Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have moved a windows script to a new machine running Windows Server 2008 R2 (from a machine running 2000).

The first thing the script does is rename a text file in the same folder as the script.

The file in question has the currently logged in user (which is an administrator) in it's security list with 'full control' set.

When I try to run the script by double clicking it (while logged into the machine as the same administrator with full control of the file) I get 'access denied' for the line where the file is renamed.

If I run the script via a scheduled task it can get beyond that point.

If I run the script indirectly via the 'runas' command running as 'Administrator' it gets past that point.

So it seems like Windows is simply ignoring the rights that the domain admin account has on the file.

Incedentally I also can't save any changes to the script file, I get access denied for that too.

Any idea how to stop the OS from ignoring the rights that the logged in user has on the files?

Edit: in response to Gnouc's comment I have taken ownership of the folder that contains the script and the other file the script is trying to rename. It now works. So it seems like for a script to work properly the user running the script needs to have 'full control' AND be the owner! Seems a bit restrictive, but I guess someone could argue that it's the OS being more secure.

share|improve this question
    
Do you try take ownership? –  Gnouc May 16 '13 at 10:22
    
No, but I just tried it and the script is now 'allowed' to make the change. So I guess not only does an account need to have 'full control' of somethig, but it also needs to own it? Anyway, thanks for the suggestion :) –  MrVimes May 16 '13 at 10:30
    
What are the permissions on the file? Are these files in a system protected area? Are you right-clicking and choosing 'Run as Administrator' in order to elevate in UAC? This sounds very similar to one of your other recent questions: serverfault.com/questions/504975/… –  jscott May 16 '13 at 10:31
    
the script does not have the 'run as administrator' option. Not all file types have that. I was able to run it as administrator by passing it as an argument to wscript.exe. As mentioned - the permissions on the file are full control for the logged in user. –  MrVimes May 16 '13 at 10:34
add comment

2 Answers

First, when a task is run using the Scheduled Task method, the script is run as the SYSTEM account, which supercedes the Administrator account. The Administrator account does not have all-permissions in Windows. When a file is copied by a user, the file ownership and permissions of the new file derive from the user performing the task. In this case, the SYSTEM account.

You have 2 possible solutions:

  1. You can alter the scheduled task to run as a specific user.
  2. You can use the cacls command to change the ownership/permissions of the files once copied.
share|improve this answer
    
Actually the scheduled task was already running the script as the same user that I tried to manually run the script as. –  MrVimes May 16 '13 at 10:43
    
Before you changed ownership of the file, who owned it? –  TheCompWiz May 16 '13 at 10:45
add comment

Because your system using NTFS, It will compare your SID of login session user with SID generated by ACL Entry. Your script using the old ACL from old system, so it can not evaluate the right ACL Enttry for your user.

The take ownership means:

Allows or denies taking ownership of the file or folder. The owner of a file or folder can always change permissions on it, regardless of any existing permissions that protect the file or folder.

So the script itself now can evaluate the ACL Entry, giving you the right permission.

More details about NTFS you can see here

Best regards.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.