Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

As a member of the 'Administrators' group on Windows 7 (not in a domain), I launch explorer with admin rights (ctrl-shift). User profile folders on the system disk (like 'c:\users\murray') have 'Administrators' listed with 'full control'.

However I get 'access denied' when I try to open them. So on these folders we can't utilize the 'list folder / read data' right of our group's permission, but can only add a new, redundant permission entry for our user to be able to read data.

I'd expect users to have access on a folder their group has permissions on, without adding a permission entry for each member. I find it inappropriate because the way it works will result in numerous additional entries on some special folders over time (profile folders in our case).

So; what blocks the existing 'list folder / read data' permission of 'Administrators' members to these folders and where is this rule stored? Perhaps it's related with the 'simple' file sharing, ntfs junction points, UAC, or system policies?

share|improve this question
    
well, this question probably belongs to 'serverfault.com' as it involves administrative actions, however people are aimed to redirect windows related questions to superuser so... –  SuperDuck Nov 28 '10 at 16:47
    
Updated my answer and provided a reference link that points to Microsoft's Social Answer site. –  SgtOJ Nov 28 '10 at 18:20
    
... And what I believe is the fix for this issue. –  SgtOJ Nov 28 '10 at 18:27
    
@Brian Ojeda : It's a workgroup (local environment). Yeah, domains have extra surprises, good question. I'll add this. –  SuperDuck Nov 29 '10 at 1:26
add comment

2 Answers

up vote 1 down vote accepted

The Answer

The final answer it is control by UAC. If you don't want to be prompted then turn off UAC. Which is basically the 'toggle' that was asked about. This has been confirm though testing. Not to mention the UAC Shield Icon, that is on the Continue button when trying to access the folder, should have given it away from the beginning.

When clicking on a install/setup application or opening an application that requires admin access, the UAC prompt opens and ask for permission. Access a user folder isn't different. You need admin permissions just like installing an application. The only difference is, with UAC on, the accessing user will be added to the ACL of the user's profile folder. Which isn't the case when UAC is toggled off.

The reason for Microsoft change towards UAC is found with in this document: Understanding and Configuring User Account Control in Windows Vista. I know it says Vista, but they're one in the same when it comes to UAC. It seems it all comes down to the way UAC works.


The Fix...

I believe this will fix the issue. I can not be sure since I don't have the ability to test it out at this time. Please be careful and remember revert it back. You can open Command Prompt in Admin Mode, then type in the following :net user administrator /active:yes. Please reverse this action by changing yes to no when finish doing what you need to do. This will help with security.

The only fix is to turn off UAC.

share|improve this answer
    
Please reply if the fix didn't work so that I can strike it out. –  SgtOJ Nov 28 '10 at 18:28
    
Thank you Brian. The example is from the system disk (not a disk with ACLs from another machine). Enabling the 'Administrator' account doesn't make a difference. It's obvious that we can only use our permission to add a permission entry for our own account (the 'change permissions' right), but not 'list folder / read data' right. But what I'm looking for is the source of this block (ie how that happens); eg. is it hard-coded in a system library (not likely), or a system policy, etc. so I'll be able to see how it works, what folders are affected, and maybe toggle the behaviour. –  SuperDuck Nov 28 '10 at 22:52
    
@SuperDuck - You asked what seem, at first, a tough question. After testing and researching, I post my finally answer. I have screenshots to go along with it. However, I am working in Afghanistan. As you can image, the internet here has slow upload speeds. –  SgtOJ Nov 29 '10 at 1:59
    
You hit the nail on the head now, Brian! Though the explorer session already passed through UAC and using the administrator token, it still blocks administrators from accessing the path. I know how UAC works and read the document you have given but it doesn't state this behaviour (blocking paths against already approved admins and adding user ACLs). But the shield icon was a good tip. Well tinkered answer! I assume it's a hard-coded path, but I can now examine it futher to see if it's a set of conditions like a 'no direct user permission' check. –  SuperDuck Nov 29 '10 at 2:33
    
@SuperDuck - Thank you. Just to let you know, the 'extra' information is more or less for the next person who might not know. I figured you already knew but wanted to think ahead. BTW, no screen shots coming too many issue with loading them from here. Thanks again. –  SgtOJ Nov 29 '10 at 2:39
show 1 more comment

Often you must overwrite the NTFS permissions. Especially if the folder came from a previous version of windows (like XP). That'a really a pain in the ass ... M$ like

share|improve this answer
    
haha yeah, it's also nothing new to me; it's just that I decided I wish to find out how it happens. so I want to know the exact source. –  SuperDuck Nov 28 '10 at 16:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.