Windows file permissions: High Mandatory Level

I encountered a problem when following the guide: WinPE: Create a Boot CD, DVD, ISO, or VHD

 

I chose to create a new .vhdx file directly under C:\ for testing in Hyper-V

Later I moved the .vhdx file to C:\Hyper-V

I actually got this dialog when moving the file, but just went ahead with Continue without considering the implications.

00_Administrator_permission_to_move_this_file

 

When I tried to attach the .vhdx to a virtual machine I got this error message:

01_User_Account_does_not_have_permissions

Failed to modify device ‘Virtual Hard Disk’.

User Account does not have permission to open attachment.

 

I checked the file permissions and noticed:

02_High_Mandatory_Level

Integrity level: High Mandatory Level

 

I also checked the permissions with:

C:\>icacls c:\Hyper-V\WinPE_amd64_PS.vhdx
c:\Hyper-V\WinPE_amd64_PS.vhdx BUILTIN\Administrators:(I)(F)
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Users:(I)(RX)
NT AUTHORITY\Authenticated Users:(I)(M)
Mandatory Label\High Mandatory Level:(I)(NW)

Successfully processed 1 files; Failed processing 0 files

 

The high integrity level was causing the problem, but how to remove it?

The easiest solution was to lower the integrity level with:

icacls c:\Hyper-V\WinPE_amd64_PS.vhdx /setintegritylevel medium

After that the file could be attached and used.

 

Conclusion

If high integrity level on a file causes problems, it can be lowered with icacls.

Generally avoid creating files directly under C:\, because it can lead to problems like this.

Change Windows PE keyboard layout

I was experimenting with Windows PE for deployment and servicing.

The default keyboard layout is American. I wanted to use Danish keyboard layout instead.

The keyboard layout can be changed to Danish with:

wpeutil SetKeyboardLayout 0406:00000406

 

Be aware that the setting does not affect the initial cmd window.

It will however affect all other programs run hereafter.

Another cmd window (with the new keyboard layout) can be opened with:

start cmd

(Dont’t close the initial cmd window. That will make Windows PE restart)

 

Microsoft has a list of locale IDs: Locale IDs Assigned by Microsoft

As another example the locale ID for Swedish is 0x41d, so Swedish keyboard layout can be set with:

wpeutil SetKeyboardLayout 041d:0000041d

 

The same principle applies to other languages.

Replace default Windows 10 Intel graphics driver

After installing Windows 10 I experienced problems with screen corruption, (unwanted) screen cloning and occasional graphics driver crashes.

The graphics driver also seemed to cause performance and stability problems for some programs.

Intel Graphics driver version 10.18.15.4256 installed by Windows Update worked poorly for me.

 

Windows 10 forces particular driver updates as standard.

I wanted to use the latest Intel graphics driver to avoid the problems described above.

 

This was accomplished by:

1. Identfying the CPU using CPU-Z and finding the latest compatible graphics driver at: https://downloadcenter.intel.com/

2. Downloading and unpacking the .zip driver package.

3. Updating and choosing the driver using Device Manager.

4. Disabling driver updates.

 

I found a number of ways to disable driver updates here:

http://www.makeuseof.com/tag/take-back-control-driver-updates-windows-10/

The method that worked for me was changing the value of registry key SearchOrderConfig from 1 to 0.

Under: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching

Conclusion

The default graphics driver delivered by Windows Update may not be the most reliable version.

In some cases it can be relevant to install a different driver version and disabling driver updates.

Media driver error at Windows 10 setup

I experienced a strange problem when trying to install Windows 10 on an Asus K52J laptop from a Verbatim Store ‘n’ Go 16 GB USB drive.

After booting Windows 10 setup and clicking “Install now” I saw the message: Setup is starting

And then this error message:

A media driver your computer needs is missing. This could be a DVD, USB or Hard disk driver. If you have a CD, DVD, or USB flash drive with the driver on it, please insert it now.

Note: If the installation media for Windows is in the DVD drive or on a USB drive, you can safely remove it for this step.

 

Followed by this error message:

No device drivers were found. Make sure that the installation media contains the correct drivers, and then click OK.

 

Common explanations for this error

  • Corrupted ISO file.

(I checked the SHA1 checksum, which was correct)

  • Wrong AHCI/SATA/IDE setting in BIOS.

(I tried the available options, which had no effect)

  • Using a USB 3.0 port instead of a USB 2.0 port.

(The machine only has USB 2.0 ports. Tried all the ports anyway, which didn’t change the situation)

 

Solution

I eventually found and tried the solution suggested by 4TXTECH here:

http://www.tomshardware.co.uk/forum/id-2762791/win10-clean-install-fails-missing-media-drivers.html

Setup could continue after following this procedure:

1. Unplug the USB drive.

2. Plug the USB drive into a different USB port.

3. Go back to the initial setup screen (by clicking X).

4. Click “Install now” again

 

Thoughts

The problem seems to be caused by a USB compatibility issue somewhere between Windows 10, the laptop or the USB drive.

Further investigation could be relevant.

If Windows installation from a USB flash drive fails due to this or other problems, try the suggested workaround.

As an alternative, try installing from a DVD (if possible).

Windows Update stuck at Preparing to install

Windows Update problems on new Windows Server 2012 (R2) machines are fairly common.

 

Common advice is to clear: C:\Windows\SoftwareDistribution

This usually works, but unfortunately it also resets parts of the Windows Update history.

In some cases it’s not necessary to clear the SoftwareDistribution folder.

 

If Windows Update is stuck at Preparing to install for a long time (hours), the problem may be resolved simply by restarting the Windows Update service.

From an elevated command prompt run:

net stop wuauserv

Usually the Windows Update service will be started automatically.

In case it isn’t, start it with:

net start wuauserv

 

This simple procedure solved the Windows Update problem I experienced today. Afterwards it was no longer stuck, but installed updates normally.