Subinacl.exe Microsoft Service Permissions

A nice little tool to manage service permissions on Windows name subinacl is available at

Default install directory is “C:\Program Files (x86)\Windows Resource Kits\Tools”
Usage example for the ‘spooler’ service and the user domain\username:

subinacl /service spooler /grant=domain\username=top



Microsoft WSUS Rebuild

To re-install WSUS with a clean database i.e. no previous configuration:

Run Windows Powershell as Administrator and use the following commands:

  • Uninstall-WindowsFeature -Name UpdateServices,Windows-Internal-Database -Restart


  • Post restart, delete EVERYTHING in the C:\Windows\WID\ (for Win 2012 r2) folder.


  • Then run the following command to re-install WSUS:
    Install-WindowsFeature UpdateServices -Restart


This only works on PowerShell 3 or higher.


I had to run the postinstallation tasks manually via Powershell using the WID db, if using SQL you need to add in sql_instance=

C:\Program Files\Update Services\Tools\WsusUtil.exe content_dir=”<<dir of update download location>>