Unable to delete file - Windows 10, Permissions Issue? - windows

Question

Details:
Windows 10 Version 1909
Have VS Code installed at C:\Users<UserName>\AppData\Local\Programs\Microsoft VS Code\
Trying to open VS Code fails, trying to run the installer says it can't override code.exe
Security says it cannot display the current owner and clicking "continue" brings me to a message "You do not have permission to view or edit this object's permission settings."
But Powershell shows I am the only one with user and access (and my account is a local admin):
Trying to remove via Powershell seems to give a RemoveFileSSystemItemIOError:
Any ideas or assistance would be greatly appreciated.
Thanks!

Answer 1

I keep this function around to resolve access issues to files or folders that I run across, assuming that I am a member of the local administrator's group.
Code:
Function PWN-Item{
[CmdletBinding()]
Param(
[Parameter(ValueFromPipeline=$True)]
$Path
)
Begin{
If(!$Script:PWNInit){
#P/Invoke'd C# code to enable required privileges to take ownership and make changes when NTFS permissions are lacking
$AdjustTokenPrivileges = #"
using System;
using System.Runtime.InteropServices;
public class TokenManipulator
{
[DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall,
ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen);
[DllImport("kernel32.dll", ExactSpelling = true)]
internal static extern IntPtr GetCurrentProcess();
[DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
internal static extern bool OpenProcessToken(IntPtr h, int acc, ref IntPtr
phtok);
[DllImport("advapi32.dll", SetLastError = true)]
internal static extern bool LookupPrivilegeValue(string host, string name,
ref long pluid);
[StructLayout(LayoutKind.Sequential, Pack = 1)]
internal struct TokPriv1Luid
{
public int Count;
public long Luid;
public int Attr;
}
internal const int SE_PRIVILEGE_DISABLED = 0x00000000;
internal const int SE_PRIVILEGE_ENABLED = 0x00000002;
internal const int TOKEN_QUERY = 0x00000008;
internal const int TOKEN_ADJUST_PRIVILEGES = 0x00000020;
public static bool AddPrivilege(string privilege)
{
try
{
bool retVal;
TokPriv1Luid tp;
IntPtr hproc = GetCurrentProcess();
IntPtr htok = IntPtr.Zero;
retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok);
tp.Count = 1;
tp.Luid = 0;
tp.Attr = SE_PRIVILEGE_ENABLED;
retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid);
retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);
return retVal;
}
catch (Exception ex)
{
throw ex;
}
}
public static bool RemovePrivilege(string privilege)
{
try
{
bool retVal;
TokPriv1Luid tp;
IntPtr hproc = GetCurrentProcess();
IntPtr htok = IntPtr.Zero;
retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok);
tp.Count = 1;
tp.Luid = 0;
tp.Attr = SE_PRIVILEGE_DISABLED;
retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid);
retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);
return retVal;
}
catch (Exception ex)
{
throw ex;
}
}
}
"#
add-type $AdjustTokenPrivileges
#Activate necessary admin privileges to make changes without NTFS perms
[void][TokenManipulator]::AddPrivilege("SeRestorePrivilege") #Necessary to set Owner Permissions
[void][TokenManipulator]::AddPrivilege("SeBackupPrivilege") #Necessary to bypass Traverse Checking
[void][TokenManipulator]::AddPrivilege("SeTakeOwnershipPrivilege") #Necessary to override FilePermissions
$Script:PWNInit = $True
}
#Obtain a copy of the initial ACL
#$FSOACL = Get-ACL $FSO - gives error when run against a folder with no admin perms or ownership
}
Process{
ForEach($Item in $Path){
$FSO = Get-Item $Item
#Create a new ACL object for the sole purpose of defining a new owner, and apply that update to the existing folder's ACL
$NewOwnerACL = If($FSO -is [System.IO.DirectoryInfo]){New-Object System.Security.AccessControl.DirectorySecurity}else{New-Object System.Security.AccessControl.FileSecurity}
#Establish the folder as owned by BUILTIN\Administrators, guaranteeing the following ACL changes can be applied
$Admin = New-Object System.Security.Principal.NTAccount("BUILTIN\Administrators")
$NewOwnerACL.SetOwner($Admin)
#Merge the proposed changes (new owner) into the file/folder's actual ACL
$FSO.SetAccessControl($NewOwnerACL)
#Add full control for administrators
$Rights = [System.Security.AccessControl.FileSystemRights]"FullControl"
$InheritanceFlag = If($FSO -is [System.IO.DirectoryInfo]){[System.Security.AccessControl.InheritanceFlags]"ObjectInherit,ContainerInherit"}else{[System.Security.AccessControl.InheritanceFlags]::None}
$PropagationFlag = [System.Security.AccessControl.PropagationFlags]::None
$objType =[System.Security.AccessControl.AccessControlType]::Allow
$objACE = New-Object System.Security.AccessControl.FileSystemAccessRule($Admin, $Rights, $InheritanceFlag, $PropagationFlag, $objType)
#Get fresh copy of ACL
$objACL = Get-Acl $FSO.FullName
#Clear any DENY rules for the local admin group
$objACL.Access|?{$_.IdentityReference -eq $admin -and $_.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Deny}|%{$objACL.RemoveAccessRule($_)}
#Add Full Control here
$objACL.AddAccessRule($objACE)
#Set updated ACL
Set-Acl $FSO.FullName $objACL
}
}
}
Ok yeah, the function name is cheesy, but beyond that it works really well. It runs some C# code to setup a [TokenManipulator] class (code I picked up on the web, but forgot to record where from. If it's your code please send me a link to the source so I can give you credit!). That allows us to take ownership. Then once we're owners of the file we make sure the local Administrators group has Full Access, and that there's no Deny rules for the local Administrators group. Beyond that you should be able to do whatever you want with the file or folder you run it against.
Usage: Run the code below to load the script into your session. Then you can either pipe strings into it like this:
Get-ChildItem C:\Temp |Select -Expand FullName | PWN-Item
Or you can run it normally against a string or array of strings:
PWN-Item 'C:\Temp','C:\Temp\MyFile.exe'