users back to the local machine Users group.

No other way out in this dead-lock.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.