-1

I am using an account that is in the group Administrators, but also in the group Users. And I have a directory for which I removed access for the group Users.

In this directory there is an executable that when I try to run it from the explorer, gives me Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item.

Surprisingly I get this even when I right-click the file and choose 'run as administrator'.

If I try to open it from a command prompt I get 'Access is denied.'.

Only if I try to open a command prompt with 'run as administator', and then try to run the executable it finally runs.

Can someone explain to me why this is, and what rights I can add to avoid having to start a command prompt in administrator mode to finally run this application? I would assume this all would not be necessary as I am already an administrator.

Improve this question
6
  • It comes down to the hierarchy of groups. Administrators might be a subset of the Users group.
    – Burgi
    May 3, 2016 at 11:10
  • @Burgi that would make no sense. If Administrators would be a subset of Users group, then I would have no problems, as being administrator would implicitly already mean that I am user.
    – nl-x
    May 3, 2016 at 11:22
  • @Ramhound first off I am not denying anything. I only removed an allow for group 'users'. So your first comment is not the case. On your second comment: I would expect right clicking and 'run as administrator' on the executable to give the same result as running the executable in a command prompt opened with 'run as administrator'. Yet it does not.
    – nl-x
    May 3, 2016 at 15:04
  • so the answer is to only assign each user to ONE group, either user OR administrator? any implications to that?
    – ruggb
    May 3, 2016 at 22:11
  • @Ramhound Again: I am not denying anything. (Removing a right is not the same as a deny rule.) As for now, I still don't understand why 'run as administrator' doesn't work, while running from an administrator command prompt does.
    – nl-x
    May 9, 2016 at 15:03

1 Answer 1

Reset to default
-1

User accounts are designed for individuals. Group accounts are designed to make the administration of multiple users easier. While you can log on to user accounts, you can't log on to a group account. Group accounts are usually referred to simply as groups. I hope the link below could help you https://msdn.microsoft.com/en-us/library/bb726978.aspx?f=255&MSPPError=-2147217396

Improve this answer
1
  • Please read the question again carefully. Your answer does not answer the original question.
    – DavidPostill ♦
    May 4, 2016 at 11:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.