Vista - Vista Permissions Questions (including Remote Desktop)

Ok, so far im finding the permission system in Vista at most, flakey. I can
execute/modify/etc files, but not move/rename/delete them sometimes. I can
change the permission myself to do this, but frankly.. if I have the
permission to do that.. isnt this process redundant?

My account is an administrator yet it prompts me all the time saying I do
not have permission. I manually have to set permission to my account even
though I am an administrator and it is totally a joke, since if I shouldnt
have permission to delete it.. I shouldnt have permission to modify the
permissions.

Onto my next question, Permissions over remote desktop - > even worse!
Either I am missing a major key factor here (a feature to change) or
something is wrong. When everything is fine and dandy when I am at home
working (moving, deleting, excuting files) I have problems from the office. I
connect (via remote desktop) to my home pc on the same administrator account,
and those SAME files I can delete/move at home I cannot over remote desktop.
How do I change this feature. I want to be able to log in as if I was logging
in at home, thats the point of Remote Desktop is it not?

If anyone has answers to these or is experiencing the same problems, some
feedback would be great!

Thanks,
Jeff

Hello,

Not sure about your remote desktop issues ... this should not be related to
NTFS permissions, however. You are right, you should get the same experience
over RD.

I can see why it would appear that permissions are "flakey"; trust me, they
do follow very logical rules .

The biggist thing to understand about security in Windows Vista, is that
even though YOU are an administrator, only the programs that ask for your
permission ("Windows needs your permission to continue") OR programs that
you manually run with admin power (right-click, Run As Administrator) can
USE your administrator powers.

So - how does this play into security permissions?

Well, if you are wanting to edit a file that is restricted to only allowing
ADMINISTRATORS to modify it, you MUST be running an administrative program
(one that prompts) in order to do it.

A great example is the hosts file - if you just open notepad, open the HOSTS
file, and try to save it - you will receive access denied.

You have to indicate to Windows that you want to use notepad to perform an
administrative operation - you do this by right-clicking notepad (or any
other application), and clicking Run As Administrator.

You *can* edit permissions on files to explicitly give YOUR USER ACCOUNT
access to the file. This will allow you to gain that amount of access from
any program that you run, regardless of whether it is an administrative
program.

However, you should never do this on system files, obviously, since this
defeats the whole purpose of the security - restricting access to certain
files only to administrative users *and* programs.

For example, you could change the permissions on the HOSTS file to give your
username full control - but you have just allowed every program that runs on
your computer to be able to change it, whether you know about it or not. If
you leave the security settings alone, only programs that prompt and you
indicate that you want to give them admin access can modify this file.

I hope this explains the behavior you are seeing



--
- JB
Microsoft MVP - Windows Shell/User

Windows Vista Support Faq
http://www.jimmah.com/vista/

Thanks for your response. I learned a bit more about the file system, but I
still do not agree with it. I take it there is no "easy way" to remove this
added security, as it is a pain in the ass?

Thanks

"Jimmy Brush" wrote:

> Hello,
>
> Not sure about your remote desktop issues ... this should not be related to
> NTFS permissions, however. You are right, you should get the same experience
> over RD.
>
> I can see why it would appear that permissions are "flakey"; trust me, they
> do follow very logical rules .
>
> The biggist thing to understand about security in Windows Vista, is that
> even though YOU are an administrator, only the programs that ask for your
> permission ("Windows needs your permission to continue") OR programs that
> you manually run with admin power (right-click, Run As Administrator) can
> USE your administrator powers.
>
> So - how does this play into security permissions?
>
> Well, if you are wanting to edit a file that is restricted to only allowing
> ADMINISTRATORS to modify it, you MUST be running an administrative program
> (one that prompts) in order to do it.
>
> A great example is the hosts file - if you just open notepad, open the HOSTS
> file, and try to save it - you will receive access denied.
>
> You have to indicate to Windows that you want to use notepad to perform an
> administrative operation - you do this by right-clicking notepad (or any
> other application), and clicking Run As Administrator.
>
> You *can* edit permissions on files to explicitly give YOUR USER ACCOUNT
> access to the file. This will allow you to gain that amount of access from
> any program that you run, regardless of whether it is an administrative
> program.
>
> However, you should never do this on system files, obviously, since this
> defeats the whole purpose of the security - restricting access to certain
> files only to administrative users *and* programs.
>
> For example, you could change the permissions on the HOSTS file to give your
> username full control - but you have just allowed every program that runs on
> your computer to be able to change it, whether you know about it or not. If
> you leave the security settings alone, only programs that prompt and you
> indicate that you want to give them admin access can modify this file.
>
> I hope this explains the behavior you are seeing
>
>
>
> --
> - JB
> Microsoft MVP - Windows Shell/User
>
> Windows Vista Support Faq
> http://www.jimmah.com/vista/
>

What don't you agree with? Do you really want all programs to have full
control over your computer?

The security cannot be removed. However, it can be disabled.

"User Account Control" is the feature that seperates admin programs from
non-admin programs. By disabling this feature, you implicitly give any
program that runs on your computer admin access to your computer. This
includes malware or viruses that may run on your computer without your
knowledge.

This also disables other security features, such as Internet Explorer
Protected Mode.

You can disable UAC via the user accounts control panel.


--
- JB
Microsoft MVP - Windows Shell/User

Windows Vista Support Faq
http://www.jimmah.com/vista/

Thanks, thats exactually what I need. There is no rish of malware on these
comps that I need to do it with so that is fine. Thanks for the help.

"Jimmy Brush" wrote:

> What don't you agree with? Do you really want all programs to have full
> control over your computer?
>
> The security cannot be removed. However, it can be disabled.
>
> "User Account Control" is the feature that seperates admin programs from
> non-admin programs. By disabling this feature, you implicitly give any
> program that runs on your computer admin access to your computer. This
> includes malware or viruses that may run on your computer without your
> knowledge.
>
> This also disables other security features, such as Internet Explorer
> Protected Mode.
>
> You can disable UAC via the user accounts control panel.
>
>
> --
> - JB
> Microsoft MVP - Windows Shell/User
>
> Windows Vista Support Faq
> http://www.jimmah.com/vista/
>