Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Windows 2008 machine A with Administrator account X. I have another Windows 2008 machine B with Administrator account Y.

Both machines have an account Z, with same username and password on both.

Account Z is in the local Administrators group on both machines.

They're not on a domain.

From machine A, as user Z (the Administrators one that's common to both machines) I want to start/stop services on Machine B.

(I actually want to do this programatically from c#, but for now via the command line to prove it works is my aim.)

I've tried a few things (e.g. using runas /user:Z cmd, then using sc.exe), but found SysInternal's psservice to be nice and flexible, since I can specify a username and password on the command line. I've also tried coding it via WMI.

I always get the same result:

If I use the user/pass for Account Y (then actual admin on machine B), it works. If I use the user/pass for Account Z (or impersonate it locally), it fails with access denied.

Since Z is in the Administrators group, why is this the case?

Thanks.

Update:

Here are my UAC settings on both machines:

UAC

share|improve this question
    
just because z is in admin does not mean the commands are being run as admin you must elevate the command to admin as in runas admin. Uac is involved more then likely. –  tony roth Aug 3 '12 at 16:01
    
I'm not trying to run as the admin user, I'm trying to runas user Z. I have tried using runas /user:Z. UAC is disabled on both machines. –  Nik Aug 3 '12 at 16:04
    
I know you are trying not to runas admin and you are doing the correct thing by doing a runas/user:Z etc. What error message do you get? Sorry I missed the "runas/user:Z" in your post. –  tony roth Aug 3 '12 at 16:15
    
do the runas again then run "wmic /node:b os" whats the result? –  tony roth Aug 3 '12 at 16:17
    
"Access is denied" comes back immediately. –  Nik Aug 3 '12 at 16:22
show 26 more comments

1 Answer

up vote 5 down vote accepted

Very grateful to everyone's comments, but here is the answer:

http://blogs.msdn.com/b/vistacompatteam/archive/2006/09/22/766945.aspx

There is a registry setting

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\LocalAccountTokenFilterPolicy

Which impacts this.

If I set that registry entry to 1, everything works as expected - users in Admin group can access remotely properly.

It's not clear to me whether this is over and above any UAC setting (i.e. those local UAC settings never impact remote access), or whether my disabling of UAC is somehow inadequate. (I disabled it by using the Windows UI - my settings are as per the original question screenshot).

share|improve this answer
1  
good work! hate things like this. –  tony roth Aug 6 '12 at 17:33
    
Damn nice work. Shocking that it would be something to do with UAC (well, split-token administrative sessions). –  HopelessN00b Genius of network Aug 8 '12 at 3:36
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.