Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Problem

I have Windows XP SP3 here in VMWare, quite fresh installation, with just a bunch of applications (Browsers, Office) installed.

When I:

  1. Log in as a local Administrator
  2. Using Explorer's GUI I connect a remote server as X:
  3. Launch "Command prompt" via Start menu link by either:
    a) launching the link manually
    b) right-clicking the link, choosing "Run as..." and filling credentials of the same user

the former case works just fine, but in the latter one, cmd.exe cannot access X::

C:\Documents and Settings\Administrator>net use
New connections will be remembered.


Status       Local     Remote                    Network

-------------------------------------------------------------------------------
Unavailable  X:        \\server\share\folder      Microsoft Windows Network
The command completed successfully.

C:\Documents and Settings\Administrator>x:
The system cannot find the drive specified.

C:\Documents and Settings\Administrator>dir x:\
The system cannot find the path specified.

C:\Documents and Settings\Administrator>

Pre-analysis

I have compared various properties I could find about the processes (I'm not sure that all of them are relevant): environment, open handles, open DLLs, "Security" tab in Process Explorer and all of them are the same.

One thing I found is that when watching the attempt with Process Monitor, the succeeding one does four more steps:

"Time of Day","Process Name","PID","Operation","Path","Result","Detail"
"10:55:33.4784227 AM","cmd.exe","2792","RegOpenKey","HKCU","SUCCESS","Desired Access: Maximum Allowed"
"10:55:33.4785212 AM","cmd.exe","2792","RegOpenKey","HKCU\Software\Policies\Microsoft\Control Panel\Desktop","NAME NOT FOUND","Desired Access: Read"
"10:55:33.4785569 AM","cmd.exe","2792","RegOpenKey","HKCU\Control Panel\Desktop","SUCCESS","Desired Access: Read"
"10:55:33.4786210 AM","cmd.exe","2792","RegQueryValue","HKCU\Control Panel\Desktop\MultiUILanguageId","NAME NOT FOUND","Length: 256"
"10:55:33.4786650 AM","cmd.exe","2792","RegCloseKey","HKCU\Control Panel\Desktop","SUCCESS",""
"10:55:33.4787131 AM","cmd.exe","2792","RegCloseKey","HKCU","SUCCESS",""
"10:55:33.4912359 AM","cmd.exe","2792","CreateFile","X:","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"10:55:33.4924104 AM","cmd.exe","2792","QueryNameInformationFile","X:","SUCCESS","Name: \server\share\folder"
"10:55:33.4924860 AM","cmd.exe","2792","QueryInformationVolume","X:","SUCCESS","VolumeCreationTime: 9/6/2005 2:05:04 PM, VolumeSerialNumber: 109F-0912, SupportsObjects: True, VolumeLabel: DATA"
"10:55:33.4932539 AM","cmd.exe","2792","CloseFile","X:","SUCCESS",""
"10:55:33.4937810 AM","cmd.exe","2792","RegOpenKey","HKCU","SUCCESS","Desired Access: Maximum Allowed"
"10:55:33.4939097 AM","cmd.exe","2792","RegOpenKey","HKCU\Software\Policies\Microsoft\Control Panel\Desktop","NAME NOT FOUND","Desired Access: Read"
"10:55:33.4939451 AM","cmd.exe","2792","RegOpenKey","HKCU\Control Panel\Desktop","SUCCESS","Desired Access: Read"
"10:55:33.4940098 AM","cmd.exe","2792","RegQueryValue","HKCU\Control Panel\Desktop\MultiUILanguageId","NAME NOT FOUND","Length: 256"
"10:55:33.4940548 AM","cmd.exe","2792","RegCloseKey","HKCU\Control Panel\Desktop","SUCCESS",""
"10:55:33.4941023 AM","cmd.exe","2792","RegCloseKey","HKCU","SUCCESS",""

The steps CreateFile, Query* and, CloseFile are missing in the log of the failing one.

Question

What can cause such a discrepancy? Is this a bug?

share|improve this question
1  
Why are you performing Run As as the same user? –  Shevek Jan 19 '12 at 14:16
    
Well @Shevek, a good question :-) somehow, my colleague did this, maybe just not realizing he's already logged in as Administrator (switching machines all the time...). We could not explain how that happened, but we needed to be able to avoid such a weird situation. –  Alois Mahdal Jan 19 '12 at 15:07
add comment

2 Answers

up vote 4 down vote accepted

Starting with Windows XP, each LSA logon session (not related to Terminal Services sessions) has its own set of drive letter assignments. If you use Run As... – whether the account is same or different – the function still creates a separate logon session with the credentials given.

More:

share|improve this answer
    
Thanks for calling things by their real names. –  Alois Mahdal Jan 19 '12 at 15:13
    
@JdeBP: On the topic of sessions, the Linux-related footnotes on your WinNT sessions page have become a bit outdated; they do not mention the currently common use of device ACLs (as opposed to ownership change) and the "audit" session IDs (which, to me, seem to be fairly close to NT logon sessions - assigned by kernel but tracked by userspace ConsoleKit or systemd). –  grawity Jan 19 '12 at 18:35
1  
Four years is a fairly reasonable interval for revisiting a FGA. –  JdeBP Feb 11 '12 at 16:59
add comment

Because mapped drives are on a !PER USER! basis, the other user (which you do the RUN AS as) can not see it!

To win, you need to try mapping a drive in a batch which is being run as the user first.

share|improve this answer
    
But as I have said, I'm opening the link as the same user (LOCALMACHINE\Administrator). I'm just using another way to achieve that. –  Alois Mahdal Jan 19 '12 at 14:10
    
Could be session based. Try mapping the drive as persistent, logging off then back on again and trying the Run As method again to confirm. –  Shevek Jan 19 '12 at 14:17
    
scratch that last comment - I just tried it with a persistent mapped drive, CMD Run As and I get the error... That's really odd! –  Shevek Jan 19 '12 at 14:19
    
Ahh, @AloisMahdal, I get it now. I had the same issue before. It seems Run As does in fact somehow not persist mappings.. I dont know... –  sinni800 Jan 19 '12 at 14:51
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.