icalcs help Utilman

[linkazoid]

Hi,

 

We have previously configured permissions to deny access to utilman.exe to stop kids changing the Ease Of Access settings on the logon screen.

 

Now we have some SEN children that need access, but trying to revert the permissions using GPP and GPO is not working.

 

The file has no owner and the permissions are set to deny. Can someone knock up an icalcs script that will set the following.

 

Owner - Administrator

SYSTEM - Read and Execute

Administrators - Read and Execute

Domain Users - Read and Execute

NT Service\Trusted Installer - Read and Execute

 

So that they can be set back to original permissions.

 

Thanks,

 

Michael

[linkazoid]

Just in case anyone needs this for themselves. This seems to work.

 

takeown /f "C:\Windows\System32\utilman.exe"

 

icacls "C:\Windows\System32\utilman.exe" /remove:d SYSTEM

icacls "C:\Windows\System32\utilman.exe" /remove:d Administrators

icacls "C:\Windows\System32\utilman.exe" /remove:d "Domain Users"

icacls "C:\Windows\System32\utilman.exe" /remove:d Users

icacls "C:\Windows\System32\utilman.exe" /remove:d "NT Service\TrustedInstaller"

icacls "C:\Windows\System32\utilman.exe" /remove:d "ALL_APP_PACKAGES"

icacls "C:\Windows\System32\utilman.exe" /grant SYSTEM:RX /q

icacls "C:\Windows\System32\utilman.exe" /grant Administrators:RX /q

icacls "C:\Windows\System32\utilman.exe" /grant "Domain Users":RX /q

icacls "C:\Windows\System32\utilman.exe" /grant "NT Service\TrustedInstaller":RX /q

[mrwoberts]

This works for me, but I also like yours, thanks.

 

To block

    takeown /f C:\Windows\System32\Utilman.exe /A
   icacls     C:\Windows\System32\Utilman.exe /deny Everyone:RX

 

To revert

    icacls     C:\Windows\System32\Utilman.exe /grant Everyone:RX

Edited September 18, 2015 by mrwoberts