Windows 10: How to add "SELF" as a group or user when assigning permissions

I'm trying to add "SELF" to the group of "users & groups" that need Launch and Activation Permission for the DCOM app named RuntimeBroker.
If I click on the "Add" button, "SELF" is not listed as either a Group or user.
So, I'm thinking maybe I need to enter it with a certain syntax.

Would anyone know what that syntax might be ?

To see an example of the dialog I'm using ....
Right click on a folder.
Choose properties.
Click on the Security tab.
Click on the Edit button.
Now, click on Add.


IE:
TrustedInstaller needs to be entered as "NT SERVICE\TrustedInstaller".
Cuz if you search for just plain "TrustedInstaller" among the available users or groups, it's not listed.

Thanks

:)

 

Unable to Change Permissions to a Shared Folder

Windows 10 allows us to redirect the 4 primary shared data folders to something other than C:. Nice change! I have created folder for Documents, Pictures, Videos and Music on my D: drive and all had been working well until just this week when I noticed
I can no longer add a folder to my Pictures folder. The other 3 are working fine and unlike the "Pictures" folder, have 4 groups assigned permissions on the folder's Security tab. Clicking on the "Edit" button (to change permissions), I am able to Add and
Remove users and groups assigned to the folder. The Pictures folder however has a single user and the Add and Remove buttons are greyed out. I cannot make any changes to the folder's user's or group's, or the one group's permissions. All actions to the
folder require administrative rights which I don't seem to be able to use to add a folder. Any ideas on how to make the changes I need?

 

How to add the group "SELF" to an object so I can assign permissions to it

I need to add the group or account SELF to an object, so that I can assign permissions to it.

When adding an account ......

I click on the Security tab which shows me a list of groups or user names that already have permission to access the object.

I click on the "Add" button, the "Select Users or Groups" dialog appears.

But if I search for SELF, I am unable to find it.

As an example.

Using the above, If I want to add the user "TrustedInstaller" to an object, I would need to enter "NT SERVICE\TrustedInstaller" into the "Enter the object names to select" box, because "TrustedInstaller" can't be found either.

If I want to add "SELF", what would be the syntax ?

 

Is SELF the actual name of a user account on the computer? For example, when you log in to Windows, and it asks for a user name and password, do you enter SELF for the user name? You can only add permissions for actual user accounts on the computer. If you need to assign permissions for SELF, then you need to create a new user account with the account name of SELF.

Keep in mind, if you do create the user SELF on the computer - when you are logged into your existing account now, you won't have the same permissions because you will be logged in as Bob, John, Joe, whatever....and not SELF.

 

Hi @JustRay, try this: "NT AUTHORITY\SELF".

 

SELF or Principle Self is....

https://technet.microsoft.com/en-us/..._PrincipalSelf

Are you on a Domain? As far as I know, SELF is only seen in Active Directory, it's not a local user or group. It was first seen in Windows 2000, which introduced Active Directory Domain Services.

https://msdn.microsoft.com/en-us/lib...(v=vs.85).aspx

 

Not necessarily.

 

Hey muchomurka (and everyone else.)
Thanks for the replies.

I tried "NT AUTHORITY\SELF", and that didn't work.
Although, I have the feeling (can't prove it though), it is something very close to that.

AND
The attachment (167658) shows EXACTLY what I am trying to add.

The RuntimeBroker Access Permissions has "SELF" as one of the users and groups assigned to it.

The Launch and Activate Permissions "used" to have "SELF" associated with it, until, as a result of some troubleshooting I was doing, I clicked on the "Use Default" followed by the "Apply" buttons.

Now after clicking on the Launch and Activation Permissions "Customize" button, it doesn't appear any longer by default and I can't figure out how to add "SELF" back.


BTW, my laptop is Windows 10 X64 home edition 1709 16299.98 with all available updates applied.
Neither SFC nor DISM expose any issues.
I run both Malwarebytes professional and Windows defender and neither identify malware or viruses.
So, methinks my laptop is reasonably healthy.

Any other suggestions would be most welcome. *Smile

 

Oops.
I forgot to rely that I'm not in a Domain.
I'm in a work group with one other pc.

 

Does this help? Seems to be using powershell commands....

https://social.technet.microsoft.com...svradminlegacy

 

Hi JustRay, try this method, it works on my testing virtual system.

- find these two registry keys (not values):
{9CA88EE3-ACB7-47c8-AFC4-AB702511C276}
{15c20b67-12e7-4bb6-92bb-7aff07997402}

- for each one of them, change owner from TrustedInstaller to Administrators

- for each one of them, set Full Control permissions to Administrators

- download and extract contents of file DCOMFIX-revised.zip from page http://www.sharepointblogs.be/blogs/...y-revised.aspx

- in the same folder as extracted files create CMD file dcom.cmd

- insert the following lines into that file:
@echo off
set appid={9CA88EE3-ACB7-47c8-AFC4-AB702511C276}
set appuser="NT AUTHORITY\SELF"
set workdir=%~dp0
openfiles > nul
if %errorlevel% equ 0 (
echo [ Set DCOM permissions ]
%workdir%\dcomperm -al %appid% set %appuser% permit level:l
)
echo [ Paused ]
pause
set appid={15c20b67-12e7-4bb6-92bb-7aff07997402}
openfiles > nul
if %errorlevel% equ 0 (
echo [ Set DCOM permissions ]
%workdir%\dcomperm -al %appid% set %appuser% permit level:l
)
echo [ Finished ]
pause

- run it as admin

- verify results in dcomcnfg.

Or you may edit and use CMD file included in that downloaded zip file, it can temporarily set needed registry permissions.

 

You muchomurka ,are a genius !

I followed your instructions exactly as written and it worked perfectly.
I now have "SELF" listed (Once again) among the users and groups in the "Launch and Activation Permissions" for both the 32 and 64 bit versions of RuntimeBroker.

I'm keeping this script (if it's okay with you) in my tool kit for the next time I manage to "shoot myself in the foot".

You'er the greatest.

 

You're most welcome JustRay. Btw I only found dcomperm utility compiled by Steven Van de Craen (supplied as source code in SDK) and made some modification of CMD file.

Surely you can keep & use the script, thanks to Steven.

Best Regards, M.