Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The following "fix" is found on Microsoft's site under KB968003, but it's unclear which operating systems it's for.

The instructions call for you to run the following batch file:

@echo off

subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f 
subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f 
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f 
subinacl /subdirectories %SystemDrive% /grant=administrators=f 
subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=system=f 
subinacl /subkeyreg HKEY_CURRENT_USER /grant=system=f 
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=system=f 
subinacl /subdirectories %SystemDrive% /grant=system=f


But I've read that this was written for Windows XP, and that this script will cause permanent damage to Windows 2008 R2 or Windows 7.

Is there any truth to this? Or will it be OK?

share|improve this question
I believe there was a related script using CACLS which was written for XP and would cause problems on Vista and later. I've read it before too, but unfortunately, I can't find the reference. That seems to be the root of your myth though. – Bigbio2002 Mar 8 '12 at 23:00
@Bigbio2002 Thanks for the explanation! – Django Reinhardt Mar 9 '12 at 15:36
Under "applies to" Windows 7 is explicitly listed. – Harry Johnston Mar 16 '12 at 4:39
up vote 3 down vote accepted

These registry keys are valid for both XP and Windows 7/2008. The commands simply modify the the registry to give administrators and system (a built-in account) full access to the respective keys. The script won't negatively affect your system.

If you're paranoid, you can back up your registry or create a system restore point before making the change. See and

Normally, you should not be getting this error, so I would highly recommend trying to discover the root cause before deciding these changes are needed.

share|improve this answer

No. This script will add an Access Control Entry for the entities specified (Administrators or System) to the locations specified (Registry keys or directories).

It is adding an ACE for "Full Control" which in most cases the specified accounts would already have.

I'm not saying that it will make your system more or less secure, because I would have to look at what the DEFAULT permissions for those locations are. It is possible that the script is adding permissions which are not necessary, which in general is not a great idea.

But granting extra Full Control permissions to the administrators group or system account would almost certainly not "cause permanent damage" to the system.

share|improve this answer
That's good to hear, thanks! – Django Reinhardt Mar 7 '12 at 16:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.