Re: Best practice: traversal of all folders.

Thank you for the explanation. However, I don't see why if access is
allowed to the target of a junction, access isn't allowed to the junction (I
can traverse "c:\users," so why can't I traverse "c:\documents and
settings," which is a junction to c:\users?).

On a related point, in trying to move the Documents folder ("Personal" in
regedit) using the properties option to move it, I noticed that Vista failed
to update the junction to point to the new location. In correcting that, I
ended up creating a link rather than a junction, but then corrected it back
to a junction. However, I don't have the attributes right, I added H and
S, but Vista seems to use "N" on the junctions under the user's folder--what
is the "N" attribute and how do I add it to the junction's attributes?


"Jimmy Brush" <JimmyBrush@discussions.microsoft.com> wrote in message
news:F3A4D9D1-F5A8-4DF8-9AED-1A247F89F9DC@microsoft.com...
> Hello,
>
> As Jeff pointed out, the reason access is denied to Documents and Settings
> is because it is a junction - basically a pointer to the Users folder,
> which replaces Documents and Settings in Vista. There are very good
> reasons why this security restriction was put in place, and unfortunately
> Explorer doesn't help you out very much in this regard.
>
> You should not change the security on these junctions. You will need to
> learn and use the new Windows Vista locations instead.
>
> As Kurt pointed out, admin accounts are basically split right down the
> middle. All applications run as if they were a standard user - they can
> only use admin powers when they request the power from you via a UAC
> prompt.
>
> Here's how file operations work in Explorer using this "admin-lite" mode.
>
> You can do anything that your username explicitly has permission to do. If
> you try to do something that you cannot explicitly do, there are a few
> things that may happen:
>
> 1) You are browsing into a folder that you don't have access to
>
> Windows will ask you if you want to "elevate" to full admin power and then
> give yourself explicit permission to access the folder. This changes
> security on the folder/files within that folder to allow you read access.
> If not even the "full admin" power is enough to change the security on the
> folder, you will not be able to access it. This could be the case if the
> administrators group does not have permission to change the folder. In
> this case, you would have to take ownership of the folder and possibly
> child folders/files first and then try to access the folder.
>
> 2) You are doing a folder/file operation that the administrators group has
> permission to do, but you do not
>
> Windows Explorer will tell you that the operation is restricted and that
> you need admin privileges to complete the operation. You will then go thru
> a UAC dialog and use your "full admin" power to complete the operation.
> The "full admin" power is only good on that one specific operation, and
> does not apply to any further operations.
>
> 3) You are doing a folder/file operation that the administrators group
> DOES NOT have permission to do
>
> You will receive an access denied error - neither you explicitly nor the
> administrators group have permission. You will need to change the
> permissions on the file/folder manually to give either yourself or the
> administrators group permission. You may need to take ownership of the
> file/folder in order to do this.
>
>
> --
> - JB
>
> Windows Vista Support Faq
> http://www.jimmah.com/vista/

ok, I realized that Vista probably has "documents and settings" junction for
backward compatibility for programs hard-coded to look there, and the
security restriction isn't for security purposes, but to prevent users from
deleting or renaming it.

You're right, the security isn't in place for security purposes ... it's
actually put in place for application compatability purposes.

That's right ... an app compat hack has an app compat hack .

It's fine for programs to traverse OVER an app compat junction - for
example, accessing c:\documents and settings\username\ works fine. However,
attempting to do a directory listing on an appcompat junction returns access
denied.

This is to prevent programs that do not understand junctions from getting
confused. Imagine the case where a backup program backs up your hard drive
and runs over both Documents and Settings and Users - it thinks it is
accessing 2 different folders, when in fact they are the same.

Also, some app compat junctions point back into themselves creating a
recursive situation - some programs probably wouldn't like this very much
.


--
- JB

Windows Vista Support Faq
http://www.jimmah.com/vista/

> Vista seems to use "N" on the junctions under the user's folder--what is
> the "N" attribute and how do I add it to the junction's attributes?

N is the "do not index contents" attribute, it shows up as I using the
attrib command-line tool.

This attribute is accessed from Advanced button in the properties screen in
the attributes section ... clearing the "Index this folder/file for faster
searching" checkbox sets this attribute.


--
- JB

Windows Vista Support Faq
http://www.jimmah.com/vista/

You can, if you so wish, take ownership of C:\documents and settings, but,
AFAICS nothing is gained by so doing.

--
Leo
If at first you do succeed, try not to look astonished.






"Manuel Lopez" <limited@newsgroups.nospam> wrote in message
news:uMiWJdlEHHA.1220@TK2MSFTNGP04.phx.gbl...
>
> Thank you for the explanation. However, I don't see why if access is
> allowed to the target of a junction, access isn't allowed to the junction
> (I can traverse "c:\users," so why can't I traverse "c:\documents and
> settings," which is a junction to c:\users?).
>
> On a related point, in trying to move the Documents folder ("Personal" in
> regedit) using the properties option to move it, I noticed that Vista
> failed to update the junction to point to the new location. In
> correcting that, I ended up creating a link rather than a junction, but
> then corrected it back to a junction. However, I don't have the
> attributes right, I added H and S, but Vista seems to use "N" on the
> junctions under the user's folder--what is the "N" attribute and how do I
> add it to the junction's attributes?
>
>
> "Jimmy Brush" <JimmyBrush@discussions.microsoft.com> wrote in message
> news:F3A4D9D1-F5A8-4DF8-9AED-1A247F89F9DC@microsoft.com...
>> Hello,
>>
>> As Jeff pointed out, the reason access is denied to Documents and
>> Settings is because it is a junction - basically a pointer to the Users
>> folder, which replaces Documents and Settings in Vista. There are very
>> good reasons why this security restriction was put in place, and
>> unfortunately Explorer doesn't help you out very much in this regard.
>>
>> You should not change the security on these junctions. You will need to
>> learn and use the new Windows Vista locations instead.
>>
>> As Kurt pointed out, admin accounts are basically split right down the
>> middle. All applications run as if they were a standard user - they can
>> only use admin powers when they request the power from you via a UAC
>> prompt.
>>
>> Here's how file operations work in Explorer using this "admin-lite" mode.
>>
>> You can do anything that your username explicitly has permission to do.
>> If you try to do something that you cannot explicitly do, there are a few
>> things that may happen:
>>
>> 1) You are browsing into a folder that you don't have access to
>>
>> Windows will ask you if you want to "elevate" to full admin power and
>> then give yourself explicit permission to access the folder. This changes
>> security on the folder/files within that folder to allow you read access.
>> If not even the "full admin" power is enough to change the security on
>> the folder, you will not be able to access it. This could be the case if
>> the administrators group does not have permission to change the folder.
>> In this case, you would have to take ownership of the folder and possibly
>> child folders/files first and then try to access the folder.
>>
>> 2) You are doing a folder/file operation that the administrators group
>> has permission to do, but you do not
>>
>> Windows Explorer will tell you that the operation is restricted and that
>> you need admin privileges to complete the operation. You will then go
>> thru a UAC dialog and use your "full admin" power to complete the
>> operation. The "full admin" power is only good on that one specific
>> operation, and does not apply to any further operations.
>>
>> 3) You are doing a folder/file operation that the administrators group
>> DOES NOT have permission to do
>>
>> You will receive an access denied error - neither you explicitly nor the
>> administrators group have permission. You will need to change the
>> permissions on the file/folder manually to give either yourself or the
>> administrators group permission. You may need to take ownership of the
>> file/folder in order to do this.
>>
>>
>> --
>> - JB
>>
>> Windows Vista Support Faq
>> http://www.jimmah.com/vista/
>
>

Thanks. (In my simplicity, I would have used the same letter for the same
attribute, but there was probably a reason for not doing that.)

p.s. actually, for junctions, you cannot use the property sheet to make an
attribute change, only the command line attrib works.

"Jimmy Brush" <JimmyBrush@discussions.microsoft.com> wrote in message
newsDBD0335-1B3A-445E-9259-DBFFE7876CC5@microsoft.com...
>> Vista seems to use "N" on the junctions under the user's folder--what is
>> the "N" attribute and how do I add it to the junction's attributes?
>
> N is the "do not index contents" attribute, it shows up as I using the
> attrib command-line tool.
>
> This attribute is accessed from Advanced button in the properties screen
> in the attributes section ... clearing the "Index this folder/file for
> faster searching" checkbox sets this attribute.
>
>
> --
> - JB
>
> Windows Vista Support Faq
> http://www.jimmah.com/vista/

"N" in explorer seems to be a mistake by Microsoft, that wasn't caught by
the beta testers. Both the SDK and Microsoft's own attrib.exe command use
"I" for "not indexed."
It should be corrected, since "N" was used for normal (meaning no file
attributes).

"Jimmy Brush" <JimmyBrush@discussions.microsoft.com> wrote in message
newsDBD0335-1B3A-445E-9259-DBFFE7876CC5@microsoft.com...
>> Vista seems to use "N" on the junctions under the user's folder--what is
>> the "N" attribute and how do I add it to the junction's attributes?
>
> N is the "do not index contents" attribute, it shows up as I using the
> attrib command-line tool.
>
> This attribute is accessed from Advanced button in the properties screen
> in the attributes section ... clearing the "Index this folder/file for
> faster searching" checkbox sets this attribute.
>
>
> --
> - JB
>
> Windows Vista Support Faq
> http://www.jimmah.com/vista/

"Manuel Lopez" <limited@newsgroups.nospam> wrote in message
news:uMTxUHzEHHA.3188@TK2MSFTNGP06.phx.gbl...
>
> "N" in explorer seems to be a mistake by Microsoft, that wasn't caught by
> the beta testers.

Not necessarily an accurate assumption. There were many, many things that
were caught, and bugged, and discussed extensively, by the Vista Beta
testers, however, it is, after all, MS's program, and the MS development
and/or prgramming folks decided not to correct or change a lot the bugs,
many were closed as "Won't fix" So bugs that still exist in Vista are not
totally the fault of the beta testers, who can only find and report the
bugs, they can't force MS to do anything about them, or to what extent. :-)

Jan
MS MVP - Windows IE

good point. at first glance, this doesn't appear to be in one of the
classes of things that they can't quickly fix (it's not complicated, not an
old-standing bug, and has no dependencies that fixing would break)


"Jan Ilacqua [MVP]" <abuse@localhost.invalid> wrote in message
news:uDAz0jSIHHA.1248@TK2MSFTNGP02.phx.gbl...
> "Manuel Lopez" <limited@newsgroups.nospam> wrote in message
> news:uMTxUHzEHHA.3188@TK2MSFTNGP06.phx.gbl...
>>
>> "N" in explorer seems to be a mistake by Microsoft, that wasn't caught by
>> the beta testers.
>
> Not necessarily an accurate assumption. There were many, many things
> that were caught, and bugged, and discussed extensively, by the Vista Beta
> testers, however, it is, after all, MS's program, and the MS development
> and/or prgramming folks decided not to correct or change a lot the bugs,
> many were closed as "Won't fix" So bugs that still exist in Vista are
> not totally the fault of the beta testers, who can only find and report
> the bugs, they can't force MS to do anything about them, or to what
> extent. :-)
>
> Jan
> MS MVP - Windows IE
>
>
>
>

In fairness to the MS folks who were also in the Beta trenches, there were a
lot of things that the teams were hoping to fix, but, they just ran out of
time. There came a point where they had to lock the code to prepare for
RTM. Many fought just as hard as the BT's on some issues, however, they
were also answering to higher ups. I think we will see some of these things
corrected in the SP1, as you say, they are the type of things that can be
corrected without a lot of in-depth code changes. Until then, we will
either have to work with it, around it, or find some way to get by until the
SP1. Not exactly the most favorable choice, but, for now, the only ones we
may have.

Jan
MS MVP - Windows IE


"Tech_vs_Life" <limited@newsgroups.nospam> wrote in message
news:86FBB656-32CD-45E9-AB48-7E3EC9838A07@microsoft.com...
> good point. at first glance, this doesn't appear to be in one of the
> classes of things that they can't quickly fix (it's not complicated, not
> an old-standing bug, and has no dependencies that fixing would break)
>
>
> "Jan Ilacqua [MVP]" <abuse@localhost.invalid> wrote in message
> news:uDAz0jSIHHA.1248@TK2MSFTNGP02.phx.gbl...
>> "Manuel Lopez" <limited@newsgroups.nospam> wrote in message
>> news:uMTxUHzEHHA.3188@TK2MSFTNGP06.phx.gbl...
>>>
>>> "N" in explorer seems to be a mistake by Microsoft, that wasn't caught
>>> by the beta testers.
>>
>> Not necessarily an accurate assumption. There were many, many things
>> that were caught, and bugged, and discussed extensively, by the Vista
>> Beta testers, however, it is, after all, MS's program, and the MS
>> development and/or prgramming folks decided not to correct or change a
>> lot the bugs, many were closed as "Won't fix" So bugs that still exist
>> in Vista are not totally the fault of the beta testers, who can only find
>> and report the bugs, they can't force MS to do anything about them, or to
>> what extent. :-)
>>
>> Jan
>> MS MVP - Windows IE
>>
>>
>>
>>
>