Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am an admin on the machine, but yet, I am unable to access all folders on the machine. For example, another admin had a script on his desktop folder that I needed, and I was not able to get it through my login. We had to use a local admin account to get into that folder. This is a deviation from prior behavior on Windows Servers.

What is the benefit of this lockdown?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

This is a result of User Access Control (UAC). With UAC on, even if your account is in the local Administrators group then granting access on a directory to the Administrators does NOT grant you access. If you turn UAC off then the behaviour goes back to the Win2k3 model and permissions work as you'd expect. The only alternative to turning UAC off is to create a new group, grant this group full control at the root and then join all the local admins to the group.

Why MS designed things this way I'm not sure. Presumably it's because people routinely join their accounts to the Administrators group, and UAC offers some protection even when people do this. Personally I find it a pain :-) I tend to turn UAC off on servers that are not routinely logged into e.g. Exchange and SQL Servers. I do leave it on for Terminal Servers.

JR

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.