StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>So I found one of my problem.</p> <p>When you want to take ownership on a resource you add to enable the <strong>SeTakeOwnershipPrivilege</strong> this allow you to change the owner SID. But the new Owner Sid must be in the caller’s token, plus, that Sid must have attribute SE_GROUP_OWNER. So in my case I was not able to change back SID owner to <em>S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464</em> (TrustedInstaller). I was just able to take ownership, or to give ownership to the group "Administrators". I discover that there is a king of work-around whereby you can assign any arbitrary user as the owner, even if its SID is not in the token. <strong>SeRestorePrivilege</strong> privilege that is <em>granted</em> to administrators and backup operators, but NOT <em>enabled</em> by default. Enbling it allow me to give back ownership to TrustedInstaller.</p> <p>So it works doing the following (user is member of administrator group):</p> <ol> <li>I give the user the privilege to take ownership and <strong>enable the privilege of restore</strong></li> <li>The user take ownership </li> <li>The user write the registry </li> <li>the user give ownership to the previous owner TrustedInstaller.</li> </ol> <p>I use InteropServices to call Win32 AdjustTokenPrivileges API, and it seems to be the only way to do it in C#</p> <p>I will soon post on my blog a small tool that allow to give back ownership to TrustedInstaller.</p> <hr> <p>Edited : Sorry for the delay I just forget it, you can find the code on <a href="https://gist.github.com/JPBlanc/ca0e4f1830e4ca18a526#file-write_a_registry_own_by_trustedinstaller-cs" rel="nofollow">Gist</a>.</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload