Restoring Default Permissions to Windows NT System Files

This article was previously published under Q153094
This article has been archived. It is offered "as is" and will no longer be updated.
IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows Registry
When an administrator attempts to secure the Microsoft Windows NT system bychanging the default Windows NT file system (NTFS) file and directorypermissions set up on the <%winnt_root%> and/or the default systemdirectories and subdirectories, some functions, such as users' ability tolog on to the network, may be impaired. In extreme cases the system mayblue screen on startup. If the system starts, the default permissions canbe restored. If the system blue screens, the original system can berestored by installing a second copy of Windows NT.
WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

The following procedure does not work in Windows NT 4.0. For additional information, click the article number below to view the article in the Microsoft Knowledge Base:
157963 Setacl.exe Not Available in Windows NT 4.0

If the System Starts

Use the following procedures to restore the default permissions on thesystem files in the <winnt_root> and all default subdirectories.
  1. Logon as administrator.
  2. The built-in SYSTEM account needs access to the Windows NT default directories and subdirectories. To get this access, do the following:
    1. In File Manager use Security/Permissions to grant the SYSTEM account FULL CONTROL to the root directory of the NTFS volume that containsWindows NT.
    2. Next, either click to select the Replace Permissions on Subdirectories option, which gives SYSTEM access to the entire volume,


      go to the system's root directory (typically, WINNT35) and give SYSTEM full control of that directory and all subdirectories. SYSTEM should always have full control of all system files.
  3. Start Registry Editor (Regedt32.exe).
  4. Go to the following registry location:
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager
  5. Double-click the value BootExecute.
  6. Under BootExecute, you may find a few entries, such as:
    autocheck autochk *
    After any entries, add on a separate line:
    setacl /a \DosDevices\<systemdrive>:\<winnt_root>\System32\winperms.txt \DosDevices\<systemdrive>:
    NOTE: This added entry should all be on the same line under theautocheck entry.

    Here <systemdrive> is the drive that Windows NT is installed onand <winnt_root> is the Windows NT root directory on that drive.

    After adding the change on a typical system, the BootExecute entrylooks like this while in the reged32 multi-string editor:
       autocheck autochk *   setacl /a \DosDevices\c:\winnt35\system32\winperms.txt \DosDevices\c:					
  7. Click OK to save the changes.
  8. Exit the registry editor and restart the computer.
When the computer restarts, the system will set security on the system files just as it does when converting from FAT to NTFS file systems.

No Additional file security needs to be placed on the Windows NT systemfiles if they are residing on NTFS. Any further restrictions may curtailthe ability of users to log on to the individual computer or the domain.

However, it is possible to restrict user access to system files.As long as the SYSTEM account has full control of all system files,user access (usually through the group EVERYONE) can be restricted.

NOTE: Microsoft recommends using the default permissions for Windows NT. Changing these permissions may make it impossible for users to log on,print, access logon scripts, or gain access to other necessary functions.As with using the Registry Editor, make these changes at your own risk.Always have a recovery plan in case you need to revert to a previous setup.

The minimum permissions necessary to log on (again, assuming SYSTEM has full control of the volume root and all system directories and files) are:

     System_root (e.g. c:\winnt35) ------------ Everyone - READ     System_root\system32 --------------------- Everyone - READ/EXECUTE     System_root\system32\repl\import\scripts - Everyone - READ/EXECUTE          (only if your users have logon scripts)				
Depending on your environment, additional permissions may be necessary.

If The System Does Not Start (Blue Screen with STOP 21A)

If the administrator has modified permissions, rebooted the computer,and now receives a blue screen, then the most likely cause is thatthe SYSTEM account does not have adequate access to the system filesand directories.

To restore access:
  1. Install a new copy of Windows NT into a new directory on the same volume as the existing copy. Of course, you will need to start up with the boot disks.WARNING: If you install a new copy of NT in the same directory as the existing copy, you will erase the existing copy, all existing accounts, and so on.

  2. Boot to the new copy of Windows NT.
  3. Use File Manager to give the System account Full Control ofthe volume root and all system files and directories.
You should now be able to boot to the original copy of Windows NT. Followthe instructions in the "If the System Starts" section of this article to restore default permissions on your system.
prodnt security

Article ID: 153094 - Last Review: 12/04/2015 14:59:44 - Revision: 3.1

Microsoft Windows NT Workstation 3.5, Microsoft Windows NT Workstation 3.51, Microsoft Windows NT Server 3.5, Microsoft Windows NT Server 3.51

  • kbnosurvey kbarchive kbother KB153094