How to fix drive ntfs permissions in powershell or cmd?

[HeyItsChris]

My drives permissions became corrupt, and it's most likely because I got hacked.  A lot of folders are set as read only as well. 

 

It all happened as soon as I upgraded my memory with new modules, from 2x 16gb mushkin ddr3-1600 ecc reg buffered to 2x 32gb samsung ddr3-1866 ecc reg buffered.

 

So, may you suggest how to run this script without error?  It gave an error something about "subst.exe".  I get errors when running the script, how do I run it error free?  I'm currently running Hirens boot cd win11.

 

GitHub - franklesniak/Repair-NTFSPermissions: Scans NTFS permissions and ensures that BUILTIN\Administrators and NT AUTHORITY\SYSTEM have full control to every file and folder

GITHUB.COM

---

Scans NTFS permissions and ensures that BUILTIN\Administrators and NT AUTHORITY\SYSTEM have full control to every file and folder -...

 

I need to know the specific commands to do this please?

Edited April 8 by HeyItsChris

[ENTERPRISE]

1 hour ago, HeyItsChris said:

My drives permissions became corrupt, and it's most likely because I got hacked.  A lot of folders are set as read only as well. 

 

It all happened as soon as I upgraded my memory with new modules, from 2x 16gb mushkin ddr3-1600 ecc reg buffered to 2x 32gb samsung ddr3-1866 ecc reg buffered.

 

So, may you suggest how to run this script without error?  It gave an error something about "subst.exe".  I get errors when running the script, how do I run it error free?  I'm currently running Hirens boot cd win11.

 

GitHub - franklesniak/Repair-NTFSPermissions: Scans NTFS permissions and ensures that BUILTIN\Administrators and NT AUTHORITY\SYSTEM have full control to every file and folder

GITHUB.COM

---

Scans NTFS permissions and ensures that BUILTIN\Administrators and NT AUTHORITY\SYSTEM have full control to every file and folder -...

 

I need to know the specific commands to do this please?

 

Looks like subst.exe is related to the below and it is possible that either you have typed in a path incorrectly, or there is an issue with Subst on your OS. If that is the case then I would suggest doing a Windows File Repair and trying again.

 

subst | Microsoft Learn

LEARN.MICROSOFT.COM

---

Reference article for the subst command, which associates a path with a drive letter.

 

Failing that you may also want to try : 

Resetting NTFS files permission in Windows – Graphical Utility – lallous' lab

LALLOUSLAB.NET

---

Update 04/30/2017: New version 1.2.0 released with Unicode support and lots of bug fixes! Download the reset permission tool from the download section below.  The post entitled “Resetting NTFS file…

 

Looks like a graphical interface for achieving the same results, at least on the surface. I would also look into Medicat to see if that tool has a tool for restoring NTFS file permissions.

[HeyItsChris]

@ENTERPRISE I think I got hacked, look at these & there is logs of everything in here.  What do you think?

 

AadRecoveryPasswordDelete

 

ClientRecoveryPasswordRotation

 

Check out this error I receive...

 

X:\>REM -- Check out the book: Batchography - The Art of Batch Files Programming

X:\>REM -- http://lallouslab.net/2016/05/10/batchography/

X:\>REM -- Temp script location: X:\Users\Default\AppData\Local\lallouslab\resetperm.bat

X:\>TITLE taking ownership of folder: C:\*

X:\>takeown /r  /SKIPSL  /f C:\*
'takeown' is not recognized as an internal or external command,
operable program or batch file.

X:\>TITLE Taking ownership of folder: C:\*

X:\>icacls C:\* /T  /L  /Q /C /RESET
'icacls' is not recognized as an internal or external command,
operable program or batch file.

X:\>TITLE Changing files attributes in folder: C:\*

X:\>attrib /s  -h -s C:\*

X:\>pause
Press any key to continue . . .

 

To fix it, I copied takeown.exe & icacls.exe from c:\windows\system32 to the directory root of ResetPermission.exe.

 

Now so far I have these errors on quite a few files.

 

X:\>REM -- Check out the book: Batchography - The Art of Batch Files Programming

X:\>REM -- http://lallouslab.net/2016/05/10/batchography/

X:\>REM -- Temp script location: X:\Users\Default\AppData\Local\lallouslab\resetperm.bat

X:\>TITLE taking ownership of folder: C:\*

X:\>takeown /r  /SKIPSL  /f C:\*

 The system cannot find the path specified. ( "C:\BIOS\Polaris BIOS\My Reference AMD Radeon RX 480 4GB\Modded BIOS\Game Stable but Topaz Labs Video Enhance Ai Unstable\1375mhz 1175mv set to 1175mv 1750mhz on 2000 timing strap 185W 185A 0 LSI Offset Adjust original bios dpm pstates offsets to 0 and fan profile 84c temp limit.rom" )

 

X:\>TITLE Taking ownership of folder: C:\*

X:\>icacls C:\* /T  /L  /Q /C /RESET
C:\BIOS\Polaris BIOS\My Reference AMD Radeon RX 480 4GB\Modded BIOS\Game Stable but Topaz Labs Video Enhance Ai Unstable\1375mhz 1175mv set to 1175mv 1750mhz on 2000 timing strap 185W 185A 0 LSI Offset Adjust original bios dpm pstates offsets to 0 and fan profile 84c temp limit.rom: The system cannot find the path specified.

Edited April 8 by HeyItsChris

[ENTERPRISE]

16 hours ago, HeyItsChris said:

@ENTERPRISE I think I got hacked, look at these & there is logs of everything in here.  What do you think?

 

AadRecoveryPasswordDelete

 

ClientRecoveryPasswordRotation

 

Check out this error I receive...

 

X:\>REM -- Check out the book: Batchography - The Art of Batch Files Programming

X:\>REM -- http://lallouslab.net/2016/05/10/batchography/

X:\>REM -- Temp script location: X:\Users\Default\AppData\Local\lallouslab\resetperm.bat

X:\>TITLE taking ownership of folder: C:\*

X:\>takeown /r  /SKIPSL  /f C:\*
'takeown' is not recognized as an internal or external command,
operable program or batch file.

X:\>TITLE Taking ownership of folder: C:\*

X:\>icacls C:\* /T  /L  /Q /C /RESET
'icacls' is not recognized as an internal or external command,
operable program or batch file.

X:\>TITLE Changing files attributes in folder: C:\*

X:\>attrib /s  -h -s C:\*

X:\>pause
Press any key to continue . . .

 

To fix it, I copied takeown.exe & icacls.exe from c:\windows\system32 to the directory root of ResetPermission.exe.

 

Now so far I have these errors on quite a few files.

 

X:\>REM -- Check out the book: Batchography - The Art of Batch Files Programming

X:\>REM -- http://lallouslab.net/2016/05/10/batchography/

X:\>REM -- Temp script location: X:\Users\Default\AppData\Local\lallouslab\resetperm.bat

X:\>TITLE taking ownership of folder: C:\*

X:\>takeown /r  /SKIPSL  /f C:\*

 The system cannot find the path specified. ( "C:\BIOS\Polaris BIOS\My Reference AMD Radeon RX 480 4GB\Modded BIOS\Game Stable but Topaz Labs Video Enhance Ai Unstable\1375mhz 1175mv set to 1175mv 1750mhz on 2000 timing strap 185W 185A 0 LSI Offset Adjust original bios dpm pstates offsets to 0 and fan profile 84c temp limit.rom" )

 

X:\>TITLE Taking ownership of folder: C:\*

X:\>icacls C:\* /T  /L  /Q /C /RESET
C:\BIOS\Polaris BIOS\My Reference AMD Radeon RX 480 4GB\Modded BIOS\Game Stable but Topaz Labs Video Enhance Ai Unstable\1375mhz 1175mv set to 1175mv 1750mhz on 2000 timing strap 185W 185A 0 LSI Offset Adjust original bios dpm pstates offsets to 0 and fan profile 84c temp limit.rom: The system cannot find the path specified.

 

With respects to the second set of errors you are getting regarding the .ROM file.  That directory is very long, not to mention that the .ROM file itself has a filename that may be too large to be processed correctly by TakeOwn, or it has an issue with the filename for some reason. I have seen this when when running commands in the past and I fixed it by removing all spaces in the command. I do not think that is the issue here but I am willing to bet that either the directory entered is incorrect or it hates that massive filename. 

 

Word of advice with filenames, short and sweet is best. Do not include descriptions in a filename if you can help it. If you need to add context to the file so you know what it is for or what it does, keep a small notepad file with it that can contain all the file specifics. 

 

With respect to this .ROM file you are trying to take ownership of, are you doing this to the file in its original location or have you tried copying off the drive OUTSIDE of a Windows environment and then tried to correct the permissions? You may have more success with taking it OUT of its original environment and then processing a TakeOwn. you may also find that simply taking out of its current environment resolves the permissions issue, I have seen this before.  

 

I would suggest making a copy of the file and using a Windows Live OS to resolve the permissions issue. Medicat has a Windows Live function which could help. 

 

Lastly, just to check, I assume you do not have a backup of these files ? If you did, it would be easier to restore them than mess around with the "broken" ones.

[Odyn]

You shouldn't use takeown on all of C:\, lots of system files in c:\windows that will break if you take ownership. Instead, just find the directories that make sense to you such as c:\users\username\*.* or c:\FoldersYouShouldntMakeHere\*.* ... 

 

If YOUR permissions are jacked, try to do this recursively by making a new user > adding to admins group > logging in as that user > right click properties on the highest level folder (again, not C:\ ) > permissions > advanced > Adjusting permissions as appropriate > [x] on replace all child object permissions. Once that completes you can just turn it off if you want, but it should fix all files inside that folder to the permissions you specify. 

 

Lastly, you can run cmd as a higher authority (system) if you get the annoying "you do not have permissions to do this" error by doing the following: open cmd as admin > psexec -s -i cmd.exe > check its actually system by doing a /whoami  ... this requires some caution though because you can royally mess things up if you don't know what you're doing.  

 

Good luck. Maybe nows a good time to invest in a backup solution.