locked
Blocked from editing security settings on wscript.exe RRS feed

  • Question

  • Windows 2008 R2 Server - brand new install

    I need to edit the security permissions on wscript.exe and cscript.exe for compliance reasons.

    I am logged into the computer as a member of the administrator's group.

    When I try to edit the security permissions on anything in the \Windows directory by going to properties -> security tab and then 'advanced security settings'.  Even after I authenticate with UAC, everything is read-only.  When viewing advanced security, the add and remove buttons are disabled.

    How can I modify permissions on files in the Windows directory in Win2008R2?

    Monday, February 13, 2012 11:31 PM

Answers

  • I would think the Administrators group doesn't have the Change Permissions permission. The group is not assigned that by default on windows 7/2008. The only account that can change the permissions is TrustedInstaller by default. As an administrator, you need to first take ownership of the file and only then you will be able to change the permissions.

    ondrej.

    • Marked as answer by skapinos Tuesday, February 14, 2012 8:35 PM
    Tuesday, February 14, 2012 8:39 AM

All replies

  • disable UAC, reboot and then check, if it works..

    Members of Domain Admins are need to elevate the permissions. This is one of the new security features include within 2008. The other option is to stop UAC or use GPOs to configure UAC for your needs. But keep in mind lowering security is always the bad option.

    Check following GPO settings:
    Computer configuration, Policies, Windows settings, security settings, local policies, security options, in the right pane you will find "User account control


    Gopi Kiran |Facebook| This posting is provided AS IS with no warranties,and confers no rights.

    • Marked as answer by Aiden_Cao Wednesday, February 15, 2012 2:04 AM
    • Unmarked as answer by skapinos Wednesday, February 15, 2012 4:09 PM
    Tuesday, February 14, 2012 12:48 AM
  • I would think the Administrators group doesn't have the Change Permissions permission. The group is not assigned that by default on windows 7/2008. The only account that can change the permissions is TrustedInstaller by default. As an administrator, you need to first take ownership of the file and only then you will be able to change the permissions.

    ondrej.

    • Marked as answer by skapinos Tuesday, February 14, 2012 8:35 PM
    Tuesday, February 14, 2012 8:39 AM