Article ID: 153094 - View products that this article applies to.
This article was previously published under Q153094
IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/256986/EN-US/ )Description of the Microsoft Windows Registry
When an administrator attempts to secure the Microsoft Windows NT system by changing the default Windows NT file system (NTFS) file and directory permissions set up on the <%winnt_root%> and/or the default system directories and subdirectories, some functions, such as users' ability to log on to the network, may be impaired. In extreme cases the system may blue screen on startup. If the system starts, the default permissions can be restored. If the system blue screens, the original system can be restored by installing a second copy of Windows NT.
WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.
The following procedure does not work in Windows NT 4.0. For additional information, click the article number below to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/157963/EN-US/ )Setacl.exe Not Available in Windows NT 4.0
If the System StartsUse the following procedures to restore the default permissions on the system files in the <winnt_root> and all default subdirectories.
No Additional file security needs to be placed on the Windows NT system files if they are residing on NTFS. Any further restrictions may curtail the ability of users to log on to the individual computer or the domain.
However, it is possible to restrict user access to system files. As long as the SYSTEM account has full control of all system files, user access (usually through the group EVERYONE) can be restricted.
NOTE: Microsoft recommends using the default permissions for Windows NT. Changing these permissions may make it impossible for users to log on, print, access logon scripts, or gain access to other necessary functions. As with using the Registry Editor, make these changes at your own risk. Always have a recovery plan in case you need to revert to a previous setup.
The minimum permissions necessary to log on (again, assuming SYSTEM has full control of the volume root and all system directories and files) are:
Depending on your environment, additional permissions may be necessary.
System_root (e.g. c:\winnt35) ------------ Everyone - READ System_root\system32 --------------------- Everyone - READ/EXECUTE System_root\system32\repl\import\scripts - Everyone - READ/EXECUTE (only if your users have logon scripts)
If The System Does Not Start (Blue Screen with STOP 21A)If the administrator has modified permissions, rebooted the computer, and now receives a blue screen, then the most likely cause is that the SYSTEM account does not have adequate access to the system files and directories.
To restore access:
Article ID: 153094 - Last Review: November 1, 2006 - Revision: 3.1