how do I turn off group policy when Sytem tells me that I am not domain admin, so that I may run stytem restore? The pc in question is a stand alone vista laptop. This belongs to my client. he told me that he thougt he was getting remote support from apple but suspected that he had a hacker connected. It appears that hacker made TrustedInstaller.exe admin and took all authority away from other users except for read/execute

What you see is perfectly normal. For most system files only the window's installer (trustedInstaller) can change. It stops you or any other program from changing system files. -- .. -- "ChrisRomine" wrote in message news:64bf5cd7-95d0-4b15-9ebf-3f9378f7f79d... > how do I turn off group policy when Sytem tells me that I am not domain > admin, so that I may run stytem restore? > > The pc in question is a stand alone vista laptop. This belongs to my > client. he told me that he thougt he was getting remote support from apple > but suspected that he had a hacker connected. It appears that hacker made > TrustedInstaller.exe admin and took all authority away from other users > except for read/execute >

Hi, Thanks for posting in Microsoft TechNet forums. Usually, this is because Windows system files are owned by the TrustedInstaller service by default, and Windows File Protection will keep them from being overwritten. To delete them, you need to grand yourself full control over the folder. Click Start, type CMD and press Ctrl+Shift+Enter key combination to open an administrator command prompt. To take ownership of the file, you’ll need to use the takeown command. Here’s an example: takeown /f C:\Windows\System32\Test.txt The folder Test.txt under C:\Windows\System32 is the one you want to delete. After taking ownership of the file, please run the cacls command to give yourself full control rights to the file: cacls C:\Windows\System32\Test.txt /G Magon:F Please note: Magon is my username, replace it with your username. Best Regards Magon Liu TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tnmff@microsoft.com

Hi, As this thread has been quiet for a while, we assume that the issue has been resolved. At this time, we will mark it as ‘Answered’ as the previous steps should be helpful for many similar scenarios. If the issue still persists, please feel free to reply this post directly so we will be notified to follow it up. You can also choose to unmark the answer as you wish. BTW, we’d love to hear your feedback about the solution. By sharing your experience you can help other community members facing similar problems. Thanks for your understanding and efforts. Best Regards Magon Liu TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tnmff@microsoft.com Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.