The version of subinacl distributed in the Windows Server 2003 resource kit doesn't work correctly, download from ( here ). 

subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f
if errorlevel 1 echo error >> %LogDir%\stderr.txt
subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f
if errorlevel 1 echo error >> %LogDir%\stderr.txt
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f
if errorlevel 1 echo error >> %LogDir%\stderr.txt
subinacl /subdirectories %SystemDrive% /grant=administrators=f
if errorlevel 1 echo error >> %LogDir%\stderr.txt
subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=system=f
if errorlevel 1 echo error >> %LogDir%\stderr.txt
subinacl /subkeyreg HKEY_CURRENT_USER /grant=system=f
if errorlevel 1 echo error >> %LogDir%\stderr.txt
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=system=f
if errorlevel 1 echo error >> %LogDir%\stderr.txt
subinacl /subdirectories %SystemDrive% /grant=system=f
if errorlevel 1 echo error >> %LogDir%\stderr.txt

subinacl /subdirectories %SystemDrive% /setowner=administrators

subinacl /subdirectories %SystemDrive% /revoke=S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464

subinacl /subdirectories c:\

subinacl /subkeyreg HKEY_LOCAL_MACHINE

subinacl /subkeyreg HKEY_CURRENT_USER

subinacl /subkeyreg HKEY_CLASSES_ROOT

List permissions on all files and subdirs on drive c:

SubInacl  /verbose /subdirectories c:\*.* /display 

To restore Vista permissions back to correct values, see:

Repair Vista Registry