0

In Windows 7 and above (maybe Vista), UAC comes to play when trying to assign permissions to files and folders via the security tab in file/folder properties. If I am a member of local administrators group and this group has full access to a folder, but the local users group does not have modify access to the same folder, I am offered an elevation of my privileges signified by the shield on the edit button (or change permissions button and other places). However, if local users group has the right to modify the folder I do not get this option and all ACL editing is done with user level privileges. This is a problem when trying to reset inheritance on/ACL on all child objects of a folder that users have the modify rights to. I am aware that I can start elevated command prompt and reset ACLs using command line, but is there a GUI way of doing this?

Can I force the properties window to start elevated, or at least force the security tab to offer me an elevation?

The only two ways I found are 1. killing explorer.exe and starting it as administrator or 2. lowering UAC to 0. Neither of Which, as you can imagine is ideal.

Edit: To clarify, my question came out of following problem. I needed to give all local users full access to a folder and all of its sub folders. So I went to security tab->edit (at which point it elevated) and gave users full control. However this did not propagate to all sub-folders. So my plan was to go back to security tab, advanced, change permissions and replace permissions on all child objects. But since local users already had full access to the root folder, no elevation was offered and the replace action failed on sub-folders that local users did not have full access to. Is there an easy way around this?

2 Answers 2

3

It seems that your users have the privilege to change permissions on those folders, which means either that:

  • They are in the Local Administrators' group.
  • They do have the Full Access permission on that folder.
  • They are Owner of the folder

You can check each of these scenarios and apply the corresponding action : Remove them from the Local administrators group, remove the Full Access rights...for the last point I wrote an article about a similar issue long time ago : It could maybe help in your case.

Edit: It seems to me that you're making a 2 step process : Granting local users Full Access (at which point it elevated), validating and closing the properties window, then starting over, but with no elevation this time. If I'm correct, maybe you can try to do these 2 steps at once, thus with the elevated privilege (Going directly to the Advanced tab).

1
  • My intend is to give users full access to a directory tree, not to take it away.
    – Peter
    Feb 13, 2014 at 19:51
0

I discovered a trick to run the Explorer as admin starting with Vista some years ago.

  • start regedit.exe
  • go to key HKEY_CLASSES_ROOT\AppID\{CDCBCFCA-3CDC-436f-A4E2-0E02075250C2} and give your account full permission to the key by making a right click and click on Permissions
  • rename or delete the value RunAs.

Now the Elevated-Unelevated Explorer Factory is disabled and you can start the Explorer with admin rights. In this case you don't get any UAC prompt while working with the Explorer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .