• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 5953
  • Last Modified:

Cannot change permissions in Windows 2008 windows folder (cmd.exe)?

Hi all,
  I have some problems with setting permissions on the file "cmd.exe" (which is required for some php appliction). I can change permissions on any given folder/file without problems, but within the Windows directory all "add", "remove" etc. buttons are disabled.

How do I enable the possibility to alter permissions in the Windows dir?

Many thanks!

1 Solution
Well, the windows folder is a system folder... Why would you need to modify permissions to cmd.exe? Because by default cmd doesn't open with admin privilages in server 2008?
HidDSAuthor Commented:
I need PHP to run an application (FFMPEG), but it refuses / returns no values. The command is good (it works when you run it from the command line), so I figured the webserver (IIS) must have the appropriate rights on the cmd.exe file.

There must be a way to be able to change this permissions? (Turn of some security somewhere?).
Henrik JohanssonSystems engineerCommented:
Look for 'Run as administrator' submenu when right-clicking the folder and choose properties from the admin-submenu.
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

HidDSAuthor Commented:
I can run cmd.exe as administrator, but when pressing properties I still can't add/edit users (groups) or alter rights for the application.
Henrik JohanssonSystems engineerCommented:
What I ment is that it's sometimes a submenu on the context menu when right-clicking the folder for administrative tasks to reach the properties dialog with administrative privileges.
I've seen this behavior with the disabled Add/Remove-buttons before on some of our 2008 servers and the buttons were only accessible through a special administrative properties dialog by using the submenu I described, but I don't remember exactly when/where this occured, but it can be that we've patched the servers to change this functionality as I can't recreate the issue. When displaying Properties now, I have an UAC-button labeled Edit instead of Add/Remove.

If you can't do it through the GUI, do it with the admin command prompt
cacls path-to-file /E /G usergroup:<perm>

When re-reading question, what permissions are you expecting to set on cmd.exe? All users have normally Read, which is necessary to execute the program. Restricting/allowing access to command prompt can be done by modifying the following policy setting
User Configuration\Administrative Templates\System\Prevent access to the command prompt
Had a similar issue with 2008 server.  At first could not click add/modify (greyed out)  Disabled UAC (control panel / users) and rebooted.  Fixed that but could not change (access denied).  Took ownership of cmd.exe from trusted installer and then was able to add IUSR with read/execute.  
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now