Topic: You Require Permissions From TrustedInstaller  (Read 21765 times)

You Require Permissions From TrustedInstaller
« on: February 04, 2014, 10:45:14 PM »

Venerence

  • Jr. Chef
  • **
  • Date Registered: Jan 2014
  • Posts: 54
From the PE environment, there are certain files that aren't allowed to be deleted (requiring permissions from TrustedInstaller).

Now I fully understand that there are certain files that in a regular environment, you don't want to delete, which is why this happens. That being said, if you're a person running a windows PE environment, you want total administrative access over all files.

I can work around it by running a permission changer over the files (ntfsaccess), but I would like the ability to manipulate all files without having to change the permissions on the files first. an XP pe environment (for example,. hirens) can do this, though I don't think any of the winse projects can.

Is there a script or a registry change I can make to have unfettered access to files, regardless of permissions?

Re: You Require Permissions From TrustedInstaller
« Reply #1 on: February 05, 2014, 07:05:35 AM »

Lancelot

  • Gena Baker
  • Grand Chef
  • *****
  • Date Registered: Sep 2010
  • Posts: 10350
Have you tried Win8PESE or Win7PESE ( instead of Win81SE)

Can you give an example with a file ... that can be found on all machines ?

ps: Try Gena as PE1x environment http://gena.cwcodes.net/Compressed/  :wink:

:turtle:

Re: You Require Permissions From TrustedInstaller
« Reply #2 on: February 05, 2014, 09:36:42 AM »

Venerence

  • Jr. Chef
  • **
  • Date Registered: Jan 2014
  • Posts: 54
For example, I had extracted the boot.wim file from the windows 8 install media into a directory. If I want to delete the folder from within windows 8.1 pe, it won't let me. I can move the folder that contains it, but I can't modify (ie: delete) the file itself because the administrator account does not have modify permissions (only TrustedInstaller does).





Interestingly enough, I tried the same thing from both Win7PE and Win8PE and it works. It may be because win8.1se is building in OS mode, which allows different permissions. That being said, I'm trying to get this to work in OS mode, because OS mode appears to work on a wider variety of computers.

Re: You Require Permissions From TrustedInstaller
« Reply #3 on: February 05, 2014, 09:39:13 AM »

Venerence

  • Jr. Chef
  • **
  • Date Registered: Jan 2014
  • Posts: 54
Direct image links since the images look broken (and I can't find an edit button on the board).


http://i.imgur.com/01cJ8N8.jpg

http://i.imgur.com/Uq8tqss.jpg

http://i.imgur.com/01cJ8N8.jpg

http://i.imgur.com/Uq8tqss.jpg




Re: You Require Permissions From TrustedInstaller
« Reply #4 on: February 05, 2014, 09:53:10 AM »

Lancelot

  • Gena Baker
  • Grand Chef
  • *****
  • Date Registered: Sep 2010
  • Posts: 10350
Welcome  Venerence :welcome:

on Win81SE
Try running a file manager with "System" User
ex:
psexec -i -s cmd.exe
on cmd.exe , .... run a filemanager like "Double Commander"

than try to delete such file with this filemanager

ps: if it doesn't work with filemanager, try also deleting within cmd.exe which was opened as System (if opened ;))



Quote
Background:
On Gena, Win7PESE, Win8PESE --> You are already System at bootup,
  Win8SE --> You are Administrator (As far as I know it is still PE with being Administrator)
      System > Administrator

Quote
PS:
For your specific example, Use
Utils\"Extract Wim Folders"
to extract wim files from source, it both extracts and do permissions  :wink:

PS:
edit button will open after 10 posts (spam protection  :wink:)




Let us know how this works.  :thumbsup:

:turtle:

Re: You Require Permissions From TrustedInstaller
« Reply #5 on: February 05, 2014, 03:10:08 PM »

ChrisR

  • XPE Baker
  • Grand Chef
  • *****
  • Date Registered: Mar 2011
  • Posts: 3494
No direct access but you should be able to do it with this plugin:
Add Take Ownership to Context Menu
Add Take Ownership of files, driectory or drive to Context Menu.

* TakeOwnership.script (7.93 kB - downloaded 255 times.)

Re: You Require Permissions From TrustedInstaller
« Reply #6 on: February 05, 2014, 03:35:21 PM »

Atari800xl

  • Code Baker
  • Sr. Chef
  • ****
  • Date Registered: Feb 2013
  • Posts: 827
Thanks ChrisR: nice, compact and to the point!!!

Re: You Require Permissions From TrustedInstaller
« Reply #7 on: February 05, 2014, 10:59:13 PM »

Lancelot

  • Gena Baker
  • Grand Chef
  • *****
  • Date Registered: Sep 2010
  • Posts: 10350
Hi Chris,

When you have time, can check above psexec way works  :cool:
If works: it is quite a nice direct way (direct delete without taking ownership  :wink:), which leads some more ideas..  :wink: :great:
Probably Venerence have no time  :lol:


Another question:
Does "AccessGain Drivers" plugin ( \Gena\Drivers\6 Other\"AccessGain Drivers") works on above condition with Win81SE Administrator
( Another direct approach but only for files , that is the reason I initially asked SYSTEM psexec trick first  :wink: which is to me overall superior to its limits  :great: )




All Whenever you have time  :great:

:turtle:

Re: You Require Permissions From TrustedInstaller
« Reply #8 on: February 06, 2014, 01:15:29 AM »

ChrisR

  • XPE Baker
  • Grand Chef
  • *****
  • Date Registered: Mar 2011
  • Posts: 3494
I see your idea, to test indeed  :thumbsup:
Take Ownership Context Menu works but I hope also that we can do better. To be like others PE with the system account.

Re: You Require Permissions From TrustedInstaller
« Reply #9 on: February 06, 2014, 01:18:03 AM »

Venerence

  • Jr. Chef
  • **
  • Date Registered: Jan 2014
  • Posts: 54
loading the following:

psexec -s -i cmd

then loading up qdir via cmd, fixes the problem. You can now delete the files (though it is a roundabout method).

I'll rebuild a pe with that gena plugin and get back to you.

Re: You Require Permissions From TrustedInstaller
« Reply #10 on: February 06, 2014, 08:35:48 AM »

Lancelot

  • Gena Baker
  • Grand Chef
  • *****
  • Date Registered: Sep 2010
  • Posts: 10350
Hi Venerence,

Yep on testing phases things always a bit roundabout  :wink:

I feel starting explorer like qdir above can do the trick too  :lol:




Hi Chris,

I feel with paexec
http://www.poweradmin.com/paexec/
We can have shortcuts for things to run as system,
"Cmd as SYSTEM"
"Explorer As SYSTEM"
"Regedit As SYSTEM"

"QDir as SYSTEM"

That is all I guess,
"Regedit As SYSTEM" maybe useful on loaded hives about permissions there  :wink:

ps: if direct shortcut not available for any reason, use xxx.cmd way  :wink:

ps2: TakeOwnership plugin as default inside projects, (if you like this way, without selected as default), would be nice  :wink:

See You
:turtle:

Re: You Require Permissions From TrustedInstaller
« Reply #11 on: February 06, 2014, 01:33:10 PM »

ChrisR

  • XPE Baker
  • Grand Chef
  • *****
  • Date Registered: Mar 2011
  • Posts: 3494
 "AccessGain Drivers" works well in Win8.1SE x86  :thumbsup:

By Adding something like:
Code: [Select]
for %%x in (C D E F .....) do fltmc.exe attach AccessGainDriver %%x:>nul

in RunOnce (if the driver is installed at this time), It must do the trick.

For x64, we need to disable the driver signature. I tried with:
Code: [Select]
bcdedit /set loadoptions DDISABLE_INTEGRITY_CHECKS
bcdedit /set testsigning ON

but unfortunately it did not work.

Re: You Require Permissions From TrustedInstaller
« Reply #12 on: February 06, 2014, 03:54:58 PM »

Lancelot

  • Gena Baker
  • Grand Chef
  • *****
  • Date Registered: Sep 2010
  • Posts: 10350
"AccessGain Drivers" works well in Win8.1SE x86  :thumbsup:

By Adding something like:
Code: [Select]
for %%x in (C D E F .....) do fltmc.exe attach AccessGainDriver %%x:>nul

in RunOnce (if the driver is installed at this time), It must do the trick.
Feel free to play with plugin the way you like, I will follow you  :thumbsup:
. a text saying "x64 now work for now" maybe ok
. above for% ... can also be added as shortcut (Access Gain All Drives) instead of runonce startup ...



I see you are busy on more core related things, all above whenever you find free time  :wink: :thumbsup: :thumbsup:
Don't forget to update FAQ about topics (2GB  http://theoven.org/index.php?topic=867 )

ps: I am making my own xpx64sp3 xpx86sp4 packages  :wink: it takes a lot time, as you know win-update do not download .exe packages....... well life goes  :great:

See You
:turtle:

Re: You Require Permissions From TrustedInstaller
« Reply #13 on: February 07, 2014, 02:26:50 AM »

Venerence

  • Jr. Chef
  • **
  • Date Registered: Jan 2014
  • Posts: 54
Tried the gena plugin, it ran during the build but didn't seem to do anything (don't even get the context menu).

Re: You Require Permissions From TrustedInstaller
« Reply #14 on: February 07, 2014, 09:21:43 AM »

Lancelot

  • Gena Baker
  • Grand Chef
  • *****
  • Date Registered: Sep 2010
  • Posts: 10350
Tried the gena plugin, it ran during the build but didn't seem to do anything (don't even get the context menu).

It works fine here  :thumbsup:
 (yes it is a small plugin that process less than a second  :wink:)


I just update plugin to v7 ,
 that adds batches ChrisR mentioned on reply 11 , to system32 folder ,
    "AccessGain All Drives_attach.cmd" , "AccessGain All Drives_detach.cmd"  :cool:
        ps: if desired ready to be used one day with startup, shortcut etc...
  (+warning about nt6x-x64)



try running explorer as SYSTEM with psexec Venerence , see if deletes.... ,
 I guess this ends up all known solutions  :thumbsup:

:turtle:

Re: You Require Permissions From TrustedInstaller
« Reply #15 on: February 07, 2014, 10:49:51 AM »

ChrisR

  • XPE Baker
  • Grand Chef
  • *****
  • Date Registered: Mar 2011
  • Posts: 3494
I just update plugin to v7 ,
It works fine here too  :great:  Thanks for the update plugin :thumbsup:

Maybe we can add shortcuts to "AccessGain All Drives_attach(detach).cmd", later.

for driver signing on x64, I found this:
ReadyDriver v3 ... or Disable Driver Signature Enforcement permanently  http://uhlik.sk/?page=swreadydriver
It may be interesting to test it for those who have a little more time  :wink:
« Last Edit: February 07, 2014, 10:50:36 AM by ChrisR »

Re: You Require Permissions From TrustedInstaller
« Reply #16 on: February 07, 2014, 11:05:00 AM »

Venerence

  • Jr. Chef
  • **
  • Date Registered: Jan 2014
  • Posts: 54
Tried out loading explorer via psexec, not great luck. Had to kill the current explorer process first, then run psexec, which did load explorer. However, the desktop did not load, and explorer soon crashed with a quote "hard error".

It may or may not work if we could run explorer as system from the get go with system permissions, rather then after the fact.

Also there is another good reason for getting this working, as most programs that rely on PE environments also rely on system permissons. For example, I ran macrium ReDeploy (lets you restore a windows image to a different computer). It did not work unless running as the system account via psexec (took me a good hour to figure out why it wasn't actually working).

I could see some partitioning programs messing up when they expect to have system permissions and they don't, for example.

EDIT: I can edit now!
« Last Edit: February 07, 2014, 11:05:27 AM by Venerence »

Re: You Require Permissions From TrustedInstaller
« Reply #17 on: February 07, 2014, 11:57:43 AM »

Lancelot

  • Gena Baker
  • Grand Chef
  • *****
  • Date Registered: Sep 2010
  • Posts: 10350
For above reason, I feel 2 solution would be nice

1)
Access Gain at startup as Chris Suggested, for today works with x86 builds only (above reply 15)

2)
Summing up with previous:

Shortcuts for things to run as system,
"Cmd as SYSTEM"
"Regedit As SYSTEM"
+
"QDir as SYSTEM"

Also for general usage a Context saying "Run as SYSTEM" would be nice for such utilities



with paexec http://www.poweradmin.com/paexec/ or whatever Chris finds suitable  :cool:
(paexec x64 version ???!! besides source code available ...)

++
Reminding old trick that does not require 3rd party
http://blogs.msdn.com/b/adioltean/archive/2004/11/27/271063.aspx
Code: [Select]
rem sc delete testsvc
sc create testsvc binpath= "cmd /K start" type= own type= interact
sc start testsvc
rem [SC] StartService FAILED 1053: this is expected since CMD.EXE doesn’t have any service related code in it.
exit
trick does not work on my win81x64-hostos  , but maybe on Win81SE ?!





***
Venerence,

I just update Access Gain plugin to v8,
 it now has all "drives access gain startup"  option as default,
  test with x86 source,   See if your such applications are fine out of box with access gain  :cool: ????

ps: Good you can edit  :great:

:turtle:

Re: You Require Permissions From TrustedInstaller
« Reply #18 on: February 07, 2014, 12:33:32 PM »

ChrisR

  • XPE Baker
  • Grand Chef
  • *****
  • Date Registered: Mar 2011
  • Posts: 3494
I did not seek more but PaExec does not work for now on x64 even after adding SysWOW64\wtsapi32.dll dependency.
PsExec does the trick

It may be easier to add it to the context menu, rather than create several shortcuts.
RegHiveLoad,Tmp_Software,%RegSoftware%
RegWrite,HKLM,0x2,"Tmp_Software\Classes\exefile\shell\Run as System\command","","%PE_Programs%\%ProgramFolder%\PsExec.exe -i -d -s #$q#$p1#$q"
RegHiveUnLoad,Tmp_Software


Re: You Require Permissions From TrustedInstaller
« Reply #19 on: February 07, 2014, 02:34:01 PM »

Lancelot

  • Gena Baker
  • Grand Chef
  • *****
  • Date Registered: Sep 2010
  • Posts: 10350
psexec not distributable. ..
i remember jfx provided alternate tools elsewhere but i can not remember now (hard to find on mobile browse...)
i guess jfx or galapo already had done this with au3.

did you try old batch trick?

i agree no needs several shortcuts , but only Essentials like above ;)
« Last Edit: February 07, 2014, 02:53:16 PM by Lancelot »

 

Powered by EzPortal