Repair permissions

This article is not Vista ready. Do not run any tools from the Repair permissions or Repair associations articles.

Much like Mac OS X, Windows XP can suffer from permissions problems (in the filesystem, registry, or other objects) which can be easily solved by applying the default permissions that originally came with the operating system. The most common problem is regarding HKEY_CLASSES_ROOT. If HKCR loses its root permissions, most of the child keys and values are no longer accessible, causing tremendous issues. HKCR includes all registered file extensions and their associations, DLL registrations (InProcServer entries), and more.

Windows can also suffer from file association problems, which is discussed below. NOTE: Recently, Norton "2006" products (such as Antivirus or Internet Security) have caused permissions issues. On some machines where malware was present, installing Norton 2006 or simply the presence of a Norton 2006 product has exaggerated or caused permissions damage.

In all versions of Windows 2000 and Windows XP, there are several default templates present in the %systemroot%\INF folder. "%systemroot%" is an environment variable whose value contains the path to the current Windows installation, typically "C:\WINDOWS" or "C:\WINNT".

Dial-a-fix (since version v0.57) has included a permissions repair tool (in the Tools dialog), which requires secedit.exe.

Most of the time, this is all that is needed to restore proper permissions. In serious cases, booting into "Safe Mode with command prompt" is the only way you will be able to run this tool.

Safe Mode with command prompt

1. Boot the computer as normal, and tap the F8 key repeatedly before the Windows logo appears and choose Safe mode with command prompt from the boot menu.
2. Login as normal and only a command prompt window will appear. If you are unable to login or a command window does not appear, consult a technician.
3. If you are not familiar with navigating via the command prompt, press CTRL+ALT+DEL to open a task manager window.
   1. Click on File > New Task..., and browse to where you stored Dial-a-fix.exe.
   2. If Dial-a-fix is not able to find secedit.exe (i.e., you are using Windows XP Home), the tool will tell you so, and you may have to use the command prompt to change directories to where Dial-a-fix full is stored, and run dial-a-fix.exe from the command prompt. Update: The Dial-a-fix download now includes secedit.exe in its package. If Dial-a-fix still can't find secedit.exe (even though it is present), then you will need to repair the .exe association before Repair permissions will work.
4. If you are able to launch Dial-a-fix.exe, click Tools and double click on Repair permissions. If all goes as planned, it will begin applying changes. If it does not, consult a technician or post at the Lunarsoft forum for Dial-a-fix.

You can also use the packages listed below to perform this repair.

NOTE: You should run the Repair permissions package before running the Repair associations package.

Repair permissions package

Download

Last updated: 2006/09/16

• Repair Permissions.exe self-extracting archive (117,015 bytes) - MD5: f4666e8f2acf6e1a12c655d56030d9e4
• Repair Permissions.zip zip archive (14,429 bytes) - MD5: 7f92b4aae860c46fa7b7d7f2997531d2
• secedit.exe - for technicians and advanced users who just want secedit

Usage

• After extracting the package, double-click on !RUNME.BAT (or type that if you are at a command prompt while in the directory containing the extracted contents)

Notes

If you are unable to open .bat files because of file association problems, download the reset associations package below.

Although you can safely ignore all errors, you can view the logs that are created at each of the two steps of the process by viewing %systemroot%\security\logs\secanalyze.log (for the first step) and %systemroot%\security\logs\secrepair.log (for the second step). The process should complete successfully, given that your default security template (%systemroot%\inf\defltwk.inf) is intact and secedit.exe was able to write to the registry.

A third optional step is now included in the script: it will now attempt to use the customized security template that is generated when you first install Windows which is located at %systemroot%\repair\secsetup.inf.

Repair associations package

If you are unable to run .exe, .bat, .com, .reg, .cmd, and so forth, you will want to download the following package which may assist in repairing important associations.

File extensions that are reset by this script: bat, cmd, com, exe, inf, js, lnk, pif, reg, scr, vbs

You can attempt to go into the aforementioned Safe mode with command prompt and run the .bat or .cmd from command prompt. Another way is to go to Start > Run (if Windows even works at all) and type 'cmd.exe' -- if Windows then asks you what you want to run cmd.exe with, then click Browse and choose %systemroot%\System32\cmd.exe, and it may open with itself. You should then be able to run the .cmd or .bat versions of the script.

These packages are currently only for Windows XP:

Download

Last updated: 2007/07/15 (corrected an error in reg.reg and all.reg)

• reset associations.exe self-extracting archive (~136 KB)
• reset associations.zip zip archive (~11 KB)

Usage

The package contains several versions of the same script. This is because you may have one or more working executable associations that you can use to launch the script. For instance: your .bat association isn't working, but for whatever reason, you are able to run .cmd scripts. There are .bat, .cmd, and .reg versions of the script. In the reg version folder, there are two ways to apply the associations: apply them all at once by importing !ALL.reg, or individually, by applying separate\bat.reg, separate\cmd.reg, and so on. If you are unable to import .reg files, or launch regedit.exe in order to import them, you will need to use the cmd or bat version.