Already a member of group Administrators

I double checked and my logged in account is a member of the local machine group Administrators.

I tried, in Files Explorer, to navigate to C:\Program Files\Microsoft SQL Server\MSSQL12.SQLEXPRESS\MSSQL\DATA.  It blocked me. - You don't currently have permission to access this folder.  Click Continue to permanently get access to this folder.  I did not click Continue but instead took a look at the folder Properties Security tab, but it said "You must have Read permissions to view the properties of this object.  Click Advanced to continue. "

I clicked Advanced, and in the Owner field it says Unable to display current owner.  Under the Permissions tab there is a Continue button with the UAC logo.  I clicked that (don't know whether that involves updating the ACL for this folder), and one of the Permission entries is Allow, Administrators, Access Full control, This folder, subfolders and files

Under the Effective Access tab, I selected my the account that is used to logged in to this PC, and it said Full control, and a long list of positive rights.

If my account is a member of the Administrators group, and the Administrators group has Full control, why can't it open the folder or view the security properties by default.

If my account has Full control on the folder whey can't it open the folder or view the security properties by default?

This thing has been puzzling me for some time.  Thanks.

April 4th, 2015 9:28pm

Could be this helpful for you?

http://answers.microsoft.com/en-us/windows/forum/windows_8-files/need-permission-from-administrators-when-logged-in/2004939f-7319-4d7a-9142-93dc1b7cd749

You can try to use the PowerShell command for giving the permissions.

for each($folder in C:\Program Files\Microsoft SQL Server\MSSQL12.SQLEXPRESS\MSSQL\DATA)
    {
        $Ar = New-Object system.security.accesscontrol.filesystemaccessrule("Administrators","Full","Allow")
        $Acl.SetAccessRule($Ar)
        Set-Acl $folder ($Acl)
    }

Free Windows Admin Tool Kit Click here and download it now
April 5th, 2015 1:12am

My question was not on what to do or change in order for me to access the file or folder.  My question was why I was initially prohibited from accessing the item when I had effective full rights to that item.  Why did it say "You currently don't have permission" when I had the permission, and why did it say "You must have read permissions to access to view..." when I already had read permissions.

All the linked references were people having trouble accessing some file object.  But one hint caught my attention: now processes don't run with administrator rights even if they are administrators.  So it seems that for those times when the system didn't balk, I was accessing an object through one of the other non-administrator ACL entries, could be Authenticated Users or Users.  If an object has no ACL entries except those of administrators, the system will stop it unless the process is elevated (manually).

It can be easily demonstrated by removing everything from the ACL of a file except the group Administrators

The confusion arose because of the misleading messages from Windows.  They say "YOU" do not have permissions" which is clearly not true.  They should say something like "the security context of the process you are currently running does not have permissions".

April 5th, 2015 3:26am

Hi,

As you said, if a user account belong to local Administrators account, when only Administrators group has permission on a folder, all admins except the build-in Administrator account will not have permission to access it.

This is because all accounts in local Administrators group are working as standard accounts. When an Administrator action need to be performed, a prompt will occurs for permission to promote to admin permission. As only Administartors group has permission on a folder and the account we are using is working like a standard account, we will be denied from accessing.

This is how UAC works as the purpose is to notice the current user any admin action which may be initialed by an known process. 

A workaround is to create a new group for all admins and give the group enough permission for accessing the target folder like you just did.

Or you could run all accounts in Administartors group in Admin mode. See this article:

UAC Group Policy Settings and Registry Key Settings

http://technet.microsoft.com/en-us/library/dd835564(WS.10).aspx

Free Windows Admin Tool Kit Click here and download it now
April 7th, 2015 5:42am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics