1

In our windows domain I am the Domain Administrator. I log into my servers with my domain administrator account via Remote Desktop.

Now, I just installed Windows Server 2012 and am working in it via RDP and discover that I cannot make changes to a text file because I don't have permissions. This problem extends to any file - not just text files, and the problem is not that they are set to read-only.

So just to make sure, I add my domain account to the local administrators group on that machine. I have also disabled UAC since I am behind a fancy firewall-router and have no security risks from local users.

So I go and check permissions on the c:\program files (x86)\ directory and see that the administrators group has no edit rights on that directory! Alas!

Then I try to give permissions to the Administrator's group and discover that I am not allowed (I'm Domain Admin!). To prove that, here is a screenshot. You can see that all the boxes are unchecked - they are actually disabled and I can't click on them.

Permissions Window

Ah, but a funny thing is this: If I look at the Users group for that directory's permissions, I see that group has permissions to Read & Execute but not modify. They have more permissions than Administrators!

How can I give my Domain Administrator account rights to edit a text file in that directory? Is there some local group policy setting?

Note: This problem does not extend to folders in the root of C. It only happens in special Windows directories. But I never had this problem in other Windows Server versions.

  • UAC? Did you Run as Administrator on notepad.exe? What does icacls "%PROGRAMFILES(X86)%" have to say? – jscott May 15 '14 at 1:31
  • Ha ha! I tried that. Windows told me that it was necessary to "elevate privileges"! The icacls command tells me that it can't find the file specified. – bgmCoder May 15 '14 at 1:49
  • Make sure you include the quotes in the icacls line, I just copy/pasted into a cmd prompt and it works. – jscott May 15 '14 at 2:03
  • I wrote exactly what you typed there. It seems not to know that path, even though I know it is there. – bgmCoder May 15 '14 at 2:10
  • What does the output of SET show? – jscott May 15 '14 at 2:11
2

The simplest way is to take ownership of the directory (which as an administrator, you can do), and then change the security permissions to suit your needs - add the administrators group or your user to the security permissions and allow full control, in this case.

  • I've tried that. I am domain administrator, but I cannot assign any permissions to the Administrators group for the program files folder. When I am in the permissions-setting panel, the options are all grayed out. – bgmCoder May 15 '14 at 14:55
  • Oh - I got it now. In "Advanced" of the Security settings I did as you said and changed the "owner" to the "Administrators" group. Then, as you said, I was able to assign permissions to the Administrators group - something I was not able to do before the Administrators group was the owner. Thanks for your clues! I found this link, too, with screenshots: mywindows8.org/grant-permissions-in-windows-8 – bgmCoder May 15 '14 at 15:15
1

I've run into the same issue on Windows Server, changing permission and ownership didn't help. But if I open my text editor as Administrator, I can then open the file from within the editor in write mode. It's annoying to have to do it this way rather than edit files from the context menu in Explorer but found this was the only workaround.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.