Problem with Admin permissions

[marcin_w]

Hi, I have a strange problem with admin permissions. My account ( is a member of Builtin/Administrators, Domain Admins in our domain - basically I should have full permissions on each PC but! - on some machines (not always ?!) I am prompted that I may not have appropr. permissions(see attached image). I am not able use Run As as well. When I log in as local admin I don't have problems. It only when I want to install sth. Not only my account is affected by that problem. Please advise.

[Pieter 't Hart]

there might be a domain policy active that blocks access to the resource.
check with gpresult what policies are aplied, maybe this gives a clue.
check this agains a computer that works OK.

you need to look into the "some machines" a little further, is this OS (XP/Vista) or servicepack-dependant.

It may be a antivirus software that kicks-in?

[Pat Flanagan]

I would double check on those machines that your domain administrator account is a member of the local (on that machine) Administrators group (assuming it's a Windows machine of course).

Pat

[Pieter 't Hart]

By the way even as domain-admin you cannot access everything by default.

Like home-directories and profiles on a domain basically only have permissions for a single user (the owner of the account).

Even as domain-administrator by default you canNOT acces these files (only for making backups).
You must explicitly take ownership and change the permissions before you can access these files.

so you need to investigate what file is referenced to befor you can check if you have access to it.

[marcin_w]

Hello,

thank you very much for all you replies.

Pieter,
the problem is strange because it affects random machines and I cannot see any pattern. The last PC which was affected was in Computers OU - (Win 2003 Server), sometimes it's user's PC from different OU with different GP. What I did, I move the PC in question to a different OU and assigned a GP (GP which only directs it to WSUS). Two days passed and now I am able to run the file. Do you think it might be cause by lack of Default Domain Policy assigned to 'main' root - in that case PC from Computers OU use local policy? Anyway it's strange because after adding PC to a domain, the Domain Admins group is automatically added to local Administrators group. I will investigete.

Pat,
the Domain Admins group is added to local Administrators group by default so my account is the part of Admin group. And as I mentioned, I am able to do everything on that PC apart of running new installations.

Thank you for your help guys.

Regards,
Marcin.

[WFHC-WI]

If you are attempting to run the file from a network share, copy it locally and then run it. If it still fails, right-click and view the properties of the file. Look for a checkbox marked "Unblock."

XP running SP2 will block certain executables from running regardless of permission levels if the file was downloaded via IE or Outlook Express and the signature is invalid.

http://support.microsoft.com/kb/843022

If you want to avoid this scenario you can disable IE Enhanced Security Configuration via Add/Remove Windows Components in the Control Panel.

Good luck!

[WFHC-WI]

Sorry, I should mention the same is true for Windows 2003 servers.

[GerSpawn]

Hello Marcin W.
Tray to run the command secpol.msc on the local machine.
This will open the Local Security Settings Editor, is like a GPO but locally.

Best Rgrds.
Ger.-