Microsoft Windows Vista Community Forums - Vistaheads
Recommended Download



Welcome to the Microsoft Windows Vista Community Forums - Vistaheads, YOUR Largest Resource for Windows Vista related information.

You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is fast, simple and absolutely free so , join our community today!

If you have any problems with the registration process or your account login, please contact us.

Driver Scanner

Administators group confusion

microsoft.public.windows.vista.security






Speedup My PC
Reply
  #1 (permalink)  
Old 10-09-2008
PMcG
 

Posts: n/a
Administators group confusion
Hello,
I'm currently trying to save a powershell global profile on a Vista SP1
machine and getting a failure, I would appreciate anybody's help with
understanding this failure

Some background
I have a domain account that is a member of a domain local group who in turn
is a member of the local administrators role on the machine. I would expect
this to allow me to act with full
administrative privileges on the box. I verified that I can add a local user
and this was successful.

When attempting to save the global powershell shell profile @
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Microso ft.PowerShell_profile.ps1
using notepad I get the following error
"Cannot create the
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Microso ft.PowerShell_profile.ps1
file. Make sure that the path and file name are correct."

I then tried to use sysinternals handle utility to see if I could view
information on the file access failure but I get "Initialization error: Make
sure that you are an administrator."

I have spent some time searching on the web without any success.



Thanks in advance
Pat

Reply With Quote
Sponsored Links
  #2 (permalink)  
Old 10-09-2008
Jon Wallace
 

Posts: n/a
Re: Administators group confusion

Hey Pat,

This could be a case of UAC kicking in. Regardless of whether you are an
administrator (local) or not, UAC will in essense take away your admin
rights and offer you the chance to use them where required. The problem is
that these propmpts happen for known operations such as starting MMC.EXE.

If you are failing to access a path, it may be down to the fact that
notepad.exe just doesn't have admin rights because they're been taken off
you..

Try right-clicking on notepad and use the run as administrator option, or if
you wish, disable UAC (within user accounts in control panel).

Personally I like UAC but you may want to disable it it you are doing admin
tasks all the time.

Let me know if this doesn't help...

Regards,
Jon

http://www.insidetheregistry.com

---

"PMcG" <PMcG@discussions.microsoft.com> wrote in message
news:755ED913-387B-4E5F-BCCB-52993B551AA7@microsoft.com...
> Hello,
> I'm currently trying to save a powershell global profile on a Vista SP1
> machine and getting a failure, I would appreciate anybody's help with
> understanding this failure
>
> Some background
> I have a domain account that is a member of a domain local group who in
> turn
> is a member of the local administrators role on the machine. I would
> expect
> this to allow me to act with full
> administrative privileges on the box. I verified that I can add a local
> user
> and this was successful.
>
> When attempting to save the global powershell shell profile @
> C:\WINDOWS\system32\WindowsPowerShell\v1.0\Microso ft.PowerShell_profile.ps1
> using notepad I get the following error
> "Cannot create the
> C:\WINDOWS\system32\WindowsPowerShell\v1.0\Microso ft.PowerShell_profile.ps1
> file. Make sure that the path and file name are correct."
>
> I then tried to use sysinternals handle utility to see if I could view
> information on the file access failure but I get "Initialization error:
> Make
> sure that you are an administrator."
>
> I have spent some time searching on the web without any success.
>
>
>
> Thanks in advance
> Pat
>


Reply With Quote
  #3 (permalink)  
Old 10-09-2008
PMcG
 

Posts: n/a
Re: Administators group confusion
Jon,
Thanks for the reply, your suggestion to explicitly start notepad as the
admin user works. Just adding some more information just in case somebody
else has similar issues.

I normally run as a non admin user on the machine and only escalate to the
admin user when I need to. I keep a seperate powershell shell running as this
admin user and run any admin commands using this instance, so to edit the
global profile i will run the following command "notepad
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Microso ft.PowerShell_profile.ps1"
which fails as I indicated below when I try to save my changes.

As you indicated this notepad process needs some further escalation due to
UAC, so my only way to acheive this is to disable UAC ?
I too would prefer not to disable UAC which means i may face similar
situations, i tried using handle by right clicking and running as
administrator with success.

This probably means that my previous approach of running an admin shell will
not always work.


Thanks
Pat






"Jon Wallace" wrote:

>
> Hey Pat,
>
> This could be a case of UAC kicking in. Regardless of whether you are an
> administrator (local) or not, UAC will in essense take away your admin
> rights and offer you the chance to use them where required. The problem is
> that these propmpts happen for known operations such as starting MMC.EXE.
>
> If you are failing to access a path, it may be down to the fact that
> notepad.exe just doesn't have admin rights because they're been taken off
> you..
>
> Try right-clicking on notepad and use the run as administrator option, or if
> you wish, disable UAC (within user accounts in control panel).
>
> Personally I like UAC but you may want to disable it it you are doing admin
> tasks all the time.
>
> Let me know if this doesn't help...
>
> Regards,
> Jon
>
> http://www.insidetheregistry.com
>
> ---
>
> "PMcG" <PMcG@discussions.microsoft.com> wrote in message
> news:755ED913-387B-4E5F-BCCB-52993B551AA7@microsoft.com...
> > Hello,
> > I'm currently trying to save a powershell global profile on a Vista SP1
> > machine and getting a failure, I would appreciate anybody's help with
> > understanding this failure
> >
> > Some background
> > I have a domain account that is a member of a domain local group who in
> > turn
> > is a member of the local administrators role on the machine. I would
> > expect
> > this to allow me to act with full
> > administrative privileges on the box. I verified that I can add a local
> > user
> > and this was successful.
> >
> > When attempting to save the global powershell shell profile @
> > C:\WINDOWS\system32\WindowsPowerShell\v1.0\Microso ft.PowerShell_profile.ps1
> > using notepad I get the following error
> > "Cannot create the
> > C:\WINDOWS\system32\WindowsPowerShell\v1.0\Microso ft.PowerShell_profile.ps1
> > file. Make sure that the path and file name are correct."
> >
> > I then tried to use sysinternals handle utility to see if I could view
> > information on the file access failure but I get "Initialization error:
> > Make
> > sure that you are an administrator."
> >
> > I have spent some time searching on the web without any success.
> >
> >
> >
> > Thanks in advance
> > Pat
> >

>
>

Reply With Quote
  #4 (permalink)  
Old 10-10-2008
Mr. Arnold
 

Posts: n/a
Re: Administators group confusion

"PMcG" <PMcG@discussions.microsoft.com> wrote in message
news:98A289ED-8BE1-4727-A8B2-B6DFD21A2CF3@microsoft.com...
> Jon,
> Thanks for the reply, your suggestion to explicitly start notepad as the
> admin user works. Just adding some more information just in case somebody
> else has similar issues.
>
> I normally run as a non admin user on the machine and only escalate to the
> admin user when I need to.


Well, the same thing happens for user/admin with UAC enabled. The user/admin
has two access tokens assigned to it. One access token assigned is the admin
full rights token. The other access token assigned is the Standard user
token, which is the default assigned to user/admin. User/admin must be
escalated to use the full rights admin token, which is valid only at the
moment of escalation, and then the user/admin is returned to the Standard
rights token.

It's being talked about in the links as to what is happening with a
user/admin and Standard user on Vista with UAC enabled.

http://technet.microsoft.com/en-us/l.../cc709691.aspx
http://news.softpedia.com/news/Admin...ta-45312.shtml
http://technet.microsoft.com/en-us/m.../cc138019.aspx
http://technet.microsoft.com/en-us/m.../cc160882.aspx


>I keep a seperate powershell shell running as this
> admin user and run any admin commands using this instance, so to edit the
> global profile i will run the following command "notepad
> C:\WINDOWS\system32\WindowsPowerShell\v1.0\Microso ft.PowerShell_profile.ps1"
> which fails as I indicated below when I try to save my changes.


So you take ownership of the file or folder with an user group account such
as Administrtors or a your indiviual user account with either one of them
having full control.

http://www.nirmaltv.com/2008/07/11/h...ders-in-vista/

Here is the kicker, C:\Program Files and C:\Windows are protected folder and
folders and files with in those folders are protected. You'll notice this
if you go to some to the folders and try to add a new account to the folder
to give permissions for the account, change permissions for an existing
account or delete an account off on the folders. You can't do it, even as
Admin. About the only thing you can do is take ownership

You can make a new folder and add user accounts, change, and delete user
accounts on that folder. I'll get to this a little later.

>
> As you indicated this notepad process needs some further escalation due to
> UAC, so my only way to acheive this is to disable UAC ?


No, you can leave UAC enabled and use this account, which has full rights at
all times, because its privileges are already escalated automatically, UAC
doesn't prompt that account, and it doesn't need Run as Administrator.

http://www.howtogeek.com/howto/windo...windows-vista/

You can also get permissions set for user/admin to circumvent permission
conflict, because Vista, UAC and NTFS look at you being part of the
Administrator group and your individual user account permissions combined.

> I too would prefer not to disable UAC which means i may face similar
> situations, i tried using handle by right clicking and running as
> administrator with success.
>


Here is a something you can do to see what is happening on permissions
conflict for user/admin on Vista.

1) Go to the Program Files and create a new directory call it *Test*. Vista
should allow you to create the directory even as you being Admin on the
machine.

2) Start Notepad enter some text and try to SaveAs with the file to Program
Files/Test. You should get permission denied. Yeah, you're getting it even
if the account you're using is your Admin account.

3) Come out of Notepad, forget the save, and cancel out of Notepad.

4) Go to the directory and to the Security tab for the directory and add a
new account to the security account list. It's going to be the User account
you login to the computer with as Admin. If you login with *PMcG* as
admin on the machine, then you're going to add *PMcG* as another account
the will have access to the directory.

5) You'll set *PMcG* to have Full Control just as Administrators has Full
Control of the folder.

6) Go back to step # 2 with Notepad and try to SaveAs the file to Program
Files\Test. You should be able to save the file.

Hopefully, you'll see the issue of account permissions conflict for the
user/admin on Vista.

On one hand, your account is in the Administrators group account. But on the
other hand, your account is part of the User group account. If your user
account *PMcG* is not on the folder with the same rights as as
Administrators, there is going to be a permissions conflict, because Vista
with UAC enabled is looking at the combined rights of those two accounts in
some situations.

What Vista defaults to is Users account group permissions on the directory
if it doesn't see your individual user account on the folder, and Users
doesn't have Full Control.

This is because on Vista with UAC enabled, a user/admin on Vista is not an
Admin with Full rights, like it is on XP or Win 2k.

So, if you add your user account to <c> with full rights, then it will show
as an account you can use to take ownership of folders or files.

BTW, built-in Administrator can't do anything on Program Files and
C:\Windows but allow you to take ownership. Also, even if disable UAC,
user/admin the one you get from Vista out of the box or any new user/admin
accounts will never have full admin rights, because those accounts don't
inherit full admin rights from the Administrator account, like it does on
XP.





Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Only the administators group can launch this program ATL Admin microsoft.public.windows.vista.administration accounts passwords 2 10-24-2007 15:12
Confusion Inez Gebhart microsoft.public.windows.vista.mail 2 08-17-2007 23:12
Readyboost confusion Mark Linehan microsoft.public.windows.vista.performance maintenance 6 05-27-2007 13:20
Trade group: Beware of IRS site confusion Steve Security News 0 04-13-2007 11:58
Trade group: Beware of IRS site confusion Steve Security News 0 04-12-2007 10:00




All times are GMT +1. The time now is 21:56.




Driver Scanner - Free Scan Now

Vistaheads.com is part of the Heads Network. See also XPHeads.com , Win7Heads.com and Win8Heads.com.


Design by Vjacheslav Trushkin for phpBBStyles.com.
Powered by vBulletin® Version 3.6.7
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Search Engine Optimization by vBSEO 3.6.0 RC 2

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120