registry editor could not set secuirty in the key currently selected, or some of its subkeys

Randy Madej
Randy Madej used Ask the Experts™
on
I have a Dell Latitude XT2 tablet that I am trying to put Symantec Endpoint Full Disk Encryption on.
After Install and restart I get an error that says " cannot export settings to client database from settings" and " update settings failed please contact administrator".

I contacted Support at Symantec and they said the issue was that I needed to do the following
1.      Right click on HKLM\SOFTWARE\Encryption Anywhere, select Permissions.
2.      Click the Advanced button.
3.      Make sure "Inherit from parent..." and "Replace permission entries..." are checked.
4.      Click the Apply button.
5.      Respond "Yes" to question "This will remove explicitly defined permissions on all child objects..."
6.      Click OK twice.
 When I try to change thie key I get the following error.
registry editor could not set secuirty in the key currently selected, or some of its subkeys

Can anyone help me fix this problem.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Top Expert 2012

Commented:
Try Setacl.exe - you can list permissions and perhaps see if there are some keys that even admins are locked out of.

At the very least you could set permissions on everything else using the "-ignoreerr"  switch.

http://helgeklein.com/setacl/documentation/command-line-version-setacl-exe/

Author

Commented:
I installed setacl.exe  On the interface  I can not find where to set The Replace all child object permissions with inheritable permissions from this object.

I ran this SetACL.exe -on c:\Windows -ot file -actn list from the command line and the run window with no luck.
Top Expert 2012
Commented:
If you need to restore default permissions to the entire OS - you can use the subsystem that does this during an actual workstation build.

Here is the command:

secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose

And here are some more details: http://support.microsoft.com/kb/313222
Learn SQL Server Core 2016

This course will introduce you to SQL Server Core 2016, as well as teach you about SSMS, data tools, installation, server configuration, using Management Studio, and writing and executing queries.

Author

Commented:
The use of “secedit /configure” to import the default security template, dfltbase.inf, is unsupported nor is it a viable method to restore default security permissions on Windows Vista, Windows 7, Windows Server 2008 and Windows Server 2008 R2 computers.

Beginning with Windows Vista, the method to apply the security during operating system setup changed. Specifically, security settings consisted of settings defined in deftbase.inf augmented by settings applied by the operating installation process and server role installation. Because there is no supported process to replay the permissions made by the operating system setup, the use of the “secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose” command line is no longer capable of resetting all security defaults and may even result in the operating system becoming unstable.
Top Expert 2012
Commented:
Sorry about that!  The rest of the article details "icacls /restore" and the other commands required to restore your configuration.

Author

Commented:
Icacls/restore did not work either. I ended up reloading the machine from scratch.

Thank you for trying .

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial