2. Open Windows PowerShell (
4. Change to your directory with
You need to run the script from the same directory where SetACL.exe is located!!!
The directory is also used for logs and registry snapshots.
5. Invoke the script with:
PS C:\Users\DownloaderGa\Desktop> .\CryptSvcAdminSetAclFix.ps1
in the Adminstrator: PowerShell console.
Start logging to C:\Users\DownloaderGa\Desktop\CryptSvcAdminSetAclFix.ps1.log
Needs: PowerShell runAs admin
with Set-ExecutionPolicy Unrestricted
(Reply R when prompted)
and SetACL.exe in current folder
Uses script folder: C:\Users\DownloaderGa\Desktop
for logs and registry snapshots
Assumes user owns the script folder.
Rev: ib03 with SID auto-chk, no LT tfile, usage refs folder dir
PS_SID: S-1-5-21-4176249515-117852638-1264263521-1001
Testfile:C:\Users\DownloaderGa\Desktop
owner SID: S-1-5-21-4176249515-117852638-1264263521-1001
HKey: HKCU
reg export HKCU\Software\Microsoft\SystemCertificates\Root as HKCUcertRoot.reg
The operation completed successfully.
reg export HKCU\Software\Microsoft\SystemCertificates\Root\Certificates as HKCUcerts.reg
The operation completed successfully.
log HKUSid \Software\Microsoft\SystemCertificates\Root permissions
and HKUSid \Software\Microsoft\SystemCertificates\Root\ProtectedRoots permissions
as C:\Users\DownloaderGa\Desktop\ProtRoots.log
SetACL.exe -on HKCU\Software\Microsoft\SystemCertificates\Root\ProtectedRoots -ot reg -actn setowner -ownr n:Administrators
Processing ACL of: <current_user\Software\Microsoft\SystemCertificates\Root\ProtectedRoots>
SetACL finished successfully.
SetACL.exe -on HKCU\Software\Microsoft\SystemCertificates\Root\ProtectedRoots -ot reg -actn ace -ace n:Administrators;p:full
Processing ACL of: <current_user\Software\Microsoft\SystemCertificates\Root\ProtectedRoots>
SetACL finished successfully.
SetACL.exe -on HKCU\Software\Microsoft\SystemCertificates\Root -ot reg -actn setowner -ownr n:Administrators
Processing ACL of: <current_user\Software\Microsoft\SystemCertificates\Root>
SetACL finished successfully.
SetACL.exe -on HKCU\Software\Microsoft\SystemCertificates\Root -ot reg -actn ace -ace n:Administrators;p:full
Processing ACL of: <current_user\Software\Microsoft\SystemCertificates\Root>
SetACL finished successfully.
The Cryptographic Services service is stopping..
The Cryptographic Services service was stopped successfully.
reg delete HKCU\Software\Microsoft\SystemCertificates\Root\ProtectedRoots /f
The operation completed successfully.
reg delete HKCU\Software\Microsoft\SystemCertificates\Root /f
The operation completed successfully.
reg import HKCUcerts.reg (before CryptSvc start)
reg : The operation completed successfully.
The Cryptographic Services service is starting.
The Cryptographic Services service was started successfully.
.\CryptSvcAdminSetAclFix.ps1 : File C:\Users\DownloaderGa\Desktop\CryptSvcAdminSetAclFix.ps1 cannot be
loaded because running scripts is disabled on this system. For more information, see
about_Execution_Policies at https:/go.microsoft.com/fwlink/?LinkID=135170.
At line:1 char:1
+ .\CryptSvcAdminSetAclFix.ps1
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : SecurityError: (:) [], PSSecurityException
+ FullyQualifiedErrorId : UnauthorizedAccess
You need to run this first:
PS C:\Users\DownloaderGa\Desktop>set-executionpolicy remotesigned
Then again run:
PS C:\Users\DownloaderGa\Desktop> .\CryptSvcAdminSetAclFix.ps1
6. After that, it will display a page of progress info, which is logged as
PS C:\Users\DownloaderGa\Desktop> .\CryptSvcAdminSetAclFix.ps1.log
Done. Goodluck with this trick to fix error Chrome doesn't work when Edge doesn't run.