Yesterday I followed a thread trying to learn to lock file folders using the cacls in the command window. I thought I'd use the temp file folder as my target, thinking that it was the most innocent folder I had. I was able to lock it, but now I can't unlock it.

Here is the code that I used to lock it:
cacls %temp% /G %username%:R

it asked me: Are you sure <Y/N> I replied Y, and it returned "processed dir: C:\DPCUME~1\HASLAM~4.AFT\LOCALS~1\Temp

I could confirm that I was unable to save anything to the temp folder. So I then wanted to unlock the folder. I used the following code:

cacls %temp% /E /T /C /G %username%:F .nul

It returns : Access is denied.

If I use the exact path to the filename instead of %temp%, I get:
The trust relationship between this workstation and the primary domain failed.

I can't download files: tells me I don't have permissions
I can't save word documents: tells me I don't have permissions
I can't read Eudora email: tells me it can't access the temp folder

I am stuck. Any thoughts on the steps I need to follow to get this working? Would a system restore take me back to how I was before?

Thanks.

First - a workaround. Change your TEMP envirionment variable so you can function..
Right-click My Computer and click Properties, select Advanced, click Environment Variables button and edit the TEMP variable to C:\TEMP. Create C:\TEMP if it doesn't already exist. Log off and back on. You should now have an accessible Temp folder.

Next, after logging in as an administrator (local or domain), browse to the affected Temp folder in Windows Explorer. From Properties on that folder, select Security, click Advanced, select the Owner tab, select Administrators, check the "Replace owner on subcontainers" box, and click Apply. You can then select the Permissions tab and grant Administrators full-control, and Users-Modify access.

Log off and back on as yourself - you should be able to CD to the old temp folder and create/delete files. Restore your original TEMP variable definition if you can access the personal temp location.

NEVER play with CACLS using only the /G option, as that will remove all System access and permit only the account(s) you specify, requiring the steps above to be performed as an admin to recover access. IF you want to experiment with CACLS, use /E to edit the permissions and grant specific access to a different account. You can use runas to open a command window with alternate credentials and test access rights with little or no ill effects.

Glenn

Thanks Glenn, your suggestions did the trick. Thank you so much!

Thanks! Good to hear it helped!

G-