Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

One to try, and I'd appreciate any thoughts on this.

On a Windows Server 2008 R2 box (or presumably 2008 R1, Windows Vista or Windows 7):

i) Logon as an administrator, and create a new NTFS volume

ii) Blow away the standard MS ACLS on the root of the volume (which are laughable), and replace with Administrators:Full Control, System:Full Control, e.g.:

echo Y|cacls.exe d:\ /g "Administrators:F" "SYSTEM:F"

iii) Now, from a Command Prompt shell window or PowerShell window, switch to that drive (cd /d D:\ or set-location D:\ ). Works fine... no issues.

iv) Now, try to browse to the root of the new volume using MS Explorer... Access denied.

Now, I've kind of convinced myself that it is UAC getting in the way, as you can add "Authenticated Users:List" access to D:\ and Explorer then works. I can only assume that MS Explorer isn't able to use the "admin" token for the Administrator. Browsing to explorer.exe and doing a "Run as administrator" has no effect.

Any thoughts?

Cheers in advance.

share|improve this question
Looks like I may have just found an answer to this…. Apologies for self-answering. Will test in tomorrow. – Simon Catlin Sep 4 '12 at 21:10
Didn't work ;-( – Simon Catlin Sep 5 '12 at 15:45
up vote 3 down vote accepted

Yep, that is UAC. Explorer windows don't really accept admin tokens via UAC.

share|improve this answer
One of the many reasons why UAC is best disabled. – Ansgar Wiechers Sep 4 '12 at 21:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.