Skyrim Unplugged (by stoppingby4now)

[stoppingby4now]

Skyrim Unplugged has been released on The Nexus and is available at the Skyrim Unplugged project page.Further information is available on the Description view. In short, Skyrim Unplugged allows you to enforce the Automatic Updates setting in Steam, allowing you to choose when you want to update Skyrim.

[stoppingby4now]

For me I was running with all settings in steam set to do not update, and running in online mode, and Skyrim unplugged ver 1.4 set to disable.

I haven't touched UAC or Administrator rights on this computer at all its a fresh windows install (2 weeks or so) with all defaults for the system and for files.

Also a completely vanilla skyrim install. It occurred after literally dozens of launchings of the game from the launcher rebuilding the ini's in various configs each time and playing through the intro.

 

Then I'm at a complete loss. Both Steam and the launcher run with your credentials. How it is disappearing in this case is baffling. Doing some additional testing.

[stoppingby4now]

While digging around, I just stumbled across something. Steam installs a service called "Steam Client Service" that runs as the System account which pretty much has full control everywhere Administrator does. This makes sense due to the Steam Client app running under your credentials, so if you install a game, it somehow needs elevated permissions to update registry entries under HKLM. That service is how it would achieve that.

 

I know that SkyrimLauncher communicates with Steam, and it may be utilizing that service. But whatever is happening at this point, I have to assume that it's that service that is somehow being called/utilized and it is the culprit that is deleting the files. Everything else runs as your user and there is no way for a (non administrator privileged) program running with your credentials to delete the files with the file permissions I set.

---

I also just found out that my TESV.exe is gone now as well. It was there before I installed the CreationKit, so it occurred sometime after that installation. I'm convinced something is giving that Steam Client Service a nudge and causing the deletion. Reports on the missing files vary from right after patch launch to a week later, so it is also semi-random.

[z929669]

I need to know specifically if the deny rule for your username exists. Right click on the executable, select properties, then click on the Security tab. Click on the Advanced button and in the list should be an entry with Type=Deny for your username. If you click on that entry then click the Edit button, there should only be two entries: Deny Delete & Deny Create files / write data.

No, I do not have deny set for any user, including my account

 

There are certain settings in the ini files that when tweaked will cause that behavior. I don't know specifically which ones though. In the testing I did with ENB shadows, I started with a fresh INI and only tweaked shadow settings and the launcher did not do that to me. Whenever I did full tweaks to INI files though, it would do it every time.

 

Good to have confirmation that neither I nor my box is insane :P

 

I'll just delete my INIs then....

[z929669]

 

For me I was running with all settings in steam set to do not update, and running in online mode, and Skyrim unplugged ver 1.4 set to disable.I haven't touched UAC or Administrator rights on this computer at all its a fresh windows install (2 weeks or so) with all defaults for the system and for files.

Also a completely vanilla skyrim install. It occurred after literally dozens of launchings of the game from the launcher rebuilding the ini's in various configs each time and playing through the intro.

 

 

Then I'm at a complete loss. Both Steam and the launcher run with your credentials. How it is disappearing in this case is baffling. Doing some additional testing.

 

You might want to pick up a copy of Win8 then, who knows what those MS chumps stuck in that OS ...

[z929669]

While digging around, I just stumbled across something. Steam installs a service called "Steam Client Service" that runs as the System account which pretty much has full control everywhere Administrator does. This makes sense due to the Steam Client app running under your credentials, so if you install a game, it somehow needs elevated permissions to update registry entries under HKLM. That service is how it would achieve that.

 

I know that SkyrimLauncher communicates with Steam, and it may be utilizing that service. But whatever is happening at this point, I have to assume that it's that service that is somehow being called/utilized and it is the culprit that is deleting the files. Everything else runs as your user and there is no way for a (non administrator privileged) program running with your credentials to delete the files with the file permissions I set.

---

I also just found out that my TESV.exe is gone now as well. It was there before I installed the CreationKit, so it occurred sometime after that installation. I'm convinced something is giving that Steam Client Service a nudge and causing the deletion. Reports on the missing files vary from right after patch launch to a week later, so it is also semi-random.

 

 

My Steam Client Service is stopped, and does not start when I bring up the CK or verify cache for CK. My CK is 1.6.89 and I am still stable with TESV v1.5.26. I'll keep an eye on this, but I just don't believe the lot of you

[stoppingby4now]

I need to know specifically if the deny rule for your username exists. Right click on the executable, select properties, then click on the Security tab. Click on the Advanced button and in the list should be an entry with Type=Deny for your username. If you click on that entry then click the Edit button, there should only be two entries: Deny Delete & Deny Create files / write data.

 

No, I do not have deny set for any user, including my account

 

What version of SU are you running?

[stoppingby4now]

My Steam Client Service is stopped, and does not start when I bring up the CK or verify cache for CK. My CK is 1.6.89 and I am still stable with TESV v1.5.26. I'll keep an eye on this, but I just don't believe the lot of you

 

I believe that is the reason why you are still safe. My service was running and still is.

 

I have also just verified on my system that running any game, including launching the CK, or installing a game, causes that service to start. Can you please check the Startup Type for the Steam Client Service on your machine and let me know what it's set to. Mine is set to Manual.

 

If yours is set to Manual, can you keep the Services window open, then launch the CK. Immediately switch back to the Services window and keep refreshing (F5) the page view to see if it starts at all, and then maybe stops.

---

My service also starts when I launch Steam, and stops when I exit Steam. If your service is not starting, then it won't be able to add registry entries under HKLM. Remembering a ways back, you reported that certain registry entries didn't exist, and I believe this may be part of the cause and that your service is likely Disabled. Only thing that makes sense to me.

[stoppingby4now]

Did some further testing. Setting Steam Client Service to Disabled causes Steam to throw an error and it wants to install the service. Renaming Steam.dll causes Steam to update itself to get it back.

 

Even after stopping the service, any action I take causes it start (launching any game or tool, or verifying game cache). I even set Steam to Offline Mode, and the service still starts.

 

It's hard to believe that yours isn't running at all.

[z929669]

you are remembering my issue with setting up a symlink and this key:

HKLM\Software\Wow6432Node\Bethesda Softworks\Skyrim

 

 

I did not have it then because I had not run Skyrim from the launcher yet I have it now ;)

 

Neither CK nor Skyrim start up that service. it is also set to manual ... just never runs. It is also not my ESET antivirus. Incidentally, even after deleting my INIs, I am still always prompted by the options whenever I use the launcher. I think the service non-start and this behavior are connected.

[stoppingby4now]

A couple of hours later, I now understand why TESV.exe is disappearing, and it's not the Steam Client regardless of what the file permissions are. This is provable by disabling Automatic Updates and validating your game cache. When complete, it will tell you how many files did not validate, but it will not download/delete anything since Automatic Updates are forced off. When enabling Automatic Updates, the files are downloaded. I have also performed this test with the Steam Client Service disabled.

 

This leaves two possible candidates for causing the deletion, being SkyrimLauncher.exe or Steam Client Service. At this point I believe either can cause the occurrence. A data point for my case is that my TESV.exe existed before I installed the CK and I did not launch SkyrimLauncher.exe at any point both hours before installing CK, as well as after (until I tried today and was dumbfounded that it was gone).

 

Now to the problem. Windows file permissions can be a beast as they can be very complicated, and this problem shows one example of unexpected behavior. Normally, Deny entries supersede any other rule, except for certain cases. One such case is when an inherited Allow permission conflicts with the deny rule. In this scenario, the inherited Allow permission from the closest parent overrules the Deny.

 

In order to fix this, all I had to do was set a Deny Delete Sub Folders and Files on the Skyrim folder. For this test, I Enabled Automatic Updates then manually set the permissions on TESV.exe, Update.esm, and Update.bsa to match what I set in SU. I then performed a Validate game cache at which point it told me that 3 files failed to validate and would be downloaded...but they weren't.

 

However, this is where it can get tricky based on what permissions are set on the Skyrim folder. The reason is that by setting Deny Sub Folders and Files on the folder for my user, that would normally prevent me from deleting anything inside. This would cause problems for mod installers. But in my case it doesn't affect me in that regard, because I also have a permission for Allow Full Control for Users.

 

When attempting to delete a file inside Skyrim, the Deny Delete rule for my user conflicts with the Allow Full Control for Users, and I'm able to proceed. Testing this out with Wyre Bash. But by having a Deny Delete/Deny Create Files/Write Data rule on the individual files, it partially matches the Deny Delete that is inherited from the parent folder (Skyrim) and the attempt is denied.

 

The above was performed via Steam Client running as me, but there may still be a problem with the service running as SYSTEM. I just don't know at this point. The only way to be for sure would be to update permissions at least for the user and wait it out.

 

That leaves me at a point where I could use some specific information form folks regardless if your TESV.exe is still safe and sound, or if it was deleted.

• Windows OS Version
• Skyrim installation path
• Is the Skyrim folder a Junction?
• Security entries for your Skyrim root folder. Below is an example of the default permissions on mine (The entries I need are located by Right clicking Skyrim and selecting Properties. Click on the Security tab, then the Advanced button towards the bottom). :

   

  TYPE - NAME - PERMISSION - INHERITED FROM - APPLY TO

  Allow - Users - Full Control - E:\usr\games\Steam\ - This folder, subfolders, and files

  Allow - SYSTEM - Full Control - E:\usr\games\Steam\ - This folder, subfolders, and files

  Allow - Administrators - Full Control - E:\ - This folder, subfolders, and files

  Allow - Authenticated Users - Modify - E:\ - This folder, subfolders, and files

  Allow - Users - Special - E:\ - Subfolders and files only

  (For Special, click on the rule then the Change Permissions button. click on the rule again then the Edit button)

  -> Traverse folder - Allow

  -> List folder - Allow

  -> Read attributes - Allow

  -> Read extended attributes - Allow

  -> Read permissions - Allow

[stoppingby4now]

you are remembering my issue with setting up a symlink and this key:

HKLM\Software\Wow6432Node\Bethesda Softworks\Skyrim

I did not have it then because I had not run Skyrim from the launcher yet I have it now ;)

Neither CK nor Skyrim start up that service. it is also set to manual ... just never runs. It is also not my ESET antivirus. Incidentally, even after deleting my INIs, I am still always prompted by the options whenever I use the launcher. I think the service non-start and this behavior are connected.

 

I'm going to stress this again just in case. If you opened the Services window before starting Steam, you MUST refresh the window. It does not update itself when the status of a service changes.

 

If you have done that, then I'm baffled. Completely opposite behavior for me. Anything I do in Steam causes that service to start, including if I restart in Offline Mode. From what I've read online, it is supposed to be running if Steam is running, which the first thing that comes to mind is that something is blocking it.

 

Out of curiosity, I'd be interested to know what permissions are set on your Steam.dll file (located in your Steam root folder).

 

I just disabled UAC and restarted and the service is not starting for me. So that is why yours isn't since Steam will be able to do what it needs to without going through the elevation process. That's one of the main reasons why the service exists so that it can update the registry and anything else necessary to help keep it's ability to perform automatic updates.

[frihyland]

Wow nice tracking there you are a bloodhound on the scent of a homicidal steam service.

 

 

 

On win 8 I've got

users                       full control              C:\games\steam    This folder, subfolders, and files
system                     full control              C:\games\steam    This folder, subfolders, and files
everyone                  full control              C:\games             This folder, subfolders, and files
adminstarators           full control              C:\                     This folder, subfolders, and files
users                        read and execute    parent object        subfolders and files only
authenticated users    modify                   C:\                      This folder, subfolders, and files

 

 

 

Thats with autoupdate on and unplugged set to enabled.

[stoppingby4now]

Wow nice tracking there you are a bloodhound on the scent of a homicidal steam service.

On win 8 I've got

users                       full control              C:\games\steam    This folder, subfolders, and files
system                     full control              C:\games\steam    This folder, subfolders, and files
everyone                  full control              C:\games             This folder, subfolders, and files
adminstarators           full control              C:\                     This folder, subfolders, and files
users                        read and execute    parent object        subfolders and files only
authenticated users    modify                   C:\                      This folder, subfolders, and files

Thats with autoupdate on and unplugged set to enabled.

 

Very interesting. Did Win8 add Everyone Full Control to C:\games, or did you? That's not something I would ever want.

[frihyland]

That is out of the box configuration no meddling on my part for this particular install.

[stoppingby4now]

That is out of the box configuration no meddling on my part for this particular install.

 

That surprises me. Can't say I agree with MS's choice to do that, unless it has something to do with the Preview. That entry should be Authenticated Users.