Technology Tips and News
I am unable to copy files to the Program Files or Program Files (x86) folders, despite my status as Administrator on a single-user system. As an advanced user, I have many legitimate needs to place files there and cannot live with this level of protection from myself.
How can I defeat this? Many thanks.
Rick A.
Pleasanton CA
The 2 "Program Files" folders have super-duper protections on them. Unfortunately in Windows8 I don't think there is a way to remove it because it is tied in to UAC and you can't turn off UAC any more.
The workaround is that while you cannot directly save to the "Program Files" folders (for example, from notepad) you can copy files into it. So to change a ini file or something like that you have to:
This is why I created a "c:\MyPrograms" folder and install everything into it
The 2 "Program Files" folders have super-duper protections on them. Unfortunately in Windows8 I don't think there is a way to remove it because it is tied in to UAC and you can't turn off UAC any more.
The workaround is that while you cannot directly save to the "Program Files" folders (for example, from notepad) you can copy files into it. So to change a ini file or something like that you have to:
This is why I created a "c:\MyPrograms" folder and install everything into it
Have you run Explorer with elevated rights? If this does not help, then start Explorer in Scheduled Tasks with SYSTEM account.
Rgds
Milos
The 2 "Program Files" folders have super-duper protections on them. Unfortunately in Windows8 I don't think there is a way to remove it because it is tied in to UAC and you can't turn off UAC any more.
The workaround is that while you cannot directly save to the "Program Files" folders (for example, from notepad) you can copy files into it. So to change a ini file or something like that you have to:
This is why I created a "c:\MyPrograms" folder and install everything into it
Many thanks, Mark.
I do not need to save to the Program Files folders; I just need to copy files there. The UAC prompt is only annoying, but once I get past it, I am faced with Access Denied errors.
I wish I had thought of creating my own Programs folder...who knew?? I absolutely positively must be able to have write access to the Program Files folders. If I cannot resolve this, I will most certainly be retreating to Windows 7. Any thoughts and advice would be appreciated.
Niki, I have confirmed that I am a member of only the Admin group. As for that Advanced tab off of Security, curiously, I am listed there twice. Here is a screen image -- can you shed any light...?
Niki, I have confirmed that I am a member of only the Admin group. As for that Advanced tab off of Security, curiously, I am listed there twice. Here is a screen image -- can you shed any light...?
Please check the following two areas.
1. Go to Computer Management, expand Users in the left pane, double click the current user, ensure it is only a member of Administrators group. Remove other groups such as users.
2. Go to C drive, right click Program Files, on Security tab click Advanced, check if Administrators has full control.
Niki, I have confirmed that I am a member of only the Admin group. As for that Advanced tab off of Security, curiously, I am listed there twice. Here is a screen image -- can you shed any light...?
My permissions look exactly like that. The key is that "Administrators" have full control.
If it is a one-time thing, you can log in as the actual administrator account, I believe it can read/write to the folder without any UAC restrictions. Go to ComputerManagement (right-click in lower left corner) and select the local user account Administrator and enable it. Then you should be able to log in as it if you need to
Worked.
But, this is such a stupid thing that MS did. Hope they fix it.
Bp
Rick,
I know this is an old thread, but can't believe no one actually solved your problem the right way.
First: you should not use an administrator user for day to day tasks. it puts your system at risk which is why the default admin account is disabled. simple elevate your user permissions only where necessary. ( such as allowing write access to program files, vice adding to admin group)
second: windows permissions work in a combined manner. and more importantly, deny permissions will always trump allow permissions. Your 'user' membership is trumping your 'admin' membership.
in your screenshot you noticed your self that you are listed multiple times, (with multiple permission sets). one listing says you only have read & execute, that permission set also means you are denied write access. Even though you have another permission set that marks you as an administrator, the lower permission set is trumping it. It is a security feature and a good one. simply removed your other permission sets, and leave only one, either your specific user which is granted full control, OR just leave the administrators account which has full control (since you are a member of that group).
I know it seems like a pain, but it is really to make your system more secure.
Sincerely,
Nick
I appreciate your chiming in on this, Nick. I tried to follow your instructions, but I do not know how to remove the permission sets. The Remove command is not available for the user membership (or any of the others, for that matter). I tried logging in as Admin to see if that made a difference; it did not.
Can you tell me how I would remove a permission set?
Nick - good catch! though I am not sure it is accurate for Win8. My account is a member of "Administrators" and "HomeUsers" and is not a member of "Users," yet I have the same issue and am also unable to make any changes to permissions of the Program Files folders. Unless "Users" at the file permission level refers to the category of "any user on the computer" rather than the specific local group "Users."
Update: "Authenticated Users" is a member of "Users" which should mean that it is the category rather than the specifics. Poorly done, if I am a member of a group, either explicitly or implicitly then it should say so.
Rick - if you click the "change permissions" button, normally you should get the ability to make changes. However in this case you can't so you still need to log in as "administrator" before you make the change.
Note that I wouldn't remove the "allow users (Rick-Desktop\Users) read/execute" line, instead, add the "modify" permission to that groups permissions. The reason is that any other user account that is not a member of Administrators will start failing in strange bizarre ways since they will have no access at all to the program file folder
Mark
Nick - good catch! though I am not sure it is accurate for Win8. My account is a member of "Administrators" and "HomeUsers" and is not a member of "Users," yet I have the same issue and am also unable to make any changes to permissions of the Program Files folders. Unless "Users" at the file permission level refers to the category of "any user on the computer" rather than the specific local group "Users."
Update: "Authenticated Users" is a member of "Users" which should mean that it is the category rather than the specifics. Poorly done, if I am a member of a group, either explicitly or implicitly then it should say so.
Rick - if you click the "change permissions" button, normally you should get the ability to make changes. However in this case you can't so you still need to log in as "administrator" before you make the change.
Note that I wouldn't remove the "allow users (Rick-Desktop\Users) read/execute" line, instead, add the "modify" permission to that groups permissions. The reason is that any other user account that is not a member of Administrators will start failing in strange bizarre ways since they will have no access at all to the program file folder
Mark
Nick - good catch! though I am not sure it is accurate for Win8. My account is a member of "Administrators" and "HomeUsers" and is not a member of "Users," yet I have the same issue and am also unable to make any changes to permissions of the Program Files folders. Unless "Users" at the file permission level refers to the category of "any user on the computer" rather than the specific local group "Users."
Update: "Authenticated Users" is a member of "Users" which should mean that it is the category rather than the specifics. Poorly done, if I am a member of a group, either explicitly or implicitly then it should say so.
Rick - if you click the "change permissions" button, normally you should get the ability to make changes. However in this case you can't so you still need to log in as "administrator" before you make the change.
Note that I wouldn't remove the "allow users (Rick-Desktop\Users) read/execute" line, instead, add the "modify" permission to that groups permissions. The reason is that any other user account that is not a member of Administrators will start failing in strange bizarre ways since they will have no access at all to the program file folder
Mark
RickAltman - I don't think there is a good solution to this. Microsoft has invested considerable energy into preventing you from doing what you want to do - They believe for security purposes nobody should write/edit in the program files folder.
If you want to edit text/ini files, right-click on the notepad executable and select "run as administrator" that should give you the ability to directly load/save to the area. For other uses, I suspect you would have to delete the permissions directly in
the program files folder - and make sure you have a good backup because in all probability it will destroy functionality somewhere.
I think the ultimate answer is - you can't. Which is why I made a new folder called "c:\Programs" and installed all of my apps in there instead of "program files." It is less secure but at least I can do what I want to do.
Good Luck!
Mark
While I understand MS's position, they are unrealistic, and seems to be going the way of iOS by hiding the ability to do simple things.
For example, I have plugins I use for Adobe After Effects, and the simply need to be copied into the correct subfolders in the "program files" folder. Not allowing me to do so is absolutely Mac-ish and unacceptable.
The workaround, which is stupid too, is to set permissions correctly (which I have), and then copy the files to my desktop and THEN to the location inside the "program files" folder.
Ludicrous.
While I understand MS's position, they are unrealistic, and seems to be going the way of iOS by hiding the ability to do simple things.
For example, I have plugins I use for Adobe After Effects, and the simply need to be copied into the correct subfolders in the "program files" folder. Not allowing me to do so is absolutely Mac-ish and unacceptable.
The workaround, which is stupid too, is to set permissions correctly (which I have), and then copy the files to my desktop and THEN to the location inside the "program files" folder.
Ludicrous.
Thanks for this much easier fix.....It is stupid that this has to be done...But it worked perfectly
Thanks
While I understand MS's position, they are unrealistic, and seems to be going the way of iOS by hiding the ability to do simple things.
I can understand the need to set up an operating system for the masses (who don't understand computing concepts very well) so that it's more "idiot proof". The problem is that people who don't fully understand what they're doing tinker around and destroy their ability to run Windows. Or malware does it for them.
And I don't think anyone ever said that the file system security setup - originally developed by Digital Equipment Corporation - is simple or easy to deal with. I got training in it at a 1980 DEC conference that has proven oh so valuable in dealing with permissions issues over the decades. It's funny the little things that prove useful in life.
With suitable knowledge and reconfiguration (and even the application of 3rd party programs) the system CAN be made to be much more powerful FOR the (knowledgeable) user and less protected FROM the (knowledgeable) user. This suits power-users.
Some things said in this thread that are not accurate or are incompletely stated:
Folks, let me turn this discussion around a bit. I am sure you can fool your own machine into whatever state you need it to, but what do i do with my customers' machine(s) when i install my software on it? My program needs to record users' preferences. THey get written to an XML file. The XML file is created in the same directory where the exe is --- and by default, it would be the Program Files folder -- at which point, my code blows up. So, my bigger question is: what/where is the simplest way to save user's preferences via a file if the Program Files\MyAppName directory is protected?
thank you.
Software installers are generally expected to set the permissions on all the folders, registry keys, etc. that they will need their application to be able to access. This is why protections get escalated to Administrator level (and thus a UAC prompt is issued) when those installers run.
There are ways - including as Bob mentions above, using the ProgramData folder - for installing software without need for an escalation. If you use exclusively the folders you're allowed (and encouraged) to write into to store program data, the installer manifest won't need to specify the need for escalation.
This list shows the "known folders" in Windows. For user-specific data, consider using the CSIDL_APPDATA location.
http://msdn.microsoft.com/en-us/library/windows/desktop/bb762494(v=vs.85).aspx
There's no real problem about writing to a file anywhere on your system if you have been granted permissions to do so. I don't know the Debugging Tools for Windows, but it may make sense to keep a .ini file in a single central location - for example if the tools are such that there can't be different preferences per user, that sort of thing.
Microsoft has taken it upon themselves to deem writing to some parts of it "undesirable", in an effort to help settle down problems people and malware cause - thus UAC was born, such as it is. That doesn't keep a different part of Microsoft from not following that guideline.
Worked.
But, this is such a stupid thing that MS did. Hope they fix it.
Bp
Worked.
But, this is such a stupid thing that MS did. Hope they fix it.
Bp
UAC is a poor implementation of a questionable idea. Call me opinionated, but I consider this a simple truth.
Inviting malware into your system then trying to block it with permissions at the last instant from changing the files it wants is not a reasonable approach.
Why not?
Because users typically just mechanically "click through" to grant permission to whatever pops up. They don't want to be bothered, because the computer should protect itself and they want to keep doing whatever it is they're doing, not talk something over with the OS. Boom, after that the malware is in. What did UAC do? Annoy, but not protect.
Far, FAR better than using UAC is blocking parasite web sites with the MVPS hosts file, not allowing ActiveX to run from just any old web site on the wild internet, and back these things with a good anti-malware solution as a safety net. But perhaps paramount to all this is to just practice responsible, intelligent computing practices. If you're doing things right you DON'T need UAC and you'll never see a notification from the anti-malware software having to block something bad. If I weren't living this dream myself I wouldn't say it. I've installed each of XP x64, Vista x64, Windows 7 x64, and now Windows 8.1 x64 EXACTLY ONCE. Never had an infection, never had a UAC prompt - because I turn that useless annoyance off.
What works for me is to run Windows Explorer as Administrator (right-click and select "run as administrator")...
Then everything you do as far as working with any files is "normal" then...
Carry on...
I am having a similar problem with the C:\ folder. I am simply trying to edit a text file there, which I have edited recently, along with other files (though there was an update recently?).
Changing permissions does not help, partly because when they are being changed, messages appear to say that access to given folders/files is denied. I get this even when logged into the hidden admin account.
If I go to Computer Management, I cannot see the Users and Local Groups section.
Control Panel - Admin Tools - no Local Security Policy option visible.
With UAC turned on, the root folder C:\ is basically off limits for users writing files there, it's way too easy for malware to mess with your boot files that way. You'll have to copy or move the file somewhere else to edit it.
You can't copy files to the root of C without providing the admin password. If you are a User with Administrator privileges, you are never prompted to give the password and then it fails.
If you are a standard user, you can move a file to the root of C because it asks you for an Administrator password to do so.
The workaround I use is the following and it works every time:
1) Start command prompt with admin rights. (Search for "cmd" --> right click "Command Prompt" --> "Run as administrator. Or just right click the start button and select "Command Prompt (Admin)".
2) Type: cd "address"
Where address is the location of the file you want to copy. e.g. if the location is the desktop, then type: cd "Desktop"
2) Type: copy "filename.extension" "new_address"
Where filename.extension is the name of the file you want to copy along with its extension and new_address is the location where you want to copy the file. e.g. if the filename is "test" with an ".exe" extension and Program Files is the location where you want to copy the file, then type: copy "test.exe" "C:\Program Files"
The workaround I use is the following and it works every time:
1) Start command prompt with admin rights. (Search for "cmd" --> right click "Command Prompt" --> "Run as administrator. Or just right click the start button and select "Command Prompt (Admin)".
2) Type: cd "address"
Where address is the location of the file you want to copy. e.g. if the location is the desktop, then type: cd "Desktop"
2) Type: copy "filename.extension" "new_address"
Where filename.extension is the name of the file you want to copy along with its extension and new_address is the location where you want to copy the file. e.g. if the filename is "test" with an ".exe" extension and Program Files is the location where you want to copy the file, then type: copy "test.exe" "C:\Program Files"
The workaround I use is the following and it works every time:
1) Start command prompt with admin rights. (Search for "cmd" --> right click "Command Prompt" --> "Run as administrator. Or just right click the start button and select "Command Prompt (Admin)".
2) Type: cd "address"
Where address is the location of the file you want to copy. e.g. if the location is the desktop, then type: cd "Desktop"
2) Type: copy "filename.extension" "new_address"
Where filename.extension is the name of the file you want to copy along with its extension and new_address is the location where you want to copy the file. e.g. if the filename is "test" with an ".exe" extension and Program Files is the location where you want to copy the file, then type: copy "test.exe" "C:\Program Files"
This thread was an excellent educational lesson for me! Not only is my understanding of UAC's and related Permission settings deepened but I was also able to lift out a Read-Only file from a directory within the Win 7 Program Files (x86) folder, edit it and then place it right back inside the originating folder. Best of all, doing so didn't harm the program whose file was edited.
Chances are that I won't remember all the information contained in this valuable thread as until today, I had never needed to edit any file within the protected (x86) folder. But, I've bookmarked the topic as it contains very good information about UAC's and File Permission settings.
Many thanks to everyone who contributed in this thread!
Excellent - Thank
Best is to store file somewhere else like under user profile or you could update the registry to allow access:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
set EnableLUA to 1
Make sure you have turn of ur UAC settings to Do not notify. Then just restart your PC.
This is NOT recommended because it provides modify access to your local C drive.
Actually, windows NTFS permissions combine to the least restrictive level of permissions, not the the most restrictive. If you are a member of a group with write permissions and another group with read permissions and your account is given Full Control, you have effectively full control. Unless your account or a group you are a member is explicitly denied a right (by clicking the Deny tick box) -- Deny trumps everything.
This topic is archived. No further replies will be accepted.
Other recent topics
Click here to get your free copy of Network Administrator. Over 25 plugins to make your life easier