I have strange issue with file permissions.

F.e. On Windows 7 under Virtual PC I have VM with enabled undo disk. Permissions for .vhd file of this VM grant full control to local Administrators group, of which I'm a member. I have checked in advanced properties of this file and confirmed that my user account (it domain account) has full effective permissions. Ok, this expected. However, when I try to applying changes in virtual machine undo disk, I receive an error message saying that one of master or undo disk for this VM is busy (I have checked, this is not true - both files are not open by any process). Notice, that this error message doesn't mention anything about permissions at all! However, after explicitly granting to my domain account full permissions for this VM vhd file (which doesn't change my effective permissions, as I already have full permissions as a member of local administrator group! I have checked it!), I could apply with any errors changes made to VM undo disk!


Described here case of applying changes to VM undo disk is only one example of many other similar situations, when granting appropriate permissions to groups of which I'm a member is not enough and I have explicitly grant permissions to my account too. I have observed this behavior under Windows 7 and Windows Server 2008, but not on Windows XP.

(P.S. In any of such case, none of permissions entry uses explicitly denying permissions)

Could someone explain me where is the problem?


I'm not familiar with all the pieces of what you're doing, but any time that I find that adding explicit permissions for an account with "Administrator" permissions "works" when an already-existing permission applying to "Administrators" isn't working I think "User Account Control". I have a suspicion that the operation you're attempting that's failing is running with a token that has your domain account's "Administrators" group membership stripped out of it. Applying a permission that explicitly names the domain user account "works" because your token does have your account's SID in it.

Try doing the operation from an "Administrator" instance of "Explorer" or command-prompt and I think you'll find it works fine w/o the explicit permission being added for your domain account.

  • Hm, you probably have right, that may be an explanation, but shouldn't I get an UAC prompt in such situations? – user71061 Mar 11 '11 at 13:48
  • UAC prompts come from "Explorer". Other applications that you run aren't going to generate them. I'm not familiar with "Virtual PC" at all, so I don't know exactly what you're doing. My guess is that you're running something that doesn't bother checking to see if it's running w/ a stripped token and doesn't ask Explorer to elevate. You can graphically demonstrate this by running a command prompt while logged-on as an "Administrator" user w/o elevating and then trying to change a file in the "\WINDOWS" directory. You'll just get an "Access denied" message-- no UAC prompts at all. – Evan Anderson Mar 11 '11 at 13:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.