Tech Support banner

Status
Not open for further replies.
1 - 8 of 8 Posts

·
Excel Formula Solutions
Joined
·
691 Posts
Discussion Starter #1
Guys, I've already experienced issues of not being able to complete easy installs due to "Permissions Denied." I am an Admin on my own personal PC and I'm not sure what I need to do make a permanent change for my personal user profile to not incur any more policy restrictions. Below is the simple task I attempted to schedule when I last created a Permissions Error.
*********
Run the following command from a command prompt once to disable hibernation: powercfg -h off
Open Task Scheduler and create a new simple task, give it a name “Sleep”
Set the Trigger to Daily
Set the Start time to the time you want the computer to sleep, set Recur every: 1 day
Set Action to Start a program
Set the Program to: C:\Windows\System32\rundll32.exe
Set the Argument to: powrprof.dll,SetSuspendState 0,1,0
On the Finish page check the box to “Open the Properties dialog for this task when I click Finish”
On the General page under Security options select “Run whether user is logged on or not” and check “Run with highest privileges”
 

·
Excel Formula Solutions
Joined
·
691 Posts
Discussion Starter #2
Re: Set User to Full Admin Privileges

I see plenty of views and no reply--hmmm. I repeat this is my personal PC and I am the owner and admin. I think certain permissions may be blocked by my antivirus or some other process, or just a protection feature I didn't turn off when i set up my laptop. I need guidance on what components of Win7 would hinder my ability. This is not an attempt to hack past policy, and if i was a limited user on my home pc then obviously the options i would need to enable wouldn't be available to modify (just in case that was a reason for a lack of response). Once again, please provide guidance on a possible option i would need to check into first. Thanks.
 

·
Moderator , - Microsoft Support
Joined
·
7,745 Posts
Re: Set User to Full Admin Privileges

Hi, go to start search and type:- cmd, right click on the returned cmd.exe and select run as administrator, this is how you need to elevate your cmd prompt to admin.

Now if you run the powercfg off cmd then the hiberfil.sys file that contains the powercfg settings will be inactive, if it is causing problems then after running the cmd, reboot, open another cmd prompt (elevated) and type powercfg -h on, now run your schedule tasks.
 

·
Excel Formula Solutions
Joined
·
691 Posts
Discussion Starter #4
Re: Set User to Full Admin Privileges

Initially I did open cmd as elevated to admin and it allowed me to set powercfg to "off." With that successful, I ran task scheduler under "run as admin." The error for permissions denied came up at the end of submitting the scheduled task. REGARDLESS--this was one of several examples of not being permitted autonomy on my own pc. I am more interested in help for checking general settings for Win7 and user profiles (my own), than help with executing a specific task. I feel adjusting settings with my user profile or local system policy I can safely not worry about permissions being denied to begin with. Let me know how you can help in those regards. Again, thanks.
 

·
Moderator , - Microsoft Support
Joined
·
7,745 Posts
Re: Set User to Full Admin Privileges

Hi, this process is not recommended as you make your system more vulnerable to Malware and OR Virus attack, having said that I run my test machines this way.

First by way of understanding how Vista Seven (and Eight) are designed to prevent Nasties this is a small snipet from a lecture I did on this subject some time ago.

From my notes:-

Both Vista and Seven have WRP (windows resource protection) administrators are allowed to create folders and over these folders, they get full access to modify,(m) which is the explicit grant and ( f) that's full access and it is inherited by child objects. System files like the root Program Files folder require the trusted installer or system to allow access
Only the System and the TrustedInstaller accounts are allowed to write to the Program Files folder. This is part of the new security model introduced in Vista. Makes it harder for malware to infect your program files.
For example, if you would try modifying/deleting a folder you have created, say for eg, "Test", you would see you could. Or if you would try extracting something into the Test folder, it would work. And if you use the icacls tool on the Test folder, you would see that it has an inherited Full Access flag for Administrators.
I have created a folder called downloads, keep them all there located at:-
C:\Users\Paul\Documents\Downloads
The Icacls CMD for C:\ Program files and C:\Users\Paul\Documents\Downloads shows the difference
Microsoft Windows [Version 6.0.6000]
Copyright (c) 2006 Microsoft Corporation. All rights reserved.

C:\Windows\system32>icacls "c:\program files"
c:\program files NT SERVICE\TrustedInstaller:(F)
NT SERVICE\TrustedInstaller:(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(M)
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
BUILTIN\Administrators:(M)
BUILTIN\Administrators:(OI)(CI)(IO)(F)
BUILTIN\Users:(RX)
BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
CREATOR OWNER:(OI)(CI)(IO)(F)
Now c:\users\paul\documents\downloads (note non system does not require “)
Microsoft Windows [Version 6.0.6000]
Copyright (c) 2006 Microsoft Corporation. All rights reserved.
C:\Windows\system32>icacls c:\users\paul\documents\downloads
c:\users\paul\documents\downloads VISTATEST\Paul:(I)(OI)(CI)(F)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
BUILTIN\Administrators:(I)(OI)(CI)(F)
VISTATEST\Administrator:(I)(OI)(CI)(RX)

Successfully processed 1 files; Failed processing 0 files
Now to grant your user, log in with the account you want and open a elevated cmd prompt. One gives Windows the other the C: drive, you can do both or choose only C:. Run the following commands (in red). Substitute your user name for "vistatest\paul" (my user name here). Syntax important, Restart to take effect.

Code:
Microsoft Windows [Version 6.0.6000]
Copyright (c) 2006 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>takeown /f C:\windows

SUCCESS: The file (or folder): "C:\windows" now owned by user "VISTATEST\Paul".

C:\Windows\system32>icacls c:\windows /grant vistatest\paul:f
processed file: c:\windows
Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>takeown /f C:\

SUCCESS: The file (or folder): "C:\" now owned by user "VISTATEST\Paul".

C:\Windows\system32>icacls C:\ /grant vistatest\paul:f
processed file: C:\
Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>
 

·
Excel Formula Solutions
Joined
·
691 Posts
Discussion Starter #6
Re: Set User to Full Admin Privileges

would I really want to do this given that I am the only user on my PC? How do I first check to see if I am a "TrustedInstaller" account?
 

·
Moderator , - Microsoft Support
Joined
·
7,745 Posts
Re: Set User to Full Admin Privileges

Hi, your response indicates only very basic knowledge, you might like to study computer science, this whole area is for advanced users only, as I said it is not recommended, as it circumvents the developers attempts to keep you safe.
 

·
Excel Formula Solutions
Joined
·
691 Posts
Discussion Starter #8
Re: Set User to Full Admin Privileges

Please do not speak so condescendingly; I know that I have "only very basic knowledge," and trust me when I say I do not wish to meddle in areas of my PC that I don't belong. The only answer I initially wanted to pursue is why I had an account that was restricted in certain aspects, considering I am the original owner of my PC and initiated all original setup. It seems you have adequately answered my question through education, and I must suffice with your explanation. If I have issues in the future with my PC being too restrictive on simple and basic program installs or access, then I'll be sure to provide ample detail and pursue such issues. Thank you for demonstrating expertise and I will mark thread as solved.
 
1 - 8 of 8 Posts
Status
Not open for further replies.
Top