Am I an Administrator on Vista? No really am I?
I’m having a bad hair day. Man, am I frustrated with Vista security today. So in my last post I mentioned that I had problems with my SQL Server not recognizing my login as an administrator login. Well, after some more checking I think I can see that my account is not really an Administrative account.
It’s ridiculously hard to trouble shoot this and actually determine what your account status is. Vista itself shows everything as if my account was an administrative account, but (as shown below) it looks like the system itself doesn’t see me as an Administrator. So how do you tell whether you are REALLY an administrator or not?
It seems I’m an administrative user: I can run admin tasks like bringing up the Services panel or Device Manager or running IIS Service manager. If I run WHOAMI I get:
GROUP INFORMATION
-----------------
Group Name Attributes
====================================== ==================================================
Everyone Mandatory group, Enabled by default, Enabled group
RASVISTA\Debugger Users Mandatory group, Enabled by default, Enabled group
BUILTIN\Administrators Group used for deny only
BUILTIN\Users Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Mandatory group, Enabled by default, Enabled group
LOCAL Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Mandatory group, Enabled by default, Enabled group
Looks like I’m part of Adminstrators right?
Or am I? Look again at the Group used for deny only. I have no idea what that means but I suspect that’s what the problem is.
I also ran some code in an application to check for admin rights by checking for the Administrators group explicitly in code. While running through this I noticed that I wasn’t showing up as Administrators in this list either:
WindowsIdentity id = WindowsIdentity.GetCurrent();
string Out = "";
foreach(IdentityReference Group in id.Groups)
{
NTAccount Account = Group.Translate( typeof(NTAccount) ) as NTAccount;
Out += Account.ToString() + "\r\n";
}
MessageBox.Show(Out);
Which results in:
RASVISTA\None
Everyone
RASVISTA\Debugger Users
BUILTIN\Users
NT AUTHORITY\INTERACTIVE
NT AUTHORITY\Authenticated Users
NT AUTHORITY\This Organization
LOCAL
NT AUTHORITY\NTLM Authentication
Something missing here???? No Administrators group account.
This would explain why SQL Server is having a hell of a time trying to authenticate me as an Administrator.
So now I’m really confused as to WTF is going on. In Vista I have:
- UAC off
- Account type set to Administrator
- My User Account is part of the Administrators group in the old User Manager
- Run all administrators in Admin Approval Mode group policy option is disabled
What else do I need here to get my admin acount status back properly?
The Voices of Reason
# re: Am I an Administrator on Vista? No really am I?
I am surprised changing UAC required a reboot, though. I would think it would be enough to logout and log back in, getting a new, unsplit, token.
# re: Am I an Administrator on Vista? No really am I?
# re: Am I an Administrator on Vista? No really am I?
Then dump it!
# re: Am I an Administrator on Vista? No really am I?
As an experimental platform, yes, I can see the need based on your job. But for every day reliability?
# re: Am I an Administrator on Vista? No really am I?
I can't add Administrators. SQL complains that the group doesn't exist. My (now) Administrative account also doesn't have full rights to the Sql Server - I can't see all the tables although I can't make sense of why I can see some of the tables including the system tables... this is odd as hell.
Guess I'll have to reinstall Sql Server.
# re: Am I an Administrator on Vista? No really am I?
Believe it or not, other than these kind of 'discovery' episodes, I am more productive on Vista...
Alot of the shit I've been ranting about often turns out to also apply to XP (like the hardware issue with the Laser Mouse) which at first seemed to be a pure Vista issue.
# re: Am I an Administrator on Vista? No really am I?
Kevin
# re: Am I an Administrator on Vista? No really am I?
How to access the true Administrator account in Windows Vista
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9001970&pageNumber=2
# re: Am I an Administrator on Vista? No really am I?
For R&D, parallel testing vs. Win2003 Server or something, as the product matures, I say 'of course'. Just not sure about relying on it for production level stuff at this stage.
# re: Am I an Administrator on Vista? No really am I?
# re: Am I an Administrator on Vista? No really am I?
Sometimes it's not easy to see the good stuff when what gets posted is mostly about problems. I post problems here primarily because if I run into it others most likely will too and this might help out...
But as I mentioned to Steve earlier - I'm happy with Vista overall. Yes there are a few things that are odd and different and not necessarily improved, but for the most part Vista makes me more productive in my day and that's what counts.
# re: Am I an Administrator on Vista? No really am I?
http://msdn.microsoft.com/msdnmag/issues/07/01/UAC/default.aspx
I'm also fighting with the new security measures in Vista but it's a matter of understanding why these new features actually made it into Vista, that makes for less unpleasant surprises, and one gets to know how to handle best these new situations.
# re: Am I an Administrator on Vista? No really am I?
> but for the most part Vista makes me more productive in my day and that's what counts.
Can you give your avid readers some examples. (Having played around with Vista, I can't think of any offhand)
;-)
# re: Am I an Administrator on Vista? No really am I?
1. The new Start Menu saves me tons of time launching applications. I've been using SlickRun for some time, but even so there's plenty of stuff on the the Start Menu that I launch by typing a few letters
2. Explorer's BreadCrumbs. This is probably the biggest timesaver. Anywhere in directory views you see the whole path and you can click on any part it of it to go there. Explorer also shows the 'next' path when you do click already highlighted.
3. TaskManager. Much easier to get to other running apps (although I admit I used a utility in XP that did more or less the same)
3. Performance. Vista just runs smoother for me than XP. Explorer doesn't lock out the CPU nearly as much as XP does.
Most of these are small things but they are time savers and it adds up quickly, but they are OS features (rather than tools or add-ins)... I'm sure there's more but the line blurs since it's been a while since I've run XP <s>. I do have oneXP machine here I use for media in the living room and it's funny how I try to click on the address bar <s>...
# re: Am I an Administrator on Vista? No really am I?
AFter spending 10 hours (yesterday) trying to fix it, I decided it was better for me to spend 3 hours re-doing my computer.
Now everything works fine.
# re: Am I an Administrator on Vista? No really am I?
You're going to face Vista sooner or later... it's just a matter of time how long you want to delay. The alternative is to go off to another OS altogether - and I suspect Vista may drive quite a few people, especially consumers in that direction.
# re: Am I an Administrator on Vista? No really am I?
One thing I'm greatful for is the fact MS built Vista Ultimate's install so it can be done in 30 minutes (yea, that's all it takes me).
Vista is a great OS, but I think a few things were rushed. I already know many of our customers and some of my contacts that dislike/hate the UAC protection. We're not letting our sales people use it until our CSR's have ran it for 2 months so they can support the sales team... leaves us developers free to make cool stuff! :D
# re: Am I an Administrator on Vista? No really am I?
# re: Am I an Administrator on Vista? No really am I?
# re: Am I an Administrator on Vista? No really am I?
1. Open up services from the Admin Tools and right click on the relevant SQL database service.
2. Select Properties and then the Log On tab.
3. Re-type the password and confirm. Click OK.
This worked for me but you could also try messing around with the Log On account if it doesn't work for you.
Now I've just got to get VS2005 working with my local IIS (it won't let me access any local websites via VS because it hasn't got access to the local IIS metabase). Love and kisses to Bill G.
Nick
# re: Am I an Administrator on Vista? No really am I?
http://support.microsoft.com/kb/928574
Nick
PS. An extraneous instruction crept into the article, so ignore step 4 in Error Message 2 instructions.
# re: Am I an Administrator on Vista? No really am I?
Microsoft Solution
1. OS Vista; IE 7
2. In Windows Explorer Folder Options, check "show hidden files and folders" and uncheck "hide protected operating system files".
3. Open IE, click Tools, Internet Options; on the General Tab, click Settings under "Browsing history", then click View Files. This gives you a list of Temporary Internet Files, but not "hidden" files. On the address bar, add "\Content.IE5", so that it now reads "C:\Users\[your name]\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5". Some additonal sub-folders now appear under Temporary Internet Files.
4. On the left panel, right click on the Temporary Internet Files (TIF) folder, click Properties. (Note that the number of files and folders are far more than the files and folders that are listed in TIF and all of its sub-folders.) Write down the size of the TIF folder. If this size is close to the capacity set for TIF (which it probably is), delete some of the files if you want to follow along with the example below.
5. Go to YouTube or Googlevideo and view a somewhat lengthly video. (I would recommend video.google.com/videoplay?docid=4776181634656145640 or www.youtube.com/watch?v=AT-_2oAdN40, which is about 10-11meg.)
6. Refresh the TIF folder, noting NO new visible files.
7. Now, right click on Temporary Internet Files, click Properties, and note that the size of the TIF folder has gone up by about the size of the video file that was saved in the TIF folder, but the video file is NOT VISIBLE.
If you do the same thing using XP (as I did on another computer), the TIF folder will have an .flv file (in the case of Google) or a "File" (in case of YouTube).
So, the question remains, how can you access the saved video file on Vista???
(Further caveats: I am signed on as administrator, my security/privacy/advanced settings for IE 7 are the same on both my Vista and XP computers, and I am using the same version of Norton, with similar settings on both computers.)
BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT,BOULSHIT, and BOULSHIT.
# re: Am I an Administrator on Vista? No really am I?
I think the key setting is the Run all Administrators in Admin Approval Mode off