topic Problem with Admin permissions in Windows Server 2003

Problem with Admin permissions

marcin_w — Wed, 15 Apr 2009 13:30:17 GMT

Hi, I have a strange problem with admin permissions. My account ( is a member of Builtin/Administrators, Domain Admins in our domain - basically I should have full permissions on each PC but! - on some machines (not always ?!) I am prompted that I may not have appropr. permissions(see attached image). I am not able use Run As as well. When I log in as local admin I don't have problems. It only when I want to install sth. Not only my account is affected by that problem. Please advise.

Re: Problem with Admin permissions

Pieter 't Hart — Thu, 16 Apr 2009 14:44:02 GMT

there might be a domain policy active that blocks access to the resource.
check with gpresult what policies are aplied, maybe this gives a clue.
check this agains a computer that works OK.

you need to look into the "some machines" a little further, is this OS (XP/Vista) or servicepack-dependant.

It may be a antivirus software that kicks-in?

Re: Problem with Admin permissions

Pat Flanagan — Fri, 17 Apr 2009 19:31:16 GMT

I would double check on those machines that your domain administrator account is a member of the local (on that machine) Administrators group (assuming it's a Windows machine of course).

Pat

Re: Problem with Admin permissions

Pieter 't Hart — Mon, 20 Apr 2009 05:43:26 GMT

By the way even as domain-admin you cannot access everything by default.

Like home-directories and profiles on a domain basically only have permissions for a single user (the owner of the account).

Even as domain-administrator by default you canNOT acces these files (only for making backups).
You must explicitly take ownership and change the permissions before you can access these files.

so you need to investigate what file is referenced to befor you can check if you have access to it.

Re: Problem with Admin permissions

marcin_w — Mon, 20 Apr 2009 06:39:17 GMT

Hello,

thank you very much for all you replies.

Pieter,
the problem is strange because it affects random machines and I cannot see any pattern. The last PC which was affected was in Computers OU - (Win 2003 Server), sometimes it's user's PC from different OU with different GP. What I did, I move the PC in question to a different OU and assigned a GP (GP which only directs it to WSUS). Two days passed and now I am able to run the file. Do you think it might be cause by lack of Default Domain Policy assigned to 'main' root - in that case PC from Computers OU use local policy? Anyway it's strange because after adding PC to a domain, the Domain Admins group is automatically added to local Administrators group. I will investigete.

Pat,
the Domain Admins group is added to local Administrators group by default so my account is the part of Admin group. And as I mentioned, I am able to do everything on that PC apart of running new installations.

Thank you for your help guys.

Regards,
Marcin.

Re: Problem with Admin permissions

WFHC-WI — Tue, 21 Apr 2009 16:56:12 GMT

If you are attempting to run the file from a network share, copy it locally and then run it. If it still fails, right-click and view the properties of the file. Look for a checkbox marked "Unblock."

XP running SP2 will block certain executables from running regardless of permission levels if the file was downloaded via IE or Outlook Express and the signature is invalid.

http://support.microsoft.com/kb/843022

If you want to avoid this scenario you can disable IE Enhanced Security Configuration via Add/Remove Windows Components in the Control Panel.

Good luck!

Re: Problem with Admin permissions

WFHC-WI — Fri, 24 Apr 2009 15:25:34 GMT

Sorry, I should mention the same is true for Windows 2003 servers.

Re: Problem with Admin permissions

GerSpawn — Fri, 24 Apr 2009 19:22:36 GMT

Hello Marcin W.
Tray to run the command secpol.msc on the local machine.
This will open the Local Security Settings Editor, is like a GPO but locally.

Best Rgrds.
Ger.-