Re: Use of credentials with UAC in vista

Mr. Arnold wrote:

"kapibarra" <k@xxxxxxxx> wrote in message news:g8eq39$6gb$1@xxxxxxxxxxxxxxxxxx
I had UAC turned off. I tried to run a command (eventcreate) under a user's account, from a command prompt with 'run as administrator' privledges, and it failed saying access denied. The user's account has power user permissions.

There are only two accounts that mean anything on Vista. Admin user and Standard user, from a user's standpoint.

There is no more Power User on Vista, as stated in the article.

<http://technet.microsoft.com/en-us/magazine/cc160882.aspx>

Thanks for the response. Well, this is Vista business 32 bit joined to a 2000/2003 mixed mode AD domain, and my domain users are all power users (see link below):

http://www.tinyang.net/misc/poweruserv.jpg

Notice how it specifies both power user and debug users? Do you think it is specifying power user because of being joined to a domain? If so, maybe it has no effect on the local machine user access and only applies to network domain resources?

It also appears from reading the above article that it did indeed cache my admin credentials. I need to remove them, how do I do that?


So I logged in as admin and turned UAC back on, rebooted, logged back in as the user, ran the command again, and it prompted me for credentials. So I put in the admin credentials, and it ran the command. Then I logged in as admin, disabled UAC, rebooted, logged in as user, and now it runs the command, whereas before it did not run the command in the user's account. My question is why is it behaving differently now than it was before? UAC hasn't cached the admin credentials, has it? If not, then can someone please explain to me why it now works?

An admin on vista is locked down to a Standard user secuirty token, until such time it needs to use the Admin Full rights Secuirty token, the the admin's rights are ecalated to Full Admin rights, as being discussed in the links.

http://news.softpedia.com/news/Admin-Approval-Mode-in-Windows-Vista-45312.shtml

http://technet.microsoft.com/en-us/library/cc709691.aspx

There is another account on Vista that has Admin Full Rights on Vista, with UAC enabled.

<http://www.computerperformance.co.uk/vista/vista_administrator_activate.htm#Summary_of_Vista_Administrator_-_Super_User_(Hidden_Account)>


--
kapibarra
.

Relevant Pages

  • Re: Use of credentials with UAC in vista
    ... user's account, from a command prompt with 'run as administrator' privledges, and it failed saying access denied. ... The user's account has power user permissions. ... There is no more Power User on Vista, ... So I put in the admin credentials, ...
    (microsoft.public.windows.vista.general)
  • Re: admin password
    ... If you only have one account on the computer, it is an admin account, ... Go into System Preferences> Accounts. ... This involves some use of the command prompt and restarting the computer ...
    (uk.comp.sys.mac)
  • Re: wierd batch file behavior
    ... Try the command without the & or the ^ or the this should work. ... > net localgroup Administrators /add Admin /domain ... > backspace),and finally make that account an administrator. ...
    (microsoft.public.windows.server.scripting)
  • Re: We are there--everything is perfect, except: Power User/Adminstrator
    ... > Power User Account and use that most of the time, ... > of one of the administrator accounts to it? ... using (I'm not sure if you'll have to log out then log in as admin to do ...
    (microsoft.public.windowsxp.configuration_manage)
  • Re: Finding a Specfic File Through a Batch File
    ... "Salvador Manaois III" wrote: ... Running the script remotely using a local account ... MCSE MCSA CEH MCITP | Enterprise/Server Admin ... The syntax of the command is incorrect. ...
    (microsoft.public.scripting.wsh)
Loading