Just Widgets Blog

I use the version of Windows that came with my computer (XP Home) since I’ve never had a deal-breaker reason to upgrade to XP Professional. When I want to run something that requires XP Professional, like Oracle, so far I’ve been able to install the software on Linux instead. I also like run Windows most of the time under a Limited User Account (LUA). This brings me to the (artificial) limitation of XP Home that I find most annoying; there is no security tab to make changing file privileges possible. The only way to access the security tab is by rebooting into safe mode and logging on as Administrator (yes that’s the user named “Administrator” built into XP Home, not any user account with administrator privileges). So if I happen to create a file when I’m logged in as an admin, I then can’t access it as a LUA or if I can open the file, then usually the LUA account is limited to read-only access. The ’round-about work-around to get full access is to create a new file with a similar name under the LUA account, then use “runas” from the command line or the “Switch User” ability to login as an admin and paste the file’s contents into the LUA’s file. This is a tedious work-around, especially if you have a whole sets of files to convert. Another work around is to connect my USB hard drive, with its FAT32 file system, which doesn’t support Windows XP’s privileges. So a quick copy back and forth will remove any notion of ownership. Well, I stumbled upon a third, more efficient method which is especially quick for changing privileges on whole groups of files. The key is SubInAcl, a free command line tool available for download from Microsoft. If you open an Administrator-privileged cmd window using runas then SubInAcl becomes the non-GUI version of the Security tab (or, for the Linux/*nix-minded, the Windows equivalent of chown / chgrp / chmod all rolled into one). Typing subinacl /help gives you an appreciation for the complexity of the Windows ACL - this is not a simple user / group / world environment. I’m not sure I’m using it in “best practices” fashion (I have very little understanding of ACL - so use at your own risk!), but the following command changed ownership of a file to my LUA account (the LUA ’s username = lua_user in this example and F stands for full-access):

subinacl /file somefile.txt /grant=lua_user=F

I wonder if there would be a way to interface this tool with somekind of shell-extension like thing that could replicate the security tab for XP Home?