윈도우 파일 권한 바꾸기 주인 icacls takeown 권한 차단

[동우]

https://joelweon.github.io/2019/01/29/windows_auth.html

https://docs.microsoft.com/ko-kr/windows/security/identity-protection/access-control/security-identifiers  S- 아이디

https://renenyffenegger.ch/notes/Windows/security/SID/index  S- 아이디

https://adamtheautomator.com/icacls/

https://docs.microsoft.com/ko-kr/windows-server/administration/windows-commands/icacls

F는 파일 (F)는 폴더 F는 모든 권한

takeown /F "%windir%\ImmersiveControlPanel\SystemSettings.exe" /A

(기본 사용자가 모든 권한을 상속 받음 시스템 프로세스는 TrustedInstaller 애가 주인이기 때문에 어쩔수 없음)

icacls "%windir%\ImmersiveControlPanel\SystemSettings.exe" /grant Administrators:F

(사용자가 쓰기외 모든 권한을 가지게 함)

icacls "%windir%\ImmersiveControlPanel\SystemSettings.exe" /deny Guest:F
icacls "%windir%\ImmersiveControlPanel\SystemSettings.exe" /deny *S-1-5-32-546:F

(차단 하고 싶은 놈을 등록함)

icacls "%windir%\ImmersiveControlPanel\SystemSettings.exe" /setowner "NT SERVICE\TrustedInstaller" 

(다시 예전 주인으로 돌려줌)

icacls "%windir%\ImmersiveControlPanel\SystemSettings.exe" /grant:r Administrators:RX

(다시 기본값으로 돌려 놓음 읽기 실행)

https://superuser.com/questions/890310/restoring-trustedinstaller-as-owner-for-executable-in-windows-folder   

권한을 정상으로 돌리기 

icacls "%windir%\ImmersiveControlPanel\SystemSettings.exe" /t /q /c /reset

리셋 명령어가 있지만 상속 권한은 리셋 되지 않아서 명령어로 돌려야 한다.

기타

"%windir%System32\CredentialEnrollmentManager.exe"

백업

icacls "%windir%\ImmersiveControlPanel\*" /save "d:\test.txt" /t

웃긴건 파일 하나는 백업이 됨 하지만 복구가 안됨 -_-;; 개발자의 함정이냐? ㅋ

복구
icacls "%windir%\ImmersiveControlPanel" /restore "d:\test.txt"

복구가 안된다  권한을 얻어야 하나봄. 결론

추천 하지 않음 

결론은 편법으로 백업 해서 그냥 해제 해야 할듯 하다 

tar -cvzf SystemSettings.zip "%windir%\ImmersiveControlPanel\SystemSettings.exe"

해당 파일 삭제 하고 무식하게 복구 하기 

tar -zxvf SystemSettings.zip -C "%windir%\ImmersiveControlPanel\"

달리 방법이 없는듯

https://superuser.com/questions/364083/windows-list-files-and-their-permissions-access-in-command-line

icacls C:\Users > d:\test\txt.txt

권한 보기

볼륨에 문제가 생겨서 해봤는대 잘 안된다 

https://howthere.org/ko/%ED%95%B4%EA%B2%B0-%EB%B0%A9%EB%B2%95-c%EC%8B%9C%EC%8A%A4%ED%85%9C-%EB%B3%BC%EB%A5%A8-%EC%A0%95%EB%B3%B4%EC%97%90-%EC%95%A1%EC%84%B8%EC%8A%A4%ED%95%A0-%EC%88%98-%EC%97%86%EC%8A%B5%EB%8B%88%EB%8B%A4

https://outsourcepath.com/resource/disk-full-due-to-large-system-volume-information-folder-on-windows

takeown /f "d:\System Volume information"
icacls "d:\System Volume Information" /grant Administrators:F
icacls "d:\System Volume Information" /setowner "NT Authority\System"
icacls "d:\System Volume Information" /remove Administrators

takeown /F "D:\System Volume Information" /A
icacls "D:\System Volume Information" /grant Administrators:F
icacls "D:\System Volume Information" /t /q /c /reset
icacls "D:\System Volume Information" /setowner "NT SERVICE\TrustedInstaller"


icacls "D:\System Volume Information" /remove Users /t
icacls "D:\System Volume Information" /remove "Authenticated Users" /t
icacls "D:\System Volume Information" /remove Administrators /t
잘 안된다 ㅎㅎ

icacls "D:\System Volume Information" /remove *S-숫자 /t

S-숫자의 경우 앞에 *를 붙쳐야 한다.

S-1-0-0 Everyone 익명 사용자

S-1-1-0 모든 사용자 

-_- 이건 너무 했다 ㅋㅋ 좀 다르게 하지 숫자 하나 잘못 찍으면 큰일남 

https://stackoverflow.com/questions/34382523/deny-all-folders-permission-from-all-users-administrators-via-cmd-batch-in-windo  

rem /inheritance:r - Remove all inherited entries
rem /deny - Set denial of permissions
rem (OI) - "Object inherit" - Also applies to files within the folder
rem (CI) - "Container inherit" - Also applies to subfolders
rem (F) - "Full control"
icacls /inheritance:r /deny "Everyone:(OI)(CI)(F)" "ANONYMOUS LOGON:(OI)(CI)(F)"
모든 사용자 거부 익명 거무 
icacls /inheritance:r /deny "*S-1-1-0:(OI)(CI)(F)" "*S-1-5-7:(OI)(CI)(F)"

icacls "%windir%\System32\mstsc.exe" /inheritance:r /deny "*S-1-1-0:(OI)(CI)(F)" "*S-1-5-7:(OI)(CI)(F)"

echo 차단 등록 하기 

icacls "%windir%\ImmersiveControlPanel\SystemSettings.exe" 
takeown /F "%windir%\ImmersiveControlPanel\SystemSettings.exe" /A
icacls "%windir%\ImmersiveControlPanel\SystemSettings.exe" /grant Administrators:F
icacls "%windir%\ImmersiveControlPanel\SystemSettings.exe" /deny "Guest:F" "*S-1-5-32-546:F" "*S-1-0-0:F" "*S-1-5-7:F"
icacls "%windir%\ImmersiveControlPanel\SystemSettings.exe" /setowner "NT SERVICE\TrustedInstaller" 
icacls "%windir%\ImmersiveControlPanel\SystemSettings.exe" /grant:r Administrators:RX

echo 차단한 애들 삭제 하기 
icacls "%windir%\ImmersiveControlPanel\SystemSettings.exe" 
takeown /F "%windir%\ImmersiveControlPanel\SystemSettings.exe" /A
icacls "%windir%\ImmersiveControlPanel\SystemSettings.exe" /grant Administrators:F
icacls "%windir%\ImmersiveControlPanel\SystemSettings.exe" /remove "Guest" "*S-1-5-32-546" "*S-1-0-0" "*S-1-5-7"
icacls "%windir%\ImmersiveControlPanel\SystemSettings.exe" /setowner "NT SERVICE\TrustedInstaller" 
icacls "%windir%\ImmersiveControlPanel\SystemSettings.exe" /grant:r Administrators:RX

[동우]

icacls "%windir%\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys" /setowner "NT SERVICE\TrustedInstaller"
icacls "%windir%\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys" /setintegritylevel H

[동우]

BUILTIN\Guests

icacls "%windir%\system32\fontdrvhost.exe"
takeown /F "%windir%\system32\fontdrvhost.exe" /A
icacls "%windir%\system32\fontdrvhost.exe" /grant Administrators:F
icacls "%windir%\system32\fontdrvhost.exe" /setintegritylevel H
icacls "%windir%\system32\fontdrvhost.exe" /setowner "NT SERVICE\TrustedInstaller"
icacls "%windir%\system32\fontdrvhost.exe" /grant:r Administrators:RX

[동우]

icacls "%windir%\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys" /setowner "NT SERVICE\TrustedInstaller"

takeown /F "%windir%\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys" /A
icacls "%windir%\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys" /setintegritylevel H
icacls "%windir%\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys" /setintegritylevel M

[동우]

icacls "C:\Users\사용자폴더\AppData\Roaming\Microsoft\Crypto\Keys" /setowner "NT SERVICE\TrustedInstaller"
icacls "C:\Users\사용자폴더\AppData\Roaming\Microsoft\Crypto\Keys" /setintegritylevel H

[동우]

https://docs.microsoft.com/ko-kr/windows/security/threat-protection/auditing/event-4648
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4624