ANSWERED Netsh.exe not allowed

[gtrman 0]

Hello,

I saw there were no servers in the old 2.16.3 portable version I was using. Downloaded the latest 2.26.2 for Win10 portable and whenever I try to launch it, it throws "Exception: Executable 'netsh.exe' not allowed". I've tried running as admin, sfc /scannow,  DISM /Online /Cleanup-Image /RestoreHealth, scanning for viruses using Windows Defender and Malware bytes, reverting all O&O10 ShutUp10 settings, checking for any services I might have disabled, using the Windows installer version instead of portable. I'm not entirely sure what could be the problem.

[Staff 10673]

@gtrman

Hello!

Thank you for the detailed list of checks. The error comes from a security check in Eddie, not from netsh.exe itself. Eddie runs netsh.exe and other Windows tools with administrator privileges, so before running them it verifies that neither the executable nor its folder can be modified by an account other than SYSTEM, Administrators or TrustedInstaller. Otherwise a non-administrator could replace the tool and have it run with elevated privileges.

The empty text after "not allowed:" in your screenshot indicates that netsh.exe itself passed the check, but its folder, C:\Windows\System32, did not: some other account is allowed to create files in it. This is not the default Windows configuration. It is usually left behind by a "take ownership" or "grant full access" tweak or tool applied to system folders in the past. This also explains why sfc, DISM and reinstalling Eddie, portable or installer, did not help: they do not reset the permissions of the System32 folder.

To confirm, please open a Command Prompt and run the following command. It only displays the permissions and does not change anything:
 

icacls "%SystemRoot%\System32"

Then post the output here. If you prefer, you can replace your computer name and user name with placeholders, but please leave the rest unchanged. On a default installation only NT SERVICE\TrustedInstaller, NT AUTHORITY\SYSTEM and BUILTIN\Administrators can write to that folder. An additional entry with (F), (M), (W) or (WD) for your user account, Users, Authenticated Users or Everyone is the likely cause.

Please do not take ownership of System32 or change its permissions recursively in the meantime. Once we see the output, we will tell you how to remove only the extra entry.

Kind regards
 

[gtrman 0]

Thank you for taking a look at this. Please see the output below:
 

Quote

C:\Users\gtrman>icacls "%SystemRoot%\System32"
C:\Windows\System32 APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(F)
                    APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(RX)
                    CREATOR OWNER:(OI)(CI)(IO)(F)
                    NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
                    NT AUTHORITY\SYSTEM:(M)
                    BUILTIN\Administrators:(OI)(CI)(F)
                    BUILTIN\Users:(OI)(CI)(RX)
                    NT SERVICE\TrustedInstaller:(CI)(F)

Successfully processed 1 files; Failed processing 0 files

Your explanation reminded me that I did take ownership of wuauclt.exe and wuaueng.dll (I was getting tired of windows auto updating without my say so; so I ended up crippling it until I felt ready to receive updates when other methods to stop it failed).
Now that Windows 10 is in end of life/extended service, I'd be comfortable reverting back to 'defaults'. I've resorted to the exported OpenVPN settings as a work around, but would like to continue using Eddie if possible. Eventually I'll move to Linux, as I refuse to use Windows 11.

[Staff 10673]

@gtrman

Hello!

Thank you, the output confirms the cause. This is the entry that blocks Eddie:
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(F)
It gives Full control of System32 to every Store (UWP) app on the system. On a default installation this group can only read and execute files in System32. The other entries do not need to be changed for Eddie.

Please open a Command Prompt as administrator (right-click Command Prompt, then "Run as administrator") and run the following commands.
1. Save a backup of the current permissions of the folder:

icacls "%SystemRoot%\System32" /save "%USERPROFILE%\system32-acl-backup.txt"

2. Replace the Full control entry with the default read and execute permission:

icacls "%SystemRoot%\System32" /grant:r "*S-1-15-2-1:(OI)(CI)(RX)"

S-1-15-2-1 is the fixed identifier of ALL APPLICATION PACKAGES, so the command works with any Windows language. Please do not simply remove the entry: Store apps, including parts of the Start menu and Settings, need read access to System32. Windows also applies the change to the files and subfolders that inherit from System32, so the command may take a minute. Wait until it reports "Successfully processed 1 files".

3. Run

icacls "%SystemRoot%\System32"

again. The ALL APPLICATION PACKAGES line should now end with (OI)(CI)(RX). Then start Eddie.

If Eddie still shows the same error, please open system32-acl-backup.txt in your user folder with Notepad and post its content here. It is a single line that shows the exact permission values, which the normal icacls output does not show. If you ever need to undo the change, this command restores the saved permissions:

icacls "%SystemRoot%" /restore "%USERPROFILE%\system32-acl-backup.txt"

Eddie does not check wuauclt.exe and wuaueng.dll, so the ownership change on those two files is not related to this error. And when you move to Linux, Eddie is available there as well.

Kind regards
 

[gtrman 0]

Unfortunately setting the permissions did not work; Eddie threw the same error. Please see the requested exported acl backup permissions below:

Quote

System32
D:PAI(A;OICI;FA;;;AC)(A;OICI;0x1200a9;;;S-1-15-2-2)(A;OICIIO;FA;;;CO)(A;OICIIO;FA;;;SY)(A;;0x1301bf;;;SY)(A;OICI;FA;;;BA)(A;OICI;0x1200a9;;;BU)(A;CI;FA;;;S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464)
 

[Staff 10673]

@gtrman

Hello!

Thank you, the backup file shows the remaining cause. The backup was saved before step 2, so it still shows the old ALL APPLICATION PACKAGES entry (AC) with FA; that is expected.
The second entry that blocks Eddie is this one:
(A;OICIIO;FA;;;CO)

It is the CREATOR OWNER entry, which the normal icacls output shows as CREATOR OWNER:(OI)(CI)(IO)(F). On a default installation it is stored as (A;OICIIO;GA;;;CO). GA (generic all) and FA (explicit full access) grant the same permissions in practice, but Eddie's check reads the stored value as it is: it accepts GA and rejects FA. Because icacls displays both as (F), the difference was not visible in the first output. This entry does not give anyone access to System32 itself, only to files created there later, and only for their owner. Eddie's check does not make this distinction yet, and we will report it to the developers.

Please open a Command Prompt as administrator again and run the following commands.
1. Save a backup of the current permissions:

icacls "%SystemRoot%\System32" /save "%USERPROFILE%\system32-acl-backup2.txt"

2. Store the CREATOR OWNER entry in its default form:

icacls "%SystemRoot%\System32" /grant:r "*S-1-3-0:(OI)(CI)(IO)(GA)"

S-1-3-0 is the fixed identifier of CREATOR OWNER, so the command works with any Windows language. As before, it may take a minute; wait until it reports "Successfully processed 1 files".

3. Save the new permissions to a second file, to check them:Open

icacls "%SystemRoot%\System32" /save "%USERPROFILE%\system32-acl-check.txt"

system32-acl-check.txt with your favorite text editor. It should contain (A;OICIIO;GA;;;CO) and (A;OICI;0x1200a9;;;AC), and no entry ending with FA;;;CO or FA;;;AC.

Then start Eddie. If it still shows the same error, please post the content of system32-acl-check.txt here.

To undo only today's change, you can run:

icacls "%SystemRoot%" /restore "%USERPROFILE%\system32-acl-backup2.txt"

Kind regards
 

[gtrman 0]

Thank you for the assistance. I ended up having to run both of the mentioned commands to get Eddie to work:

icacls "%SystemRoot%\System32" /grant:r "*S-1-15-2-1:(OI)(CI)(RX)"

and

icacls "%SystemRoot%\System32" /grant:r "*S-1-3-0:(OI)(CI)(IO)(GA)"