Signed On As Administrator, but Denied Access

Is the user logged in as an administrator?

If so, you can set the browser (I'm assuming your program is started from
the browser) to run via task scheduler with highest privilege, which will
make it have admin privs when it starts up. This is as opposed to however it
is starting automatically now.

This will not work correctly if the user is not an admin.

A better temporary solution would be to create a manifest for your
application and deploy it with your application, that will make it ask for
admin permission from the user whenever it starts.

The IT people could create this manifest themselves if the app is already
deployed.

A manifest file takes the following name, and must be in the same location
as the file it goes with:

yourprogram.exe.manifest

(where yourprogram.exe is the filename of the program the manifest is for).

The manifest file would contain the following data to have it always prompt
for admin permission:




<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">

<assemblyIdentity
version="5.1.0.0"
processorArchitecture="x86"
name="PROJECTNAMEHERE"
type="win32"
/>
<description>Unknown</description>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel
level="requireAdministrator"
uiAccess="false"
/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>






--
- JB
Microsoft MVP - Windows Shell/User

Windows Vista Support Faq
http://www.jimmah.com/vista/

I should add,

Since you mentioned that the program is downloaded automatically from the
browser... if you know for certain what the program executable will be named
and where it will be stored when the browser downloads it, the manifest file
can be created for that file and put in that location before the program is
downloaded.


--
- JB
Microsoft MVP - Windows Shell/User

Windows Vista Support Faq
http://www.jimmah.com/vista/

"Jimmy Brush" <jb@mvps.org> wrote in message
news:F2DE4FAD-1391-44BB-92A4-450C70A4FC48@microsoft.com...

>... I understand that you are having issues because of this change because
>you are using older programs that do not know how to ask for your
>permission; however, these issues will go away as programs are made that
>work with Windows Vista, and the fix for these programs is really simple
>(right-click them and click run as administrator for short-term; for long
>term, right-click, click properties, click compatability tab, and tell it
>to always run as administrator).

How would I do this for VBScripts which must be run by CScript?
I'm running Microsoft's WMIDiag.vbs, and some of the WMI namespaces belong
to a user who was deleted as part of the initial boot process of a
preinstalled Vista Home Basic system (I think). Output of WMIDiag gives me
errors like:
(1) !! ERROR: Default trustee 'BUILTIN\ADMINISTRATORS' has been REMOVED!

-Paul Randall

Hello,

I replied to your original thread, but apparently it didn't propogate to the
nntp server for some reason ...

Programs that don't prompt (like cscript in this case) receive a filtered
version of the user's administrator token, which in effect gives that
program only standard user rights. I believe this is what is causing your
errors.

You need to start cscript with admin power. To do this, open a command
prompt that you have run-as-administrator'd, and then run cscript with the
propper arguments to start your script. This will cause cscript to run with
the full administrator token, and it should work correctly.

More info on UAC:

http://technet2.microsoft.com/Window...6c2d91033.mspx
http://technet.microsoft.com/en-us/w.../aa905108.aspx
http://blogs.msdn.com/uac/

Here's my original message:

Hello,

This is due to the new security feature of Windows Vista that Tom referred
to (UAC).

He explained how to turn it off, but he didn't explain what it does, what
benefits it gives you, or how to do what you were trying to do with UAC
turned on .

Quick solution: Right-click command prompt, click run as administrator, then
start your vbs script, and it will work fine.

Now on to the explanation of what's going on ...

Very simply, UAC draws a line on your computer between administrative
programs and non-administrative programs.

UAC then enforces a single rule: Programs must have your permission in order
to have administrative power.

This gives you the following benefits:

- Programs that don't need admin power, don't have it (why give someone the
keys to your car if they will never drive it)

- Any program that wants full control over your computer must ask you for
permission, or you must explicitly start it with admin power by
right-clicking it and clicking Run As Administrator

Specifically, this protects you from programs that:

- Would try to perform administrative operations without your knowledge or
consent

- Would try to be sneaky and start an administrative program without your
knowledge/consent to bypass restrictions ("Hey I didn't start format.exe, I
don't want it to run!")

- Would try to abuse/exploit a currently running administrative program in
order to take control over your computer

So, here's how to successfully use Vista when logged in as an administrator
with UAC turned on:

Just remember that if you are starting a program or performing an action and
it doesn't prompt, then it will not have administrative control over your
computer.

- When running command-line programs: You will need to run administrative
command-line programs from an administrative command prompt (right-click
command prompt and click Run As Administrator)

- When running a Vista-compatible program: You don't have to do anything
special, these programs will prompt you automatically if they want admin
access to your computer

- When running old programs not designed for Vista: If these programs needs
admin access to your computer, right-click them and click Run As
Administrator. If you use it a lot, right-click the program, click
properties, click compatability, and put a check next to always run as
administrator. This will cause the program to automatically prompt every
time it is run.

Turning off UAC takes this extra control away from you and makes things work
like Windows XP, where any program that happens to run on your computer can
do anything it wants to your computer.

Also, turning off UAC disables Internet Explorer protected mode, because it
uses UAC's seperation-of-privilege in order to work.

--
- JB
Microsoft MVP - Windows Shell/User

Windows Vista Support Faq
http://www.jimmah.com/vista/

Great advice if the option to always run as adminstrator was available to
check - its greyed out even though I'm the administartor. Whats the work
around in this case ?

"Jimmy Brush" wrote:

> Microsoft is not "determining how you use your computer" at all.
>
> There is *nothing* you are blocked from doing now; an administrator has as
> much power to do things as they did in Windows XP.
>
> The only difference is that *you* now have control over which programs can
> use *your* administrator power.
>
> I understand that you are having issues because of this change because you
> are using older programs that do not know how to ask for your permission;
> however, these issues will go away as programs are made that work with
> Windows Vista, and the fix for these programs is really simple (right-click
> them and click run as administrator for short-term; for long term,
> right-click, click properties, click compatability tab, and tell it to
> always run as administrator).
>
> The best advice I can give is that if you are getting errors such as "access
> denied" or "you have to be an administrator to do this", it is because the
> program you are using is not designed for Windows Vista, and needs to use
> your administrator power in order to be able to do what it needs to do, but
> doesn't know how to ask you for your permission.
>
> In order to allow it to do what it wants to do, right-click it, and click
> Run As Administrator; just be aware that this will give that program *full
> access* to your computer, so be sure you trust the program with such access
> before doing it.
>
> This security feature in Windows Vista gives you the following assurances:
>
> * Programs that run on your computer can *ONLY* have full access to your
> computer with *YOUR* knowledge/permission; programs that don't need or don't
> ask for full access to your computer, don't get it
>
> * You are notified EVERY TIME a program requiring full access to your
> computer starts; this protects you from programs loading trusted, system
> components and using them against you ("Hey, I didn't start format.exe...
> what is it doing running?")
>
> These are good things
>
>
> --
> - JB
> Microsoft MVP - Windows Shell/User
>
> Windows Vista Support Faq
> http://www.jimmah.com/vista/
>

If you are not referring to a shortcut, make a shortcut to the program and
follow the steps below:

Otherwise (it is a shortcut), follow these steps:

- Right-click the shortcut
- Click Properties
- Click "Advanced..." button
- Check "Run as administrator"
- Click OK
- Click OK


--
- JB
Microsoft MVP - Windows Shell/User

Windows Vista Support Faq
http://www.jimmah.com/vista/

This reply is completely arrogant. A person is locked out of their home and
you tell them about the importance of security. Vista is a bad joke in my
opinion. I just installed software I wrote and minutes later I find I cannot
uninstall it.

g

"Jimmy Brush" wrote:

> Hello,
>
> In Windows Vista, even though you are an administrator, the programs that
> run on your computer are not allowed to use your administrator power unless:
>
> 1- They prompt you for permission
> 2- You explicitly give them permission (right-click, run as administrator)
>
> The files in Program Files and your root C drive are not writiable by
> non-administrative programs because the files in these areas affect every
> user and the entire system.
>
> Allowing unpriviliged programs write access to these areas would allow them
> to overwrite/replace well-known programs or system-wide configuration data
> used by windows or well-known programs, which is unacceptable for a program
> that does not prompt.
>
> The easiest way to accomplish what you are doing is to save the file to some
> place in your user profile (such as documents), and then using windows
> explorer, move that file to program files. This will end up prompting you
> for permission and then allowing things to work.
>
> Alternatively, you can run the program that is doing the downloading "as
> administrator" by right-clicking it and clicking Run As Administrator, and
> this will allow it to save to this area, but the solution above is better.
>
> --
> - JB
> Microsoft MVP - Windows Shell/User
>
> Windows Vista Support Faq
> http://www.jimmah.com/vista/
>
>

I bought a laptop with vista basic on it used it for about a week. Now it
tells me access denied to my hard drive. Can't save anything and can't
delete anything. Any help?



"TelGar" <TelGar@discussions.microsoft.com> wrote in message
news:8A80DF51-8A3C-4BF4-A4FF-8E951BAD0E01@microsoft.com...

> This reply is completely arrogant. A person is locked out of their home
> and
> you tell them about the importance of security. Vista is a bad joke in my
> opinion. I just installed software I wrote and minutes later I find I
> cannot
> uninstall it.
>
> g
>
> "Jimmy Brush" wrote:
>

I have a similar problem.

I am trying to install an anti-virus/anti-spyware that Rutgers requires
on my daughters toshiba laptop.

The downloaded app that does the install tries to save a file to
C:\Windows\TMP directory, this fails because this directory has
been marked as read only. The app does not give a choice on
where to write this file.

I use the file manager to get to the directory, select it and do a properties
on it. I says it is read only, I turn off read only and apply.

I go back and look at it and lo and behold, it is read only again.
Vista does not want to allow this directory to allow writing although
I am told this directory should be writable.

My daughter also tells me she was in the file manager and may have accidently
move a file - doesn't know what it was.

Is there any file system integrity checker in vista (like scf in xp) or
anything
else that will solve my problem?

Scott Holland
sgh54@verizon.net (better)
sgh@drexel.net

Scott

Have you tried right clicking the installation file and selecting the 'Run
as administrator' option? This will usually fix the problem.

--

Ronnie Vernon
Microsoft MVP
Windows Shell/User


"sholland" <sholland@discussions.microsoft.com> wrote in message
news:39AC6915-6E3E-431C-B31F-FD214F4E670A@microsoft.com...

>I have a similar problem.
>
> I am trying to install an anti-virus/anti-spyware that Rutgers requires
> on my daughters toshiba laptop.
>
> The downloaded app that does the install tries to save a file to
> C:\Windows\TMP directory, this fails because this directory has
> been marked as read only. The app does not give a choice on
> where to write this file.
>
> I use the file manager to get to the directory, select it and do a
> properties
> on it. I says it is read only, I turn off read only and apply.
>
> I go back and look at it and lo and behold, it is read only again.
> Vista does not want to allow this directory to allow writing although
> I am told this directory should be writable.
>
> My daughter also tells me she was in the file manager and may have
> accidently
> move a file - doesn't know what it was.
>
> Is there any file system integrity checker in vista (like scf in xp) or
> anything
> else that will solve my problem?
>
> Scott Holland
> sgh54@verizon.net (better)
> sgh@drexel.net
>