Re: Server 2008: You don't currently have permission to access thi

I have been researching the same 'features'. I don't mind being prompted for
performing administrative functions, but it doesn't appear that the Local
System Policy or anything else provides enough granularity to where you can
exempt just the folder/file structure access - it's either all or none.


"HAL07" wrote:

Thanks for the info anyways.

Meinolf Weber [MVP-DS] wrote:
Hello HAL07,

IE shows it correct.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and
confers no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

That page seemed to render incorrectly in Firefox

Meinolf Weber [MVP-DS] wrote:

Hello HAL07,

Maybe this gives you more infos, how UAC works:
http://technet.microsoft.com/en-us/library/cc505883.aspx
Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and
confers no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
Thanks, however I wonder why traversing a directory triggers UAC,
even if one has access to it. Especially on a server.

Meinolf Weber [MVP-DS] wrote:

Hello HAL07,

When an administrator logs on to a computer running Windows Vista
or Windows Server 2008, the user is assigned two separate access
tokens. Access tokens, which contain a user's group membership and
authorization and access control data, are used by Windows® to
control what resources and tasks the user can access.

The only account that has the FULL control is the administrator
account.
All other admins are prompted with UAC. You have the following
options:
- disable UAC - run all with the "Run as Administrator..." option.
-
check out and TEST the GPO, Computer configuration, windows
settings,
security settings, local policies, security options, "User account
control: Behavior of the elevation prompt for administrators in
Admin
Approval Mode", choose "Elevate without prompting".
In my opinion you should NOT use that policy. It lowers the
security
tremendous.
Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties,
and
confers no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
I get this popup all the time when logging in to a server as a
member of the Domain admins (not administrator) and try to go into
directories I've not been in before.

I then have to Click Continue and I get a UAC popup that edits the
security ACLs on the folder.
After, I see that my username is added with the new permissions:
- Read & Execute
- List folder contents
- Read
However I am a member of Domain Admins. How can Windows then still
ask
me for access to a folder? Doesn't Windows Server 2008 file
explorer
support nested groups?




--
-- HAL07, Engineering Services, Norway

.

Relevant Pages

  • [Full-disclosure] "run as" local denial-of-service enables administrative account proces
    ... Windows XP Professional with SP2 ... While a user, at any security membership ... A contributing factor to the success of the attack ... Log in to the computer as a local administrator. ...
    (Full-Disclosure)
  • "run as" local denial-of-service enables administrative account processes to be killed
    ... Windows XP Professional with SP2 ... While a user, at any security membership ... A contributing factor to the success of the attack ... Log in to the computer as a local administrator. ...
    (Bugtraq)
  • RE: how to change security settings
    ... Administrator account Windows XP is Administrator. ... security model to bypass, disable, or reset the password. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: domain/password
    ... | Organization: DragonByte Computing ... | Simply use the built-in Administrator account to log in locally. ... Karl Levinson's Microsoft Security FAQ ... Windows XP Security Homepage: ...
    (microsoft.public.windowsxp.security_admin)
  • RE: password
    ... administrative access to log on and reset the password using Computer / ... There is no other *supported* method in the Windows ... XP/2000 security model to bypass, disable, or reset the password. ... Have you tried logging in using the default Administrator account? ...
    (microsoft.public.windowsxp.security_admin)
Loading