7

I have a Windows 2008 machine A with Administrator account X. I have another Windows 2008 machine B with Administrator account Y.

Both machines have an account Z, with same username and password on both.

Account Z is in the local Administrators group on both machines.

They're not on a domain.

From machine A, as user Z (the Administrators one that's common to both machines) I want to start/stop services on Machine B.

(I actually want to do this programatically from c#, but for now via the command line to prove it works is my aim.)

I've tried a few things (e.g. using runas /user:Z cmd, then using sc.exe), but found SysInternal's psservice to be nice and flexible, since I can specify a username and password on the command line. I've also tried coding it via WMI.

I always get the same result:

If I use the user/pass for Account Y (then actual admin on machine B), it works. If I use the user/pass for Account Z (or impersonate it locally), it fails with access denied.

Since Z is in the Administrators group, why is this the case?

Thanks.

Update:

Here are my UAC settings on both machines:

UAC

31
  • just because z is in admin does not mean the commands are being run as admin you must elevate the command to admin as in runas admin. Uac is involved more then likely.
    – tony roth
    Aug 3, 2012 at 16:01
  • I'm not trying to run as the admin user, I'm trying to runas user Z. I have tried using runas /user:Z. UAC is disabled on both machines.
    – Nik
    Aug 3, 2012 at 16:04
  • I know you are trying not to runas admin and you are doing the correct thing by doing a runas/user:Z etc. What error message do you get? Sorry I missed the "runas/user:Z" in your post.
    – tony roth
    Aug 3, 2012 at 16:15
  • do the runas again then run "wmic /node:b os" whats the result?
    – tony roth
    Aug 3, 2012 at 16:17
  • "Access is denied" comes back immediately.
    – Nik
    Aug 3, 2012 at 16:22

1 Answer 1

6

Very grateful to everyone's comments, but here is the answer:

http://blogs.msdn.com/b/vistacompatteam/archive/2006/09/22/766945.aspx

There is a registry setting

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\LocalAccountTokenFilterPolicy

Which impacts this.

If I set that registry entry to 1, everything works as expected - users in Admin group can access remotely properly.

It's not clear to me whether this is over and above any UAC setting (i.e. those local UAC settings never impact remote access), or whether my disabling of UAC is somehow inadequate. (I disabled it by using the Windows UI - my settings are as per the original question screenshot).

2
  • 1
    good work! hate things like this.
    – tony roth
    Aug 6, 2012 at 17:33
  • Damn nice work. Shocking that it would be something to do with UAC (well, split-token administrative sessions). Aug 8, 2012 at 3:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .