Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In NT prior to Vista, if you created a local folder and were in the Administrators group and gave that folder Full Control, you could access that folder locally. Now in Vista/7/2008 it says "would you like to add yourself permanently to this folder?" and then you click proceed and it adds your account.

If you just have:

SYSTEM
Administrators

It padlocks the folder and does the question prompt.

However if you have one of the following:

SYSTEM
Administrators
[another group to which you are a member and have access to the folder with] OR
Authenticated Users group [with read or more] OR
CREATOR OWNER [but it will just re-add your user account if you leave CREATOR OWNER]

It doesn't padlock the folder and acts as you'd expect.

Why does this work this way? This seems counter-intuitive to me. It seems like it opens up a potential to confuse people and introduce security holes. Is there a "best practice" and if so, what it is?

share|improve this question

migrated from stackoverflow.com Apr 19 '12 at 23:07

This question came from our site for professional and enthusiast programmers.

    
Best practice is to create your own group, and assign permissions to that group, rather than using Administrators. Consider the Administrators group to be for system (or expert) use only. –  Harry Johnston Apr 20 '12 at 4:30
    
Makes sense--I'm just not used to doing that for local use though :-) Thanks! –  greentiger Apr 20 '12 at 18:06
    
One trick that can be handy, if you're in a domain, is to create a domain group for "administrators of (some set of) computers" or perhaps just "administrators of computer X" and add that group to the Administrators group on the computer(s) in question. Then you can use the domain group for file permissions, but still only have to add admins to one group. –  Harry Johnston Apr 21 '12 at 3:41

1 Answer 1

up vote 2 down vote accepted

What you're missing is that thanks to UAC, the software you run most of the time doesn't have the Administrators token applied. So if the only ACEs are for System and Administrators, you don't have access unless you elevate.

share|improve this answer
    
So even though my account is in the Administrators group I'm not carrying the proper token? Then the Administrators group only effectively works as expected for Domain Administrators and the local Administrator account? Does this behavior revert if the UAC is turned off? –  greentiger Apr 20 '12 at 1:06
1  
I believe you'll find the Domain Administrators group behaves the same way. The Administrator account is a special case, because UAC is (by default) disabled when logged in as Administrator. And yes, turning UAC off will revert this behaviour, but you shouldn't do that. –  Harry Johnston Apr 20 '12 at 4:31
    
No I prefer to have the UAC on for the added security--but the changes are confusing. It does help me to think of it terms of the groups as being for specific accounts (administrators only for the administrator though). I appreciate the answers! –  greentiger Apr 20 '12 at 18:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.