Windows 7 Upgrade resets file system permissions


  • After performing a Windows 7 upgrade on my Windows Vista Ultimate primary workstation, I found that some file system permissions were reset.

    In particular, I had some videos in c:\Users\Public\Videos with permissions assigned to an account for my media center, but after the upgrade, these permissions were reset and I had to reassign the permissions. They also seem to be removed from c:\Users\jaraco\music.  I suspect other permissions have been reset, but I'll have to track them down as I run into issues.

    If Windows plans to reset permissions on user data, it should at the very least warn that it's going to do this and leave a log that indicates what permissions were reset from, so they can be recovered manually if desired.

    Is there documentation on which permissions get reset during an upgrade? Can I assume it's only files under C:\Users, C:\Program Files*, C:\ProgramData, and "C:\Windows" ?
    Thursday, October 29, 2009 2:04 PM

All replies

  • I hope you've gotten the issue straightened out by now, but I figured I might post what seems to have worked for me for this problem, just in case.
    I just decided to start from scratch, after trying to fix it with the new permissions command line tool, ICACLS.  Being a new administrator, I ended up just complicating things even more, trying to use this ICACLS (which seems to be a hit amongst the more experienced IT pros, I just needed something a bit simpler).

    This solution uses SUBINACL, which is from the 2K3 toolkit. (link: several lines below)

    The following is from:


    " ... If you want to reset the entire registry permissions to defaults follow these steps

    Note:- Before Doing any changes to registry plesae take a backup and start your changes

    First you need to download SubInACL from here

    SubInACL is a command-line tool that enables administrators to obtain security information about files, registry keys

    , and services, and transfer this information from user to user, from local or global group to group, and from domain to domain.

    Create a file with the name reset.cmd under C:\Program Files\Windows Resource Kits\Tools folder

    Now you need to Edit the reset.cmd file and add the following lines

    subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f
    subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f
    subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f
    subinacl /subdirectories %SystemDrive% /grant=administrators=f

    subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=system=f
    subinacl /subkeyreg HKEY_CURRENT_USER /grant=system=f
    subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=system=f
    subinacl /subdirectories %SystemDrive% /grant=system=f

    Save and exit your file

    Now you need to open command prompt

    run the following command

    cd “C:\Program Files\Windows Resource Kits\Tools”

    after this press enter and enter the following command


    after entering this please press enter

    after a few minutes by processing subinacl, the permission will be reset."


    Hope that helps!


    Sunday, December 20, 2009 8:26 AM
  • i did this (install subInACL and run reset.cmd) and it totaly screwed my instalation. luckely i was able to repair it, but i don't know where it went wrong. while reset.cmd was running it gave a lot of failed operations.
    Tuesday, April 27, 2010 4:22 PM
  • The issue I had was not that the default permissions were not present. That is, administrators and system had the correct permissions to the correct files as expected. It was custom permissions, such as granting read permission to Authenticated Users on a specific subfolder of C:\Users such as C:\Users\myusername\Videos. After upgrading from Windows Vista to Windows 7, all permissions were reset to the default (inherited from C:\Users with no customizations).
    Tuesday, April 27, 2010 11:06 PM
  • Pls, help me, How did you repair after running reset.cmd? My Windows 7 not working properly now...
    Saturday, May 8, 2010 2:29 PM
  • Please create a new thread if you have trouble with the subInACL technique proposed by protege4000ad. This thread is not the appropriate place to ask for help with that problem.
    Saturday, May 8, 2010 3:47 PM
  • WhenI tried this procedure 1/3 of the entries failed. There were 50,000 +/- that succeeded and about 25,000 that failed in each hive.

    What got me started after a clean install of Win7 on a new hard drive is that I cannot install most drivers. When copying the files it says that I don't have permission to change the settings. I reinstalled the OS because Acrobat Reader was telling me that I didn't have access to update an earlier version and MS FAX told me it couldn't send faxes because the "media is protected".  I am thinking about going back to XP. I would be happy with just some basic services and not spending my working day fixing something as basic as administrative permissions.

    Tuesday, May 18, 2010 9:25 PM