Winobj perms problem

Question

Could use some help with this please. Long story short I have serious perms issues happening. I'm using winobj to root out (pun intended) the remaining pieces to a big mess.

Found what I was looking for but get errors when trying to open the objects (can't open properties in registry either); cannot open this object type, and access is denied.

Any help on getting those perms fixed would be greatly appreciated.

Win10 21h2: everything updated: local admin on the pc: i have already run calcs, secedit, some manual witchcraft.

Answer 1

Hello @Mitigating the Damage

Being a client machine, the general recommendation when a "mess" happened with permissions, would be to re-image the computer. NTFS Permissions are very delicate when it comes to system, as even performing a takeover may break the ownership and permissions of certain system files or services.

All in all, I would see if the computer has restore points that can be used to timetravel to a moment without issues, but I would not put too much hopes.

Hope this helps with your query,

---------
--If the reply is helpful, please Upvote and Accept as answer--

Answer 2

Yeah. Not what I was hoping to hear. But it is what it is. The issue made sure that there's no restore points. Was hoping to avoid doing a flatten and rebuild. Theres about 2 days worth of installing forensic suites and tuning av so it doesn't kill everything