I am an admin on the machine, but yet, I am unable to access all folders on the machine. For example, another admin had a script on his desktop folder that I needed, and I was not able to get it through my login. We had to use a local admin account to get into that folder. This is a deviation from prior behavior on Windows Servers.

What is the benefit of this lockdown?


This is a result of User Access Control (UAC). With UAC on, even if your account is in the local Administrators group then granting access on a directory to the Administrators does NOT grant you access. If you turn UAC off then the behaviour goes back to the Win2k3 model and permissions work as you'd expect. The only alternative to turning UAC off is to create a new group, grant this group full control at the root and then join all the local admins to the group.

Why MS designed things this way I'm not sure. Presumably it's because people routinely join their accounts to the Administrators group, and UAC offers some protection even when people do this. Personally I find it a pain :-) I tend to turn UAC off on servers that are not routinely logged into e.g. Exchange and SQL Servers. I do leave it on for Terminal Servers.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.