📎 AI Summary:
The thread is about “locking down” access to system executables on a Windows 7 Pro VM (e.g., `C:\Windows\System32\cmd.exe`) by removing the Users/Owner permissions, but then finding that the files can’t be executed even when Administrators ostensibly have full control. The key question is why execution fails with an “appropriate permissions” error despite granting Administrators full rights, and what permissions/groups must remain for Windows/service account access to function (notably interactive logon and related system mechanisms). Overall sentiment is troubleshooting-focused and practical: contributors discuss the likely role of required security entries and inherited/extra permissions rather than simply adding/removing Users.

w1r3d

New Member
Member details
Joined
Jun 12, 2012
Messages
2
Thread Author #1
Hi all!


I'm having a problem with a Windows 7 Professional VM.


I'm trying to "lock down" the permissions of some files (cmd.exe, ftp.exe, etc)


For example, I modify the permissions for C:\Windows\System32\cmd.exe so that only SYSTEM and Administrators have full access. I removed Users, Owner, etc from the list.


Then, if I try to run cmd.exe, I get this message: "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item."




Which is confusing, to say the least. I gave the Administrators group (of which I'm a part of) full access: read, write, execute, etc yet I still can't run the executable. I tried adding other groups such as Users and INTERACTIVE, and THEN it works. However, that defeats the purpose, because then anyone can access the file, which I don't want.




If anyone can shed some light on this issue, I'd greatly appreciate it.




Thanks!
Pedro