Windows 7: "Access Denied" on the Command Line When Using FIND

I tried to run a FIND command in the CMD (sometimes called the DOS) box in Windows 7.  I got an error message:

Access Denied - D:\FOLDER\SUB FOLDER

This was bizarre.  I had been using the command line in this Win7 installation for months.  Well, something had apparently changed.  I got this message regardless of whether I used my pre-installed "Open Command Window Here" right-click option in Windows Explorer or the Administrator Command Box option I had created in the Start menu.

A search led me through various possible solutions.  I tried especially to tweak the permissions for the entire partition and for the individual folder via right-click > Properties > Security tab > Advanced > Owner tab > Edit > select Administrators and check "Replace owner on subcontainers and objects," and to play with other tabs and settings in that vicinity.

One option I hadn't seen previously was to open the Local Group Policy Editor (Start > Run > gpedit.msc) and go into Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > right-click on "User Account Control:  Behavior of the elevation prompt for administrators in Admin Approval Mode" > Properties > Elevate Without Prompting.  But I already had that selected.

That writeup raised the question, though:  had I not completely disabled User Account Control (UAC)?  As advised, I went into Start > Run > Regedit and navigated to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System.  There, I right-clicked on EnableLUA and verified that the value was zero.  Nonetheless, I exported the tweak, extracted the relevant lines from the REG file, and added them to my Win7RegEdit.reg file for future installations, just to be sure.

When I was in Permissions (via Windows Explorer folder right-click > Properties > Security tab > Edit), I noticed that the permissions checkboxes were checked but greyed out.  I couldn't change them.  Was I somehow not in the right account?  A search led to a proffered batch file (Permissions.zip) that read as follows:

@echo off
title File/Folder Permissions
echo.
echo.             BY KAOS - Windows 7 Forums
echo.
echo.
set /p a=Enter Path Of File/Folder:
echo.
set /p b=User Name:
echo Type "deny" = remove access OR type "grant" = allow full access
set /p c=Permission Type:
echo.
echo.
echo.
if %c%==deny goto lock
if %c%==grant goto unlock
if %a%==menu goto start2
if %b%==menu goto start2
if %c%==menu goto start2
:lock
cacls %a% /e /d %b%
cls
exit
:unlock
cacls %a% /e /g %b%:f
cls

The gist of this batch file seemed to be that I could try a CACLS command of this form:  cacls [folder path] /e /g [username]:f, where /e meant "edit," /g specified the user, and :f gave full control.  So, in my case, what username would I use?  Control Panel > User Accounts said that I had set up my system so that the only options were Ray (Administrator) and Guest (turned off).  Maybe this was the problem:  I had been thinking in terms of the Administrator account rather than the Ray account.  So, OK, I tried typing this on the command line, to grant full control to the whole drive:

cacls D:\ /e /g Ray:f

In response to that command, I got a short message:  "processed dir: D:\.  Did that mean champagne?  I retried the command that had given me the "Access Denied" error.  No, still denied.  Alright, how about same command, different user:  Administrator.  Same output.  Still denied.  Baffling!

I ran across a post that said something about turning off simple file sharing and permissions, and then permissions.  It raised a question:  was there a way to reset permissions to the default, and start over?  For the drive (i.e., right-clicking on D: in Windows Explorer), I went into Share with > Advanced sharing > Sharing tab > Advanced Sharing.  I unclicked Share This Folder > Apply.  I got a note indicating that I had some files currently opened, and they would be closed.  I clicked Yes > OK > Close.  This, in itself, didn't have any effect on another try of the FIND command; still denied. 

I had recently gotten an indication that the Recycle Bin on drive D was corrupted.  I had said go ahead and empty it.  That message had recurred.  I had also been getting bothersome messages when I tried to move or delete folders, telling me that these folders were shared and confirming that I really wanted to do what I had said I wanted to do.  It seemed that these problems might be related.  But how, and what could I do about it?

I found a Windows XP article from 2002 that said, "If you don't have a thorough understanding of the various permissions and their relationships, it can be nearly impossible to sort out a permission problem and find a solution."  So I could see how Windows 7 was a direct descendant from Windows XP:  both could make it impossible to get any work done.  The article said that there was a difference between sharing permissions and NTFS permissions, and that the more restrictive one wins.  So if I wanted to grant full control to everyone for everything, I had to do that in two different right-click > Properties tabs:  the Sharing tab and also the Security tab.  But it really looked like I had done that, over and over again.

Ah, but now I saw a new problem.  In the Security tab, I saw that I had a little red circle with an X in it, next to the Administrator group.  There was no right-click option to explain it.  I guessed that the problem was that I had entered the wrong CACLS command, regarding Administrator rather than Administrators (plural).  So that was interesting.  I clicked on Edit, selected Administrator, and clicked Remove.  Then I re-ran that CACLS command with a reference to Administrators, this time, instead of Administrator.  But still no joy on my FIND command:  Access denied.

So anyway, as I was saying, it did seem that I had given full control to almost everyone listed in the Security tab.  I mean, literally, Everyone:  I had an entry for them, and they had full control, and so did SYSTEM, Ray, and Administrators.  But not Authenticated Users, and not plain old Users.  Who the hell were all these people, anyway, and why did we all need to have so many kinds of access to my computer so that I could get work done?  (Sigh.)  Wiser minds knew; I did not.  Anyway, I went ahead and gave full control to my whole world to everyone and his brother, Users and all.  And still the godforsaken command did not run.

And, by the way, at this point I searched in vain for those greyed-out permissions boxes I had seen earlier.  Evidently I had altered something significant, in all this screwing around.  Not so significant as to actually let me get any work done, but significant certainly in the sense that I could no longer detect greyness when I searched therefor.  Not in the Security, nor back in the Sharing tab.  Speaking of which, I now saw that my reestablished share of drive D now had permissions only for Everyone.  Did Everyone include me and all the other Administrators and Users and Authenticated Users of my home system (I was living alone), or did I need to add the whole gang back to my computer?  Not sure.

It occurred to me that I did have a solution.  It was called System Restore.  But, alas, the mere fact of telling Windows to keep system restores, accompanied by weekly checking to make sure that the task was really running as scheduled, did not necessarily mean that I would actually have recourse to any system restore points, other than the one created that very morning.  Apparently Windows was not content with the 10GB of disk space I had set aside for this purpose.  Fortuitously, I did have an Acronis drive image from a week or so earlier, and so, without further ado, I wiped the drive and restored that.  Did there exist any further difficulty?  Yes, there did.  My Acronis backup was too recent.  Apparently this problem had lurked for days and/or was not only, or primarily, a matter of drive C (stored in Acronis) as distinct from drive D (not backed up in Acronis).

I tried a different command that, I knew, I had run within recent days:  DIR.  It ran.  Now, why would DIR run and FIND not run?  FIND took a look inside files; were my permissions of some type not reaching into the files?  I right-clicked on the files in question.  They didn't have sharing or security options collectively; I had to click them one at a time to get a Security tab.  It said everyone had full control.  The Advanced > Owner tab option said the owner of at least one file was Administrators.  Anyway, the CACLS command was supposed to take care of user accouint issues.

I tried the same FIND command on another computer of virtually identical configuration.  It, too, provided a FIND error.  A search led to a brilliant insight:  my command was wrong.  I was trying to use FIND on a directory, when it only works on files.  I had to make one change:  I had to add a star (asterisk) to the end of my search.  The FIND command worked without error when I did it this way:

find /i /c "X-Message-Delivery:" "D:\Folder\Sub Folder\*"

Solution:  operator error.  Case closed.

Windows 7: Thunderbird: Add Security Exception

I was using Mozilla Thunderbird 10.0 for email.  I suddenly got this message:

Add Security Exception

You are about to override how Thunderbird identifies this site.

Legitimate banks, stores, and other public sites will not ask you to do this.

Server Location:  imap.exchange.iu.edu:993

Certificate Status

This site attempts to identify itself with invalid information.

Wrong Site

Certificate belongs to a different site, which could indicate an identity theft.

Below that, there was an option to "Permanently store this exception" and buttons to Confirm Security Exception or else Cancel.  Canceling didn't achieve anything:  the same dialog came right back.  I was afraid to click anything else.  The site in question was linked to Indiana University, which seemed legit.  I had gotten something like this before, using an earlier version of Thunderbird, but there the problematic email account had been Hotmail.

I wasn't sure why I was getting this.  A Mozilla page said, "The problem usually arises when the mail server's certificate is invalid for some reason. . . . Often this problem takes care of itself, in that the mail server provider will realize that they have made an error with their certificate and will replace it with a corrected version."  I had started getting this program maybe a year earlier.  I didn't know if this meant that I was the only person at Indiana University using Thunderbird, or what the explanation might have been.

I didn't find anything on point in Indiana's knowledgebase.  A search led to advice to make a change in Server Settings.  To get there, I had to click Cancel with the "Permanently store this exception" box checked; otherwise the dialog wouldn't budge.  Even so, I had to click Cancel a bunch of times to get out of there.  I went into Thunderbird > Tools > Account Settings.  I went to the Server Settings heading under the listing for the Indiana University account on the left side.  The advice seemed to be that, in that area, I should go to the Security Settings area and set Connection Security to None, instead of its present setting of "SSL/TLS."  Doing that changed the Authentication Method from "Normal password" to "Password, transmitted insecurely."

I wasn't sure about that.  I looked further down that same thread.  Someone else seemed to be saying that the address should be imap.exchange.iu.edu.:993, with a period before the colon.  Staying in the Account Settings dialog, and looking specifically at the list of options on the left side, I moved from the Server Settings option down to "Security," the last option for the Indiana University email account.  There, I went into Certificates > View Certificates > Servers tab.  I saw that I had certificates here for Mozilla, Google, Yahoo, etc.  It seemed like a legitimate list.  I decided to go with the advice, which was to go into Add Exception and type https://imap.exchange.iu.edu.:993.

Before I finished that, I took another look at the Mozilla page.  They said that the mail server provider (i.e., IU) should provide the necessary connection information.  They said that the Add Security Exception option that I was just about to finish would make my email through that account nonencrypted and visible to third parties.  Writers in another recent thread indicated that they, too, were having this problem.  The list of certificates (for e.g., Google, Yahoo) seemed to indicate that they had done what was necessary to provide email security at some level, but Indiana University had not.  I tried another search, but it led to surprisingly few hits, among which the main relevant reaction was puzzlement.

The Mozilla page seemed to be saying that you have three options in this kind of case.  You can ask the mail server people to get it together.  You can add a security exception -- or, as it appeared in my case at least, you would have to add a security exception if you wanted the program to be usable.  Or you could switch to a different account.  I wasn't sure whether switching to a different email program would provide another possible solution.

Unlocking PDFs

I was working with PDF files.  For purposes of reading them onscreen, I found it helpful to go into Adobe Acrobat and crop off most of the white space around the text.  This would allow Acrobat's page view to show the text in a larger size, making it easier to read.  I also sometimes liked to add bookmarks.  And for many PDFs, I would add a comment balloon on the first page, citing the URL, bibliographic information, or other indications of where the PDF came from, for future reference.

None of these things were possible when the creator of the PDF would password-protect it.  I was not sure why people would do that.  Most of them didn't, but there was the occasional exception.  Maybe they feared that someone would go in and change their wording.  I had never seen or heard of that, in my years of working with PDFs.  It did not seem like a realistic concern, for purposes of the kinds of PDFs that I was working with.  Its drawback was that it made it irritating, difficult, and for some purposes impossible to work with what they had written.

To get rid of the password, so that I could make adjustments like those described above, I did a search for appropriate freeware.  The first site that came up was an About.com review of a handful of tools that were supposedly capable of unlocking PDF files.  Some of these programs could actually figure out what the original password was, though apparently that could take hours, days, or longer, depending on how complex the password was and what level of security was used.  It was evidently faster for a program to just break the password without trying to figure out what it was.

Among the tools listed in that About.com review, I had long used Freeware PDF Unlocker.  Unfortunately, I was not able to install the version available at this point (1.0.4) in 64-bit Windows 7, even though the About.com webpage said that I should have been able to do that.  The solution to that problem was to run it from within a Windows XP virtual machine (VM), created automatically by Windows Virtual PC.  Once I had installed Virtual PC, I had to go into it, open a Windows Explorer session (Start > Run > explorer), copy the Freeware PDF Unlocker installation program to Local Disk C, and install it from there.  I had to do that copying inside the VM because, of course, the virtual drive C used by Virtual PC did not actually exist on a hard drive:  it would not appear in Windows Explorer in Windows 7, outside of the VM. I had to install it from Local Disk C, inside the VM, because the VM would not install programs located on real drives.  Once it was installed, Freeware PDF Unlocker put an icon on the desktop in the VM.  I could then drag a passworded PDF from Windows Explorer, drop it on that icon, and get a PDF of the same name, with "_noPW" added at the end of the file's name.

Needless to say, it was a bit of a hassle to start a Windows XP VM, find the PDF in a Windows Explorer session inside the VM, and drag it over to the icon.  Freeware PDF Unlocker also was not able to unlock some PDFs with more advanced security, imposed by people who were desperate to insure that nobody would ever be able to change their words -- adding, perhaps, a faux testimonial about the author's positive experiences in having sex with animals.  I mean, that was certainly something to be worried about.  If I was going to continue with my work of inserting such comments into random PDFs, I was going to have to find a better PDF cracker.

The first relevant tool on the About.com list was Guaranteed PDF Decrypter (GuaPDF for short).  I ran it on a PDF that Freeware PDF Unlocker hadn't been able to unlock.  GuaPDF gave me a message stating that it definitely could unlock the file, but unfortunately the file was too large for the free version, so I was going to have to buy the paid version.  That was a possibility, but I decided first to continue down the About.com list.

The next option on that list was FreeMyPDF.com.  This was an online service.  I had to upload my PDF and let them do their magic on it.  I then spent a minute or two watching the charming RevolverMaps image, on their webpage, that showed how people around the world were using FreeMyPDF at this very ... well, recently.  I didn't snap out of it until FreeMyPDF had downloaded the decrypted PDF back to me, a minute or two later.  Its print was a bit faded, compared to the original, but it looked like everything was there.  Acrobat wasn't able to OCR its pages until I first saved them as JPGs and then stitched them back together in Acrobat, producing a much larger file.  Then again, I didn't really need to OCR its pages.  They were already OCRed.  I did it just because the OCR process (or, in this case, reducing the gamma on the individual JPGs in IrvanView > File > Batch Conversion/Rename > Advanced, after first testing on a sample JPG in IrfanView with Shift-G) could sometimes improve the appearance of the text.

Anyway, FreeMyPDF had done the job, so that killed the incentive to look further down the About.com list.  But if the incentive had been there, the next candidate would have been PDF Password Remover Online.  This appeared to be another upload-download option, though apparently (according to About.com) accommodating a smaller maximum PDF size.  Another option:  PdfCrypt, a command-line tool.  There were a couple of other tools on the About.com webpage, but they seemed to be password retrievers and, as I say, would thus presumably be slower.

Windows 7: You Need Permission to Perform This Action

I was trying to move a file from one folder to another.  This was a frequently used folder.  I had done this operation a thousand times before.  Suddenly I got this error message:

Destination Folder Access Denied
You need permission to perform this action

A search led to the suggestion that, in Windows Explorer, I should right-click on the folder and go to Properties > Security tab > Advanced > Owner tab > Edit > select Administrator (since that was who I wanted to own the folder, though that was *already* who owned it) > Apply > OK.  That didn't work.  Some remarks indicated that this could be a digital rights management issue, in the case of a music file, but this was just a PDF.  It was, however, a PDF created by Sumatra PDF, in an attempt to remove security from the PDF so that I could run OCR on it.  It seemed I should have used Foxit instead.  Anyway, I went back into Properties > Security tab > Advanced > Everyone > Change Permissions > Everyone (check both boxes) > Apply > OK.  That didn't do it either.  I moved everything out of the folder, deleted it, put its former contents into a new folder, and was able to work normally.  No explanation.

A Tweaked Windows 7 Installation: Second Try

I was installing Windows 7.  I had spent days exploring various possibilities.  Unfortunately, I had also acquired a networking problem for which a new installation seemed to be the only solution.  This post consolidates what I learned in the first installation attempt, and adds some new items.  As in that previous post, some of these items were recorded after the fact, and may not look or function precisely as described here.  For example, settings may already have been changed by the time they come into focus in the sequence described here.
My first step was to delete all accounts except the Administrator and the Guest.  The changes described here thus had to be made only to the Administrator account.  I also allowed Windows and other updates whenever they seemed to be ready for installation.  In Windows Update, after installing desired updates, I highlighted all unwanted updates (e.g., foreign language packs) > right-click > "Hide updates."

I made some preliminary adjustments in Windows Explorer.  These included Organize > Layout > Details pane, right-click on the menu and turn on Classic Explorer Bar, and also in Windows Explorer, in Tools > Folder Options.  Also, in my early usage of Internet Explorer, I allowed it to turn on AutoComplete (Tools > Content > Settings).  (This did not fix the perennial problem of IE not remembering passwords, by the way.)

During the first installation, I organized programs that I was installing (including drivers, batch files, and other materials) into folders.  I numbered the folders (01, 02, 03 ...) so that they would appear in the correct sequential order in Windows Explorer.  The contents of all of these folders had to be checked to make sure that I was using programs and other materials designed for Windows 7.  Some but not all of my Windows XP programs fit that description.  The first several folders, at this point, had these names:

01 Motherboard Drivers and Utilities
02 Programs Needed at Start
03 Other Installation & Tweaking Programs
04 Broadly Useful Programs
05 Experimental and New Programs

The contents of folder 05 are addressed in later posts.  This post goes up through folder 04.  In other words, this post describes what I installed, and how I adjusted it, to set up a general-purpose system, mostly using software that I had used previously.

Folder 01 contained several subfolders, likewise numbered sequentially.  The first contained drivers that I would need to load during the Windows 7 installation process if I wished to install Win7 in a RAID array.  I had decided against that.  The second subfolder contained drivers to be installed after the basic Windows 7 installation.  I installed these, and continued on to install motherboard utilities.

Folder 02 contained a few items that I found very useful during the installation and setup process:

• Antivirus.  I was currently using just Microsoft Security Essentials and Windows Defender, for convenience during installation.
• AvaFind Professional.  A program that quickly finds filenames.  Some program of this sort was invaluable for locating files needed for various purposes during installation and tweaking.
• 7-Zip.  Programs to be installed, that had to be downloaded, often came in zipped format.  Windows provided an unzipping feature, but this one was more versatile.
• Google Chrome.  I found it easier to use Chrome, rather than Internet Explorer, to search for installation-related information.  Turning on Chrome's sync feature minimized the time needed to configure this tool.  Basically, my list of favored extensions was available as soon as I installed Chrome.
• Bullzip PDF Printer.  There were a few items that I wanted to save as PDF during this process.
• Router driver and utilities.

Folder 03 contained hardware drivers, registry edit (.reg) and batch (.bat) files used to configure the system, and other programs needed for the basic installation and tweaking process.  The previous post describes most of the materials in this folder.  I have added links in the following list to those that are not mentioned in that previous post.  For the most part, I ran straight through these materials, installing them all after the initial Windows installation.  I installed the programs before turning to the manual tweaking tasks (below) because these programs would take care of some of those tasks automatically.  The programs I installed at this point, in approximately this order, were as follows:

• Printer drivers and utility software.
• Win7NewInstall.bat and Win7RegTweaks.reg.  These contained a collection of registry tweaks and other adjustments and customizations.
• Classic Shell, to change the look and some functions of the Windows 7 Start Menu and Windows Explorer to what I considered the more efficient form of Windows XP.  I went ahead and configured these items at this point.
• Somehow Windows Live Essentials came up, asking how much of Live Essentials I wanted to install.  I chose Messenger, Movie Maker, and Windows Live Mesh.
• The first time I tried to play an audio file, Windows Media Player popped up and had to be configured.
• IOBit Smart Defrag.  I had used this defragmenter for several years and had no problems with it.
• LockHunter.  This was experimental, for me -- a replacement for Unlocker.  Preliminarily, it appeared less functional.  I wanted integration with the Windows Explorer context menu.  I hoped for a Win7-compatible update of Unlocker.
• QuickTime.  It appeared that several other programs depended upon this program being installed.

After installing those necessary programs, I changed the following items from the default in Ultimate Windows Tweaker (clicking Apply after each bullet point):

• Personalization:  Hide detail pane.
• User Accounts & UAC:  Enable admin approval mode for the built-in administrator account.
• System Performance:  Enable support for 4GB of RAM on 32-bit Windows OS.  Disable Tablet PC Input service.
• Network Tweaks:  Disable auto-discovery of media contents in shared network by Windows Media Player.
• Internet Explorer:  Uncheck "Open first home page when IE starts."  Uncheck "Disable IE check for updates."  Uncheck "Notify when download completes."
• Additional Tweaks:  Uncheck "Show 'Search ...'"  Show "Move To Folder..."  Remove "-Shortcut" suffix for new shortcuts.
• It appeared, in some cases, that Ultimate Windows Tweaker was not always effective.  I installed TweakNow PowerPack 2010 and used it to deselect drives not to be displayed in Windows Explorer (in my case, floppy drive A). This setting was in Windows Secret > Windows Explorer.

After restarting the machine, I made changes in Control Panel.  These, too, follow but also modify the steps described in the previous post.  Some (Action Center, Administrative Tools) had already been done in previous steps (e.g., while installing updates or resizing partitions)  Auto-Play was already set the way I wanted, which was suspicious:  had I made more changes to the two-week-old image on which I was doing these tweaks than I had recorded?  Likewise for Personalization (Windows Classic theme. Window Color > Adjust at least Active Title Bar, Inactive Title Bar, Menu, and Desktop).  Regarding Backup and Restore, I was still using Acronis as a fail-safe, but was also using the Win7 system image option.  I would make both after completing some more tweaks.  For regular data backup, I was still using Beyond Compare, which I found was pretty good at showing me when I had nested files too deep. 

Control Panel options still requiring attention were as follows:

• Internet Options: I went into General tab > Tabs > Settings > adjust as desired. I went to Security tab > Custom Level > Scripting section (near the bottom) > Allow programmatic clipboard access > Enable. I saved and closed those.  I went into Content tab > Autocomplete Settings > turn on.  Then I navigated to YouTube.com and played a video, so as to trigger the process of installing Adobe Flash Player.
• Power Options: Show additional plans > High performance > Change plan settings > Change advanced power settings > Change settings that are currently unavailable > High performance > change individual items as desired > Apply.
• Programs and Features: Turn Windows features on or off > Make sure Indexing Service is off.
• System: Windows Activation > Activate. System Protection > Hardware tab > Device Manager > verify no yellow-circle exclamation marks. Hardware tab > Device Installation Settings > Yes, do this automatically. Advanced tab > Performance > Settings > Advanced > Change > Uncheck automatically manage paging file size for all drivers; instead, set a paging file of 4000-8000 MB (or more) on each hard drive (not on each partition). System Protection tab > Configure > adjust Disk Space Usage as needed.
• Taskbar and Start Menu: Start Menu tab > Customize. Adjust various items to taste. Turn on Run command. Save and close.

Additional tweaks:

•  I now had a more or less complete approach for developing a custom-organized Start Menu on a drive other than drive C, where it could be shared with other computers and would survive a Windows crash and reinstallation.  As described in the previous post, Win7NewInstall.bat, used in the previous installation, had created a so-called God Mode folder on this Start Menu.  That folder was still there, so I did not need to recreate it.  I just needed to get around to distributing, across my Start Menu, the shortcuts to every Windows function that I had created via the God Mode folder.
• As advised, I used Resource Hacker to open C:\Windows\System32\Shellstyle.dll.  There, I went into UIFILE > 1 > 1033.  I searched (Ctrl-F) for the line that said, <style resid="FolderBandStyle">.  I inserted this code after that line:  <if mousefocused="false" mousewithin="false"><Element padding="rect(0rp,0rp,0rp,-28rp)"/></if>.  I left it conditional, able to come up on a mouseover, because I wasn't sure if I might need it in the future.  Later, if possible, I would make this change permanent, without the mouseover option, by inserting only the "Element padding" portion of the line.  With this change made, I clicked on the Compile Script button, there in Resource Hacker. Then I saved the file as Shellstyle.dll in a backup location, so I would not have to do this again.  I right-clicked on C:\Windows\System32\Shellstyle.dll and took ownership, using one of the tweaks installed above.  I copied that backup Shellstyle.dll to C:\Windows\System32, overwriting the existing Shellstyle.dll there.  Then I logged off and back on to see the change.
• Shut off an annoying question. On the Desktop, right-click Recycle Bin > Propeties > deselect "Display delete confirmation dialog."
• To make Windows remember size and position of a window, I found two solutions mentioned near the end of a very long thread on the subject.  What worked for me:  right-click on the title (top) bar of a Window.  Choose "Size."  Drag the window and its edges around.  Even if it's exactly where you want it, move it somewhere else and then back, all in one motion.  Then click on the top right X to close the window.  If that technique hadn't worked, I would have gone on to try ShellFolderFix.
• Every time I started the system, Windows Defender would give me the message, "This program is turned off."  Someone said Windows Defender was unnecessary if I was running Microsoft Security Essentials.  Posts in that thread suggested many remedies, almost none of which worked for the original poster.  A post about two-thirds of the way down that thread offered a solution that worked for me.  I added that solution to Win7NewInstall.bat.
• Somehow, a Boot folder wound up on drive D.  A thread suggested that (as administrator) I type "bcd c:\Windows /s C:" to get that folder onto drive C with the other system folders.  Before doing that, I made a System Restore point.  To do that, I went into Control Panel > System > Advanced system settings > System Protection tab > Create a restore point.  Then I went ahead with that bcdboot command.  It said, "Boot files successfully created."  I looked at C and, sure enough, there was now a Boot folder there too.  (Maybe there had been before; I hadn't thought to look.)  Now, as advised, to delete that hopefully unnecessary Boot folder, I tried steps through the user interface (taking ownership of the folder), but those did not work.  Using another approach, I went to Start > "cmd" and typed these commands (running as Administrator):

Finally, folder 04.  These were the programs, mostly familiar but some new, that I installed to set up a complete system.  These were as follows:

• Adobe Acrobat.  I already had a copy, else I would have considered checking out some of the steadily more competent freeware alternatives.
• Adobe Premiere Elements.  I found that a basic ability to do some video editing was valuable for many purposes.
• CamStudio.  I was not yet finding good freeware alternatives.  CamStudio, at this point, still did not have a Windows 7 compatible version, so this was a tentative solution.  I was considering buying a copy of Debut, which had done screen video capture pretty well during my trial use of it.  I also installed Jing as an alternative, though it seemed to me that I had already tried and rejected it once if not twice.  When I rebooted, there was suddenly an unexplained, virus-looking dialog offering to let me "Enter or Create a Screencast Account."  When I figured out that this was Jing's doing, I went ahead and created the account.
• CoolEdit.  An old audio-editing program that still had capabilities and familiarity.
• Copernic Desktop Search.  My search had led to this as the best desktop search option, much more useful than Google Desktop Search had been.
• Gadgets.  These were new in Vista and Win7.  Mine were not currently arranging properly on the desktop.  I was not sure how much I would use them.
• Microsoft Office 2003.  I had OpenOffice Portable already in place as an alternative.
• Shortcuts to copy into C:\Windows.  As noted in a comment following a previous post, I had discovered that putting shortcuts to programs would make them available for easy reference in batch files.
• Aqua Deskperience.  I had bought this for capturing text from a region onscreen.  There were freeware alternatives that did the same thing now.
• EditPadLite.  A Notepad alternative.  After installing this, I decided to rely on Notepad++ instead.
• File Checksum Integrity Verifier.
• Firefox.  The portable version had not been reliable for me.
• Freeware PDF Unlocker.  Drag a PDF onto this desktop icon to make a non-locked copy, so that you can add highlights and comments.
• Glary Registry Repair.  My Windows 7 replacement for Advanced WindowsCare V2 Personal.  A registry cleaner that I planned to run each time the system started.  I put a shortcut to it in the Start Menu's Startup folder.
• Google Earth.
• Handbrake.  For video conversions.
• iRotate.  Turn the monitor on its side for improved screen captures in some cases.
• Oxelon Media Converter.  Valuable context-menu addition for all sorts of conversions (e.g., getting audio out of a video file).
• Paradox dBase Viewer.  For extracting data from old Paradox for DOS files.
• Skype.
• TClockEx.  For giving me date and time in the system tray.  I didn't have those because I was using Win7's classic desktop skin.
• Thunderbird.  For email.  Again, the portable version wasn't up to the job.
• Total Commander (above).  I wasn't actually using it much, though.  I had largely managed, by this point, to tweak Windows Explorer to suit me.

Note that these were in addition to portable (i.e., standalone) applications that I already had in place and was using for many purposes.  Those were incorporated into my customized Start Menu (above) and therefore did not need to be reinstalled, or even relinked in my Start Menu, at this point.

This gave me a complete working Windows 7 installation.  It represented a great improvement over the previous try.  I was sure there would be further ways to streamline it in future installations.

takeown /f D:\Boot /r /d y
icacls D:\Boot /grant administrators:F /T

Security Update: Windows 7

I was installing Windows 7, and decided to review the current situation in the area of security software.  This post summarizes what I found.

I was concerned about the possibility that some reviewers would be influenced by advertisers, so I started with About.com.  From their list of security software reviews, I went to the most recent AV-Test report.  Its top five antivirus offerings for Windows 7 in terms of protection, in descending order, were AVG Internet Security 9.0, G Data Internet Security 2010/2011, Panda Internet Security 2010, Norton Internet Security 2010, and F-Secure Internet Security 2010/2011.  The top five in terms of repair were Avira Premium Security Suite 10.0, Kaspersky Internet Security 2010, Panda Internet Security 2010, Eset Smart Security 4.2, and F-Secure Internet Security 2010/2011.  The top five in terms of usability (which presumably included interference with other programs and other hassles) were BitDefender Internet Security Suite 2010/2011, F-Secure Internet Security 2010/2011, G Data Internet Security 2011, Kaspersky Internet Security 2010, and Microsoft Security Essentials 1.0.

I decided to treat protection and repair as two parts of the larger issue of effectiveness.  In terms of effectiveness, then, the programs appearing on both of those lists were Panda Internet Security 2010 and F-Secure Internet Security 2010/2011.  Of those two, only F-Secure also appeared among the usability top five.

The AV-Test report was cited by reviewers at various commercial sites, which nevertheless came up with somewhat different lists.  At TopTenReviews, the top five were BitDefender Antivirus, Kaspersky Anti-Virus, Webroot AntiVirus, Norton AntiVirus, and Eset Nod32 Antivirus.  The only one not having a perfect score on the three criteria considered by AV-Test (above) was Eset, on protection.  I also looked at CNET, which offered lengthy reviews of each program.  From their list of kinds of antivirus and filtering programs, I looked particularly at the Antivirus and Desktop Firewall categories.  The most recent review in either category was about 15 months old, which seemed ancient in antivirus terms.  Ranked by editors, the antivirus programs to which they gave four out of five stars (leaving out duplicates from earlier years) were Norton AntiVirus 2010, Kaspersky Anti-Virus 6, McAfee VirusScan Professional 8.0, and McAfee Internet Security Suite 6.0.  At PCMag, the antivirus programs scoring at least 4.5 stars (excluding previous years' versions of the same programs) were Ad-Aware Free Internet Security 9.0, Ad-Aware Pro Internet Security 9.0, Norton AntiVirus 2011, Norton 360 Version 4.0, and Webroot AntiVirus with Spy Sweeper 2011.  Security suites (drawn from an apparently overlapping list) getting that score were Norton Internet Security 2011, Norton 360 Version 4.0, ZoneAlarm Extreme Security, and Webroot AntiVirus with AntiSpyware 6.0.

I decided to treat PCMag as authoritative among commercial sites.  Their list diverged almost completely from the AV-Test list shown above.  I decided to rely on AV-Test above PCMag.  From their list, F-Secure Internet Security 2011 seemed to be the best program.  I wondered what would have happened if AV-Test had tested Ad-Aware Free Internet Security 9.0.  CNET's review noted that the free version was not able to scan networked drives, a killer for my purposes.  It looked like I would be shopping around for a copy of F-Secure Internet Security 2011, available from their website for $40.

Windows XP: Some Updates Were Not Installed

I had experienced occasional problems when trying to install updates to Windows XP SP3.  At some point, those problems stopped being resolved and started accumulating.  At the time of writing this post, I faced a situation in which the Microsoft Update webpage told me that I had 47 "High Priority" updates to install, along with seven optional hardware and software updates; and yet, each time I tried to install those updates, I got the messages "Some updates were not installed" and "The following updates were not installed."  I was concerned that these updates might be important for system security and stability.

On this particular day, I had once again sought out advice.  The summary of the steps I took, all of which failed, is as follows:

*   *   *   *   *

*** FIRST TRY ***


6. Make a folder "C:\WUAGENT" (any location/name can be used). Download into it:
   - http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-x86.exe
   - better yet, read "http://support.microsoft.com/kb/949104" and get the proper file there.
7. Start -> Run "C:\WUAGENT\WindowsUpdateAgent30-x86.exe /wuforce".
   - note: this failed for me if the "Automatic Updates" service was stopped.
   - I (RW) had to run it twice to get it to work.
8. In IE run "Tools -> Windows Updates" - perhaps a few times as it rebuilds update stuff.

*** SECOND TRY ***

First, do this:

1. Start -> Run "services.msc" (in Vista, it's Start->All Programs->Accessories->Run)
2. Right "Automatic Updates" and select "stop".
3. Start -> Run "%systemroot%"
4. Delete "SoftwareDistribution" folder and "WindowsUpdate.log"
5. Back in services, right-click "Automatic Updates" and select "start".

Then run steps 6-8, above.

*** THIRD TRY ***

Start > Run > regsvr32 wups2.dll
Then try running Windows Updates.

*** FOURTH TRY ***

REGSVR32 WUAPI.DLL
REGSVR32 WUAUENG.DLL
REGSVR32 WUAUENG1.DLL
REGSVR32 ATL.DLL
REGSVR32 WUCLTUI.DLL
REGSVR32 WUPS.DLL
REGSVR32 WUPS2.DLL
REGSVR32 WUWEB.DLL

*** FIFTH TRY ***

net stop wuauserv
regsvr32 %windir%\system32\wups2.dll
net start wuauserv

*** SIXTH TRY ***

Look at the log file for one of the updates.  Example:
Security Update for Windows XP (KB979309)

Then put that number into the following command:

%windir%\KB979309.log

In my case, the end of this log file gave me this information:
1,297: [PatchFilesFromResponseBlob] returning STATUS_READY_TO_INSTALL
1,313: KB979309 installation did not complete.
1,313: Update.exe extended error code = 0xf201

For guidance on whether the update was installed or not, see:
http://support.microsoft.com/kb/910339/. 

Following the advice on that webpage, look up that error code.  See:
http://support.microsoft.com/kb/906602/.

That didn't work for me, possibly because I had already obliterated the evidence in previous steps.