Signed On As Administrator, but Denied Access

Downloaded APC Power Chute update for VISTA. Wanted to save this into
Program Files - Denied Access as administrator. Well, guess what, I am the
ADMINISTRATOR! I could not save this update anywhere except PUBLIC folder.
Why is this? Who has the right to administrator action when I'm signed on as
the sole administrator of this account? This is very irritating.

I'm having the same problem. I can't mofiy files in the Program Files
directory or my root (C:\) drive. I am an administrator. Why can't I modify
files?

"ativar" wrote:

> Downloaded APC Power Chute update for VISTA. Wanted to save this into
> Program Files - Denied Access as administrator. Well, guess what, I am the
> ADMINISTRATOR! I could not save this update anywhere except PUBLIC folder.
> Why is this? Who has the right to administrator action when I'm signed on as
> the sole administrator of this account? This is very irritating.

Hello,

In Windows Vista, even though you are an administrator, the programs that
run on your computer are not allowed to use your administrator power unless:

1- They prompt you for permission
2- You explicitly give them permission (right-click, run as administrator)

The files in Program Files and your root C drive are not writiable by
non-administrative programs because the files in these areas affect every
user and the entire system.

Allowing unpriviliged programs write access to these areas would allow them
to overwrite/replace well-known programs or system-wide configuration data
used by windows or well-known programs, which is unacceptable for a program
that does not prompt.

The easiest way to accomplish what you are doing is to save the file to some
place in your user profile (such as documents), and then using windows
explorer, move that file to program files. This will end up prompting you
for permission and then allowing things to work.

Alternatively, you can run the program that is doing the downloading "as
administrator" by right-clicking it and clicking Run As Administrator, and
this will allow it to save to this area, but the solution above is better.

--
- JB
Microsoft MVP - Windows Shell/User

Windows Vista Support Faq
http://www.jimmah.com/vista/

Thanks Jimmy. I did exactly that, save and then move. However, it is
frustrating to be an 'administrator' but not have administrator powers to
work with my own system as I see fit, not as MS determines how it should be
run! I'm not into programming, I'm HR, and need to be able to make
corrections etc. to things within my 'control'. This is not possible with
the new "ask your administrator", safety and security that MS has imposed
upon us. I realize that registry etc. are proprietery, and that I need not
be able to access these, and accept that. But being unable to save to a
folder within the Program Files is just not acceptable! My time and effort
are worth just as much, and I don't need to spend it working around something
that hinders MY ability to do MY job.

Red


"Jimmy Brush" wrote:

> Hello,
>
> In Windows Vista, even though you are an administrator, the programs that
> run on your computer are not allowed to use your administrator power unless:
>
> 1- They prompt you for permission
> 2- You explicitly give them permission (right-click, run as administrator)
>
> The files in Program Files and your root C drive are not writiable by
> non-administrative programs because the files in these areas affect every
> user and the entire system.
>
> Allowing unpriviliged programs write access to these areas would allow them
> to overwrite/replace well-known programs or system-wide configuration data
> used by windows or well-known programs, which is unacceptable for a program
> that does not prompt.
>
> The easiest way to accomplish what you are doing is to save the file to some
> place in your user profile (such as documents), and then using windows
> explorer, move that file to program files. This will end up prompting you
> for permission and then allowing things to work.
>
> Alternatively, you can run the program that is doing the downloading "as
> administrator" by right-clicking it and clicking Run As Administrator, and
> this will allow it to save to this area, but the solution above is better.
>
> --
> - JB
> Microsoft MVP - Windows Shell/User
>
> Windows Vista Support Faq
> http://www.jimmah.com/vista/
>
>

Microsoft is not "determining how you use your computer" at all.

There is *nothing* you are blocked from doing now; an administrator has as
much power to do things as they did in Windows XP.

The only difference is that *you* now have control over which programs can
use *your* administrator power.

I understand that you are having issues because of this change because you
are using older programs that do not know how to ask for your permission;
however, these issues will go away as programs are made that work with
Windows Vista, and the fix for these programs is really simple (right-click
them and click run as administrator for short-term; for long term,
right-click, click properties, click compatability tab, and tell it to
always run as administrator).

The best advice I can give is that if you are getting errors such as "access
denied" or "you have to be an administrator to do this", it is because the
program you are using is not designed for Windows Vista, and needs to use
your administrator power in order to be able to do what it needs to do, but
doesn't know how to ask you for your permission.

In order to allow it to do what it wants to do, right-click it, and click
Run As Administrator; just be aware that this will give that program *full
access* to your computer, so be sure you trust the program with such access
before doing it.

This security feature in Windows Vista gives you the following assurances:

* Programs that run on your computer can *ONLY* have full access to your
computer with *YOUR* knowledge/permission; programs that don't need or don't
ask for full access to your computer, don't get it

* You are notified EVERY TIME a program requiring full access to your
computer starts; this protects you from programs loading trusted, system
components and using them against you ("Hey, I didn't start format.exe...
what is it doing running?")

These are good things


--
- JB
Microsoft MVP - Windows Shell/User

Windows Vista Support Faq
http://www.jimmah.com/vista/

Well, I guess, as the English PHD stated in a lecture, "Conjecture is a
symantic, and all the world talks in symantics. So I conjecture that this
symantic is not compatible with your symantic and therefore the conjecture of
a converstation is simply not symantic enough to be compatible."
Now. I am still totally confused as to why I have to have administrator
powers in order to save a program in a specific file folder. That is my
basic question. And if not allowing me to save a program that is VISTA
specific - as is the one I was attempting to save - is a security measure to
protect VISTA, then it would be somewhat of a forgone conclusion, in my
humble estimation, that MS is indeed, 'determining how I utilize my computer.'
But, all that aside, your original answer was sufficiently specific, and
allowed me to manage the problem that I was having. I thank you for your
help.

ativar


"Jimmy Brush" wrote:

> Microsoft is not "determining how you use your computer" at all.
>
> There is *nothing* you are blocked from doing now; an administrator has as
> much power to do things as they did in Windows XP.
>
> The only difference is that *you* now have control over which programs can
> use *your* administrator power.
>
> I understand that you are having issues because of this change because you
> are using older programs that do not know how to ask for your permission;
> however, these issues will go away as programs are made that work with
> Windows Vista, and the fix for these programs is really simple (right-click
> them and click run as administrator for short-term; for long term,
> right-click, click properties, click compatability tab, and tell it to
> always run as administrator).
>
> The best advice I can give is that if you are getting errors such as "access
> denied" or "you have to be an administrator to do this", it is because the
> program you are using is not designed for Windows Vista, and needs to use
> your administrator power in order to be able to do what it needs to do, but
> doesn't know how to ask you for your permission.
>
> In order to allow it to do what it wants to do, right-click it, and click
> Run As Administrator; just be aware that this will give that program *full
> access* to your computer, so be sure you trust the program with such access
> before doing it.
>
> This security feature in Windows Vista gives you the following assurances:
>
> * Programs that run on your computer can *ONLY* have full access to your
> computer with *YOUR* knowledge/permission; programs that don't need or don't
> ask for full access to your computer, don't get it
>
> * You are notified EVERY TIME a program requiring full access to your
> computer starts; this protects you from programs loading trusted, system
> components and using them against you ("Hey, I didn't start format.exe...
> what is it doing running?")
>
> These are good things
>
>
> --
> - JB
> Microsoft MVP - Windows Shell/User
>
> Windows Vista Support Faq
> http://www.jimmah.com/vista/
>

Mr. Brush,

I totally understand the reasoning for the new permissions design and
personally think it's a great idea. The user is the most dangerous part of
the system!
I do have a question. One of our programs uses an add in application that
creates a virtual lock, simulating a VPN connection. This install is
automatic and does not prompt for permission. Vista blocks this installation.
There isn't a way to save this to a system because it does not give the
chance. The "guys in the sky" are working on upgrading the program; however,
that could take up to two months (usually more). In the mean time the guys
out in the field are helpless. Which means money out of pockets. Being the IT
GOTO, I feel the heat from both directions.Is there a work around?

"Jimmy Brush" wrote:

> Microsoft is not "determining how you use your computer" at all.
>
> There is *nothing* you are blocked from doing now; an administrator has as
> much power to do things as they did in Windows XP.
>
> The only difference is that *you* now have control over which programs can
> use *your* administrator power.
>
> I understand that you are having issues because of this change because you
> are using older programs that do not know how to ask for your permission;
> however, these issues will go away as programs are made that work with
> Windows Vista, and the fix for these programs is really simple (right-click
> them and click run as administrator for short-term; for long term,
> right-click, click properties, click compatability tab, and tell it to
> always run as administrator).
>
> The best advice I can give is that if you are getting errors such as "access
> denied" or "you have to be an administrator to do this", it is because the
> program you are using is not designed for Windows Vista, and needs to use
> your administrator power in order to be able to do what it needs to do, but
> doesn't know how to ask you for your permission.
>
> In order to allow it to do what it wants to do, right-click it, and click
> Run As Administrator; just be aware that this will give that program *full
> access* to your computer, so be sure you trust the program with such access
> before doing it.
>
> This security feature in Windows Vista gives you the following assurances:
>
> * Programs that run on your computer can *ONLY* have full access to your
> computer with *YOUR* knowledge/permission; programs that don't need or don't
> ask for full access to your computer, don't get it
>
> * You are notified EVERY TIME a program requiring full access to your
> computer starts; this protects you from programs loading trusted, system
> components and using them against you ("Hey, I didn't start format.exe...
> what is it doing running?")
>
> These are good things
>
>
> --
> - JB
> Microsoft MVP - Windows Shell/User
>
> Windows Vista Support Faq
> http://www.jimmah.com/vista/
>

"ativar" <ativar@discussions.microsoft.com> wrote in message
news:C5B8322A-FCF0-44F7-A79E-106751A513EE@microsoft.com...
> Well, I guess, as the English PHD stated in a lecture, "Conjecture is a
> symantic, and all the world talks in symantics. So I conjecture that this
> symantic is not compatible with your symantic and therefore the conjecture
> of
> a converstation is simply not symantic enough to be compatible."

*blank stare*

> Now. I am still totally confused as to why I have to have administrator
> powers in order to save a program in a specific file folder. That is my
> basic question.

You *have* admin power. You can save anywhere you want. But, you have to
tells Windows that you want the program you are using to *use* this power,
if it doesn't ask for it.

> And if not allowing me> to save a program that is VISTA
> specific - as is the one I was attempting to save - is a security measure
> to
> protect VISTA,

LOL, it is not a security measure to protect Vista. .. it is a security
measure to protect *you*. From the program that you are using to do the
download (i.e. perform an administrative action).

Vista doesn't know you want that program to be able to have full control
over your computer ... because it is too old to know how to ask for it. So
you have to let vista know that you want it to be able to use your admin
power.

The reason certain folders are restricted in this way is because it contains
sensitive files that, if modified, could be used to take over your computer.

UAC protects you from programs that would modify these areas without your
knowledge or consent.

UAC prompts are not somehow controlling you or keeping you from doing
things... UAC does nothing of the sort. UAC protects you from the programs
that run on your computer, and puts you in control over them by 1) telling
you when a program runs that wants full access to your computer and 2)
giving you a chance to stop such programs from running. That is the only
thing that is going on .

You seem to be really driving at "what is the difference between what is a
restricted/administrator action and what isn't", and pointing to the fact
that Microsoft has defined this seperation, and thus is round-aboutly in
control of your computer.

While it is true that Microsoft has defined the line between administrative
vs. non-administrative, this gives them NO control whatsoever over your
computer because you have the SOLE and EXPLICIT control over how programs
cross this line via the UAC prompt and the run-as-admin tool. Microsoft has
no control over what programs you choose to allow to cross this line - you
have the sole power to determine this.

If Microsoft wanted to control what you did on your computer, they would not
prompt you at all or give you the power to run programs with admin power.
You would simply be told what you are and are not allowed to do. .

<snip>


--
- JB
Microsoft MVP - Windows Shell/User

Windows Vista Support Faq
http://www.jimmah.com/vista/

Hello,

"JamesT" <JamesT@discussions.microsoft.com> wrote in message
news:ED3566E5-327D-4137-ACDC-CDC02CEFA9F6@microsoft.com...
> Mr. Brush,
>
> I totally understand the reasoning for the new permissions design and
> personally think it's a great idea. The user is the most dangerous part of
> the system!

UAC is designed to empower the administrative user, not control them...

> I do have a question. One of our programs uses an add in application that
> creates a virtual lock, simulating a VPN connection. This install is
> automatic and does not prompt for permission. Vista blocks this
> installation.
> There isn't a way to save this to a system because it does not give the
> chance. The "guys in the sky" are working on upgrading the program;
> however,
> that could take up to two months (usually more). In the mean time the guys
> out in the field are helpless. Which means money out of pockets. Being the
> IT
> GOTO, I feel the heat from both directions.Is there a work around?

How is the install automatic?

The easiest solution, assuming "the people in the fields" are installing the
software by hand and not by automated means, would be to have the IT
technicians run whatever .exe that does the updating "as administrator" (by
right-clicking it and clicking run as administrator).

For example, if the update is done inside of Internet Explorer, then run IE
as admin.

I really cannot offer any other solutions without knowing more about how the
install works (how is it being deployed? is it MSI? etc)

--
- JB
Microsoft MVP - Windows Shell/User

Windows Vista Support Faq
http://www.jimmah.com/vista/

There is nothing to right click. When the user punches in his/her password
the bowser loads the secure page. The program automatically loads the first
time the page is opened on the system. There is nothing to click or view
before it loads. It's almost scripted the same as an activeX control with the
execption of it being an actual program.

"Jimmy Brush" wrote:

> Hello,
>
> "JamesT" <JamesT@discussions.microsoft.com> wrote in message
> news:ED3566E5-327D-4137-ACDC-CDC02CEFA9F6@microsoft.com...
> > Mr. Brush,
> >
> > I totally understand the reasoning for the new permissions design and
> > personally think it's a great idea. The user is the most dangerous part of
> > the system!
>
> UAC is designed to empower the administrative user, not control them...
>
> > I do have a question. One of our programs uses an add in application that
> > creates a virtual lock, simulating a VPN connection. This install is
> > automatic and does not prompt for permission. Vista blocks this
> > installation.
> > There isn't a way to save this to a system because it does not give the
> > chance. The "guys in the sky" are working on upgrading the program;
> > however,
> > that could take up to two months (usually more). In the mean time the guys
> > out in the field are helpless. Which means money out of pockets. Being the
> > IT
> > GOTO, I feel the heat from both directions.Is there a work around?
>
> How is the install automatic?
>
> The easiest solution, assuming "the people in the fields" are installing the
> software by hand and not by automated means, would be to have the IT
> technicians run whatever .exe that does the updating "as administrator" (by
> right-clicking it and clicking run as administrator).
>
> For example, if the update is done inside of Internet Explorer, then run IE
> as admin.
>
> I really cannot offer any other solutions without knowing more about how the
> install works (how is it being deployed? is it MSI? etc)
>
> --
> - JB
> Microsoft MVP - Windows Shell/User
>
> Windows Vista Support Faq
> http://www.jimmah.com/vista/
>