I have a Windows 2008 machine A with Administrator account X. I have another Windows 2008 machine B with Administrator account Y.

Both machines have an account Z, with same username and password on both.

Account Z is in the local Administrators group on both machines.

They're not on a domain.

From machine A, as user Z (the Administrators one that's common to both machines) I want to start/stop services on Machine B.

(I actually want to do this programatically from c#, but for now via the command line to prove it works is my aim.)

I've tried a few things (e.g. using runas /user:Z cmd, then using sc.exe), but found SysInternal's psservice to be nice and flexible, since I can specify a username and password on the command line. I've also tried coding it via WMI.

I always get the same result:

If I use the user/pass for Account Y (then actual admin on machine B), it works. If I use the user/pass for Account Z (or impersonate it locally), it fails with access denied.

Since Z is in the Administrators group, why is this the case?



Here are my UAC settings on both machines:


  • just because z is in admin does not mean the commands are being run as admin you must elevate the command to admin as in runas admin. Uac is involved more then likely. – tony roth Aug 3 '12 at 16:01
  • I'm not trying to run as the admin user, I'm trying to runas user Z. I have tried using runas /user:Z. UAC is disabled on both machines. – Nik Aug 3 '12 at 16:04
  • I know you are trying not to runas admin and you are doing the correct thing by doing a runas/user:Z etc. What error message do you get? Sorry I missed the "runas/user:Z" in your post. – tony roth Aug 3 '12 at 16:15
  • do the runas again then run "wmic /node:b os" whats the result? – tony roth Aug 3 '12 at 16:17
  • "Access is denied" comes back immediately. – Nik Aug 3 '12 at 16:22

Very grateful to everyone's comments, but here is the answer:


There is a registry setting


Which impacts this.

If I set that registry entry to 1, everything works as expected - users in Admin group can access remotely properly.

It's not clear to me whether this is over and above any UAC setting (i.e. those local UAC settings never impact remote access), or whether my disabling of UAC is somehow inadequate. (I disabled it by using the Windows UI - my settings are as per the original question screenshot).

  • 1
    good work! hate things like this. – tony roth Aug 6 '12 at 17:33
  • Damn nice work. Shocking that it would be something to do with UAC (well, split-token administrative sessions). – HopelessN00b Aug 8 '12 at 3:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.