Access to CD/DVD Drive is Denied through Windows 7 Explorer (Permission Problem)

A while ago I started having trouble with my optical drives. Both of them keep showing up in Explorer as CD/DVD drives on boot, but as soon as I put a disc in either one, it suddenly turns into a hard-drive—“local disk” is displayed in the Type column, though the File System column remains UDF/CDFS. (I though that maybe it was a permission issue on the registry key in HKLM\System\CurrentControlSet..., but I’m not so certain because of the next test.)

Here’s a screencast of My Computer; when I put in a disc, the DVD drive magically turns into a hard-disk and cannot be opened.

When I try to open a disc (of any type), I get an access denied error message. If I open an elevated command-prompt, I am able to access the files. Also, if I kill Explorer and run it from an elevated command-prompt (thus giving Explorer elevated permissions), then I can access the files from Explorer.

I’ve tried uninstalling and reinstalling the devices without success. The security dialog indicates that there are none set for the drives (no owner and no permissions). I tried setting the owner, but am only able to do so if there is a disc in it (it complains if it is empty), but the settings do not stick (if I immediately open the security dialog after setting it, it is empty again). I tried setting permissions, but that gives an error.

I’ve included a screencap-flowchart of the security dialog of one of the drives below.

I suspect that the problem is with the registry entries related to optical drives in HKLM\SYSTEM\CurrentControlSet. For example, the Properties subkey in HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318} is conspicuously absent. Worse, I cannot figure out what should be in it or import one from a backup hive because the Properties subkeys in …\Class have some sort of “super-admin” permissions—I cannot even view the permissions or owner on these! It does say however that I can change them, but I don’t know what account owns or has permissions for them (my guess would be TrustedInstaller—or something).

(Yes, I made sure that there are no upper- or lower-filters, and yes, I ran sfc. I also made sure that in the policy editor, “devices: restrict CD-ROM...” and “removable storage access” are not set.)

Does anyone know what the owner and permissions are supposed to be for optical drives and how to reset them?

Synetech

Posted 2011-02-01T22:01:07.657

Reputation: 63 242

I know you checked "Devices: Restrict CD-ROM..." but did you also check Computer Configuration | Administrative Templates | System | Removable Storage Access? – Patrick Seymour – 2011-02-01T23:26:01.810

Yup; those are also all “not configured”. – Synetech – 2011-02-01T23:26:01.873

Does it work okay with UAC disabled? (after a restart) – Kez – 2011-02-19T22:57:15.857

@kez, yes, not surprisingly it does work, though is not correct or a solution (it has the same effect as starting Explorer from an elevated command-prompt). I suspect that there is something wrong with the permissions on the registry keys in HKLM\System related to the optical drives. – Synetech – 2011-02-21T03:14:09.440

Answers

Well, it turns out that I was right; it was indeed the missing Properties key in HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}. It took several steps to fix, but actually not that long overall (especially compared to the three or so weeks I’ve been living with and working around the problem).

Grabbed a an offline copy of the SYSTEM hive from my previous installation of Windows-7 (the backup in %systemroot%\System32\Config\RegBack has the same problem)
Mounted it in my current copy (> reg load hku\z system)
Ran Regedit and navigated to HKU\z\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}
Opened the permissions dialog for the Properties key, ignoring the errors and warnings about not being allowed to view permissions for the key
Switched to Owner tab and set permission to myself
Switched to main tab and added myself to the ACL and assigned full-control
Refreshed and successfully viewed the Properties key and its contents
Exported the key to a .REG file
Unmounted the backup SYSTEM hive (> reg unload hku\z)
Edited the .REG file to change the key (HKEY_USERS\z -> HKEY_LOCAL_MACHINE)
Imported the updated .REG file
Navigated to HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318} in the registry
Opened permissions dialog for Properties (no errors this time)
In Owners tab, switched owner from myself to the virtual user SYSTEM
In main tab, removed myself from permissions list and made sure SYSTEM has full access (iirc, it already did)
Refreshed, unable to view key anymore (that’s good), closed Regedit
Opened Device Manager
Uninstalled optical (CD/DVD) drives
Rebooted
Inserted a disc to test, observed that it loaded without suddenly turning into a hard-disk, opened the disc in Explorer successfully.

It works correctly now (I can watch a DVD without having to rip it to the hard-drive or running the player in administrator mode, or I can install a game or program without having to open an admin command-prompt to install or even copy the whole disc to the HD).

I guess my instincts were correct from the start. If I had the time—um, at the time—I would have rolled up my sleeves and dug into that inaccessible key like I usually do. Thanks to harrymc for insisting on the key being accessible and pushing me to copy it.

(I’m still not sure what caused the problem in the first place. I do recall that there were other issues with the optical drives just before the key got deleted—Device Manager had kept marking them with an error/warning—and I recall trying various ways to forcibly uninstall the drives in an attempt to get Windows to detect and reinstall them correctly. It stands to reason that one of the forced uninstallations somehow managed to delete the key; it didn’t exactly improve the situation. On the bright side, the drives are no longer marked with warnings in Device Manager.)

Synetech

Posted 2011-02-01T22:01:07.657

Reputation: 63 242

Your method works very well. I also imported "HKLM\SYSTEM\CurrentControlSet\Control\Class{4D36E965-E325-11CE-BFC1-08002BE10318}" from a previous backup and everything came back to normal. One question remains: what triggered the problem ? Gil – None – 2011-12-28T21:21:13.937

You had the same problem? I’m glad I could help. I too saw the pages referencing that CLSID, but they did not help because I was not missing the CD/DVD drive, I just could not open it. I don’t know what could have caused it; it doesn’t help that it was quite a while ago, so I could never remember all the things that went on in my system back then.

– Synetech – 2011-12-29T20:28:21.603

Thanks for such detailed instructions about how to give yourself permissions to the Properties key :) – Rachel – 2012-12-13T16:43:11.077

This behavior is very puzzling, so all I can offer are some hints and more questions.

It would help to know whether the CD/DVD drive is shared. If it is, maybe unsharing can help.

Second, whether you have a CD-burning software installed, such as Nero. You might try to uninstall such software to see if this makes a difference.

Third, run gpedit.msc and check Computer Configuration / Administrative Templates / System / Removable Storage Access. Verify that "CD and DVD: Deny read access" is disabled or not configured. In effect, all the options should be not configured.

You might also try to see what happens with "sfc /scannow" as described in
How to Repair Windows 7 System Files with System File Checker.

The last resort is following How to Do a Repair Install to Fix Windows 7, which will refresh your Windows files without requiring the reinstallation of applications.

Some anti-virus scans might also be useful.

harrymc

Posted 2011-02-01T22:01:07.657

Reputation: 306 093

I can see from your answer to KJGraphics that the drive is unshared, so don't bother replying on this. – harrymc – 2011-02-21T09:13:08.340

Same to gpedit.msc (from the deleted answer to Patrick S.) – harrymc – 2011-02-21T12:30:50.307

Like I’ve said in the original question, I have already checked the policies and the upper and lower filters and run SFC (which only works for files, not the registry). It’s not a virus–or a tumor! :-D I am not interested in doing a repair install; that’s all I ever see for any difficult questions (even in the Microsoft Answers forums by “MSMVPs”); I’d rather dig in and fix a problem than just run away and do the “easy thing”—as though reconfiguring all of the settings all over again would be easy. – Synetech – 2011-02-21T13:06:13.443

In the comments you say that it works with UAC off or with an elevated Explorer. Does it mean that you can then see the contents of the DVD even though it still appears as "Local disk"? – harrymc – 2011-02-21T13:12:15.580

start="2">

Also you haven't answered to my question about Nero or such.

< – harrymc – 2011-02-21T13:42:56.473

start="3">

In the gpedit.msc part of my answer, you might try to set everything to Disabled, rather than not configured.

< – harrymc – 2011-02-21T13:48:21.537

start="4">

Did you do any registry cleanup just before the problem occurred?

< – harrymc – 2011-02-21T13:49:57.337

Yes, like originally said, I can see and access the files using administrator access (in whatever way that access is used). 2. No, no Nero etc.; like I said, the Upper- and Lower-Filters are clear. 3. Not Configured means default, which is supposed to work; it should need to be specifically set. 4. No registry cleanup apps at all.

I’m almost certain that it is because of the missing HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\Properties key. – Synetech – 2011-02-25T05:48:27.490

1Registry access to Properties is easy : in another computer do regedit, right-click the Properties key and select Permissions, click Advanced, change to yourself in Owner tab, Apply, then in Permissions tab add all permissions. Now you can export the whole class and import it to your computer. It should work with whatever owner. But create first a restore point on both computers, just in case. – harrymc – 2011-02-25T06:31:57.187

But how do I find out who is supposed to be the owner in the first place so that I can restore the owner after importing it? I can only change it, not view it. – Synetech – 2011-02-25T21:13:25.210

1I don't think you can or need to reset the owner to that hidden account. I believe it can still work with whatever owner. To be sure, I have suggested taking a restore-point, which you can restore-to at least on the source computer. The target computer will stay with Administrator as owner, and I believe that this will work. If not, then restore back. – harrymc – 2011-02-26T06:51:08.380

What you suggested won’t work. I have a copy of the registry hives from my previous installation of Win7, so a couple of weeks ago, I tried accessing the Properties keys from the old (and offline) SYSTEM hive and it was not possible (access denied). – Synetech – 2011-02-27T23:22:38.583

1This can work in spite of the frightening "access denied" message. Click OK on the message, then right-click on Properties and follow as per my advice above. – harrymc – 2011-02-28T12:49:43.610

I tried giving myself permission, but it failed. I tried setting myself as the owner (it didn’t complain), but when I try exporting, it says the branch is not found. – Synetech – 2011-02-28T19:36:03.977

1You should do it in the order : 1) become owner and click Apply, 2) give permissions. – harrymc – 2011-02-28T20:20:04.617

Duh. :-) See; proof that multi-tasking things like texting and driving (or working on a computer and watching a movie) doesn’t work well.

Anyway, there is indeed some data in the Properties key (two values). Not surprisingly though exporting the data has not fixed it yet. I’m going to try rebooting, then unintsalling the optical drives, then rebooting again, and hopefully it will work.

Incidentally, it looks like the owner of those inaccessible keys is the virtual user SYSTEM. – Synetech – 2011-03-01T03:28:24.303

It also looks as if your bounty has evaporated into thin air. – harrymc – 2011-03-01T07:02:12.450

Yup, apparently that’s one of SE’s stupid and arbitrary rules. – Synetech – 2011-03-05T23:32:11.670

@Synetechinc. Bounty "evaporated" because you didn't award it and there were no other qualifying entries.

– Sathyajith Bhat – 2011-03-06T03:50:52.130

@Sathya, I know; that’s what makes it so stupid. – Synetech – 2011-03-06T03:59:05.280

@Synetechinc. Not sure what's stupid about that. You put in the bounty, you should be following it up. Plus you get notifications & emails about bounty expiring – Sathyajith Bhat – 2011-03-06T04:00:32.977

@Sathya, You can’t follow up on nothing. If no answers solve a problem, the bounty was unhelpful and so should be returned once expired. What if there were no answers whatsoever? The bounty still evaporates? Notifications are only relevant if you get an answer to the question – Synetech – 2011-03-06T04:19:24.190

@Synetechinc. What if there were no answers whatsoever? The bounty still evaporates? -> Yes. so should be returned once expired -> Have a look at http://meta.stackexchange.com/q/56298/133693

– Sathyajith Bhat – 2011-03-06T04:22:17.037

@Synetech inc.: I do not agree about no answers, as mine did put you on the right track. Your own answer contains the detailed procedure, but it is based on my contribution. It is normal in such cases to award the bounty to the answer that put you on the right track, as a thank-you for the time spent on your problem. – harrymc – 2011-03-06T07:52:19.990

@harrymc, A few of your comments prodded me to continue with what I was doing; hence I up-voted the relevant comments. It’s not my fault that no rep is award to comments; I have voiced my opinion in the relevant Meta threads. Your answer however was not helpful (you yourself said you can only offer more questions), and contained things that I had already addressed in my question. In any case, it was not until after the bounty expired that I finally managed to successfully fix it with the idea I had from the start. Do you expect a bounty to be awarded prematurely just because it is expiring? – Synetech – 2011-03-06T08:18:08.247

@Synetech inc.: Whatever you like. It's your rep. – harrymc – 2011-03-06T12:42:31.230

Today there was one 13-byte file on a CD I couldn't read on windows 10 home. However after creating a ISO-file (using BurnAware), I was able to extract it from there (using WinRAR).

MeMyselfI

Posted 2011-02-01T22:01:07.657

Reputation: 121

I faced the same problem , what i did was:(Windows 7)

Ran Regedit and navigated to HKU\z\SYSTEM\CurrentControlSet\Control\Class{4D36E965-E325-11CE-BFC1-08002BE10318}

Right clicked, then click new, then create a new key. Then rename it to Properties. In Properties create two new dwords

DeviceType Type:reg_dword Value:00000002
DeviceCharacteristics Type:reg_dword Value:00000100

Then Uninstall the driver of cd/dvd from Device manager.

Scan for New Hardware. Boom!! Problem Solved.

Abhishek Jha

Posted 2011-02-01T22:01:07.657

Reputation: 1

I’m glad I could help fix it, but why did you create the two extra values? That should not be necessary; should get created automatically when the drivers are re-installed. Did you make sure to check the permissions? – Synetech – 2013-12-22T19:21:32.130

I found that the Initio default controller" in the device manager needed to be uninstalled, including the driver files. After that the external USB DVD drive suddenly appeared again.

(To verify this, I let Windows Update reinstall the 52kb Update called Initio - Bus Controllers and Ports - Initio Default Controller, with the effect that DVD drive disappeared. Deleted driver again in device manager; DVD drive appeared again.)

Martin G

Posted 2011-02-01T22:01:07.657

Reputation: 1