I’m having a bad hair day. Man, am I frustrated with Vista security today. So in my last post I mentioned that I had problems with my SQL Server not recognizing my login as an administrator login. Well, after some more checking I think I can see that my account is not really an Administrative account.
It’s ridiculously hard to trouble shoot this and actually determine what your account status is. Vista itself shows everything as if my account was an administrative account, but (as shown below) it looks like the system itself doesn’t see me as an Administrator. So how do you tell whether you are REALLY an administrator or not?
It seems I’m an administrative user: I can run admin tasks like bringing up the Services panel or Device Manager or running IIS Service manager. If I run WHOAMI I get:
GROUP INFORMATION
-----------------
Group Name Attributes
====================================== ==================================================
Everyone Mandatory group, Enabled by default, Enabled group
RASVISTA\Debugger Users Mandatory group, Enabled by default, Enabled group
BUILTIN\Administrators Group used for deny only
BUILTIN\Users Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Mandatory group, Enabled by default, Enabled group
LOCAL Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Mandatory group, Enabled by default, Enabled group
Looks like I’m part of Adminstrators right?
Or am I? Look again at the Group used for deny only. I have no idea what that means but I suspect that’s what the problem is.
I also ran some code in an application to check for admin rights by checking for the Administrators group explicitly in code. While running through this I noticed that I wasn’t showing up as Administrators in this list either:
WindowsIdentity id = WindowsIdentity.GetCurrent();
string Out = "";
foreach(IdentityReference Group in id.Groups)
{
NTAccount Account = Group.Translate( typeof(NTAccount) ) as NTAccount;
Out += Account.ToString() + "\r\n";
}
MessageBox.Show(Out);
Which results in:
RASVISTA\None
Everyone
RASVISTA\Debugger Users
BUILTIN\Users
NT AUTHORITY\INTERACTIVE
NT AUTHORITY\Authenticated Users
NT AUTHORITY\This Organization
LOCAL
NT AUTHORITY\NTLM Authentication
Something missing here???? No Administrators group account.
This would explain why SQL Server is having a hell of a time trying to authenticate me as an Administrator.
So now I’m really confused as to WTF is going on. In Vista I have:
- UAC off
- Account type set to Administrator
- My User Account is part of the Administrators group in the old User Manager
- Run all administrators in Admin Approval Mode group policy option is disabled
What else do I need here to get my admin acount status back properly?