TrustedInstaller - Restore as Owner

How to Restore TrustedInstaller as Owner of a File in Vista and Windows 7​

   Information

This will show you how to restore TrustedInstaller back as the owner for a protected system file, folder, drive (usually the C: drive), or registry key that you have Taken Ownership of with your user account.

   Note

There are a few essential protected system resources (system files, folders, and registry keys) that are installed as part of Vista and Windows 7. To help prevent a application and operating system failure, these resources are protected using Windows File Protection (WFP) in such way that applications or users cannot modify these resources by default. The way this protection is implemented is by setting an Access Control List (ACL) on these resources only to allow the TrustedInstaller user to modify them. Not only can a Administrator (elevated or not) account cannot modify them, but neither can the System.

   Warning

• It is best not to Taken Ownership of these protected system resources to prevent them from being changed and less secure. If you do, then be sure to change the Owner of the file back to TrustedInstaller below to secure the file again.
• Not all files are set with TrustedInstaller as the Owner, so do not change random files ownership to this. If you do, your user account will not be able to modify these files until you have Taken Ownership of them again.

Here's How:

1. Right click on the file, folder, drive, or registry key and click on Properties.​

​

2. Click on the Security tab and click on the Advanced button. (See screenshot below)​

​

​

3. Click on the Owner tab and click on the Edit button. (See screenshot below)​

NOTE: If the Current owner is listed as TrustedInstaller, then you can stop here. The file's owner is already set as TrustedInstaller.​

​

​

4. If prompted by UAC, then click on Continue (Vista) or on Yes (Windows 7).​

​

5. Click on the Other users or groups button. (See screenshot below)​

​

​

6. Type in the object name of NT SERVICE\TrustedInstaller and click on the Check Names button. (See screenshot below)​

​

​

7. Click on OK. (See screenshot below)​

​

​

8. Click on TrustedInstaller to highlight it. (See screenshot below step 9)​

NOTE: If you also wanted to change the owner for all subfolders and files to, then check the Replace owner on subcontainers and objects box. Leave this unchecked for a drive. This option will not be here if you are doing this for a just a file from step 1.​

​

9. Click on OK. (See screenshot below)​

​

​

10. Click on OK for the window that just popped up. (See screenshot below)​

​

​

11. Click on OK. (See screenshot below)​

NOTE: Notice that the Current owner is now TrustedInstaller again.​

​

​

12. Click on OK. (See screenshot below)​

NOTE: If you had taken ownership of this item, then you may also want to change the permission level back to the default Allow settings first for the account that you took ownership with to prevent changes to this item again.​

​

​

That's it,
Shawn

Related Tutorials

---

• How to Add Take Ownership to the Context Menu in Vista
• How to Take Ownership of a Item in Vista
• How to Perform a Repair Installation for Vista
• How to Repair and Verify the Integrity of Vista System Files with System File Checker
• How to Do a System Restore in Vista
• How to Allow or Deny Permissions to Users and Groups

 

[Feroc1ty]

Hi Brink. Thanks for the guide, got TrustedInstaller back as owner, but now i got another problem. I cant install or uninstall programs. I tried uninstalling norton nd just as it starts uninstalling, it then begins with error reporting, i cant even do updates on norton now. Installed new ATI drivers as well and i cant open the control center anymore.

I ran SFC (thanks for that as well) and it says everything is fine.

What can i do? I cant restore because the point before all this went down isn't in the list anymore, unless there's another way? Would a startup repair actually help, seeing as the SFC scan says all is ok? Or is the only option now a clean install? (I hav a OEM Recovery Install disk)

Thanks
Calvin

 

[Brink]

Hi Calvin,

Welcome to Vista Forums.

If it is just Norton that you are having problems with, then try the Norton Removal Tool to clean up the remnants.

Download and run the Norton Removal Tool


If that does not help, then you can try doing a Repair install to see if it can fix the problems before having to do a clean install again.

http://www.vistax64.com/tutorials/88236-repair-install-vista.html

Hope this helps,
Shawn

 

[Feroc1ty]

Hi Shawn

Thanks for the help. Unfortunately had to do a clean install
Oh well at least everything is running again, no problems yet nd hopefully never will have. Fingers crossed!

And once again thanks for all the tutorials posted on the site. Your help is invaluable!

Regards,
Calvin

 

[Brink]

Sorry to hear you had to do a clean install Calvin, but I'm happy everything is running smooth for you now.

Shawn

 

[sbw07]

Hi, I added a context menu item for folders to "open command window here (administrator). Somehow it the command got replaced with a take ownership command. I realized this when I right-clicked on the System32 folder in C:\Windows and selected the admin command button but a command window opened up and started taking ownership of the folder and all its contents. I stopped it as soon as I realized what was happening but now I don't know which files were under which ownership originally.

Is it safe to simply make TrustedInstaller the owner of System32 and all its subcontainers and objects?

 

[Brink]

Hi sbw07,

Most of everything in and including the System32 folder has TrustedInstaller as the owner. There are a few a items that should be owned by System and your administrator account instead, but there is just to many items to go through them all. You should be ok setting everything to TrustedInstaller though since the permission levels will still allow the others access.

Hope this helps,
Shawn

 

[sbw07]

Thanks,
If there are any files that belong under different ownership that are particularly important, that you can list offhand, I would be very grateful.

 

[Brink]

Your welcome, but I do not have any offhand. There were just too many files in that folder. You should be fine though since the permission levels will still be there for the other owners for access.

 

[naiem08]

Please help me...
Actually, I have changed imageres.dll to imageres.old and now I want to change back to imageres.dll but I can't do that because when I clicked at "edit" under Owner tab, the message displayed "Can't open access control editor.(null)".

So,i hope that you can solve my problem immediately because after I change imageres.dll to imageres.old my control panel and my personalized cannot be opened.
I changed that thing coz I want turn to the new theme but eventually this happened to me.
(sorry for my bad English)

 

[Brink]

Hello Naiem, and welcome to Vista Forums.

Since you just did this, see if doing a System Restore with a restore point dated before this can fix this system file for you.

Hope this helps,
Shawn

 

[dtureaud]

TrustedInstaller is not listed when I try to add it to the list of users with rights on mofd.dll and audiodev.dll. sfc had identified these files as being corrupted so I copied them off my vista cd. My vista cd is no service pack, but I have sp2 installed on my pc.

 

[Brink]

Hello Dtureaud,

TrustedInstall will not be listed in the "Group or user name" area unless you have added it exactly as in the tutorial to change the owner of the file to TrustedInstaller instead. By default, it has full permission and access anyways.

Hope this helps,
Shawn

 

[dtureaud]

Its not listed as an option in the take ownership box either. I had to take ownership with the admin group of audiosrv.dll and mofd.dll so I could replace them with fresh copies from the vista cd. however when i copied them the trustedinstaller had no rights. after a restart audiosrv.dll just magically created a trusted installer entry and transferred ownership, but mofd.dll still isnt right. just for some background I had a tidserv!inf virus. I got rid of it but it knocked out my dhcp service. tdx.sys was being identified as the source of the virus so it got deleted, as well as all reg entries that referenced the file. i also am having the trusted installer issue with tdx.dll. my dhcp is back up but tdx is no longer listed as a dependancy and I am unable to view any network shares.

 

[Brink]

Dtureaud,

Since this is a system file, you might see if running a sfc /scannow command may be able to help. If not, here's a clean copy of the C:\Windows\System32\drivers\tdx.sys file from my Vista 32-bit system that you can use to help.

 

[dtureaud]

the problem seems to be related to the fact that tdx is no longer listed as a dependancy for dhcp. I need the reg entries related to tdx also

 

[Brink]

Have already tried doing a System Restore with a restore point dated before this to see if it can fix this system file for you?

 

[dtureaud]

Have already tried doing a System Restore with a restore point dated before this to see if it can fix this system file for you?

I got sick of viruses that infected my restore points so I turned them off. sfc /scannow is telling me that audiodev.dll and mofd.dll have been corrupted and the copies in the store have also been corrupted. I extracted new copies from my cd but my cd is no sp and I have sp2 installed on my machine. Id like to reinstall sp2 but it detects that sp2 is installed and wont go. Is there a way to either skip the sp version detection at the begining of the sp2 install or trick it into detecting a previous service pack?

 

[Brink]

I hate to say it, but it may be best to do a clean reinstall of Vista.