DLL Copy / Permission Issue

[Jason Teagle]

Situation:
* I am *the* admin for the Vista installation.

* User Access Control is switched off for my account (for now, in an attempt
to solve the issue).

* I have a directory created under C on the Vista machine (*not* under
Program files, Windows or Windows\System32), which I own and have full
permission for according to the Security tab on the folder's properties.

* I have a network share from another machine, also on which I'm the admin,
and I happen to be using the same username and password on that machine
(thus, shouldn't require extra permission to access it).

* I'm trying to copy a folder from the network share to the local C drive
folder of the same name (the original attempt at this is what created said
folder under C). I had already done this with another folder and received no
problems whatsoever, even with UAC switched on.

* This network share folder contains DLLs (the other folder did not, which
is obviously why it succeeded).

* The target folder under C is currently empty, so no existing DLL trying to
be replaced (a fairly clear security issue, even though it's not a system
folder).

When I try and copy the DLL, it says "You need permission" and gives me the
Retry, Skip and Ignore options.

Two questions:

1. Why do I *need* permission to *copy* a DLL from a network share I *own*,
with *matching* credentials, to a folder I *own*, *not* in a
protection-worthy area of the machine, with *no* existing DLLs to overwrite,
when I *am* the admin with *full* permissions? Yes, that's a lot of
asterisks.

(I'm a programmer, so no need for any glib comments about people blindly
copying files around.)

2. Why does the access denied message box not give me any help? It provides
no way to get that permission (such as a Run As... button), or any links to
help or information about why access was denied and how to potentially
rectify it.

I completely understand what Vista is trying to do here to protect us from
malware, but I do think it's become a bit flawed if it won't let you do the
stuff you should be able to do {:v)

Can anyone help?

 

[Guest]

* User Access Control is switched off for my account

enable UAC

 

[Guest]

2. Why does the access denied message box ? It provides
no way to get that permission (such as a Run As... button), or any links to
help or information about why access was denied and how to potentially
rectify it.

if UAC is OFF you have ACCESS DENIED
if UAC is ON you'll have an UAC prompt in order to get the full access.
That's so simple and so easy.

 

[Jason Teagle]

if UAC is OFF you have ACCESS DENIED
if UAC is ON you'll have an UAC prompt in order to get the full access.
That's so simple and so easy.

I'm afraid that isn't the answer (at least not in this case).

1. It may not have been obvious from my original post, but UAC was *on*
originally; I only turned it off when the problem arose.

2. I tried turning it back on again, just in case, and it confirmed the same
result; access denied and no way to change it. So switching UAC on or off
isn't the answer here - even with it on it won't let me.

I have had elevation prompts for other tasks (now that I understand what
they are), but I get no such prompt for this particular action - any idea
why?

 

[Jason Teagle]

if UAC is OFF you have ACCESS DENIED

if UAC is ON you'll have an UAC prompt in order to get the full access.
That's so simple and so easy.

I draw your attention to the article here:

http://technet.microsoft.com/en-us/windowsvista/aa905117.aspx#BKMK_AdminUAC

"Disabling UAC
Disabling the User Account Control: Run administrators in Admin Approval
Mode setting turns UAC "off." Files and folders are no longer virtualized to
per-user locations for non-UAC compliant applications and all local
administrators are automatically logged in with a full administrative access
token. Disabling this setting essentially causes Windows Vista to revert to
the Windows XP user model."



In other words, turning it off gives (or *should* give) full unfettered
access, not Access Denied.

 

[Guest]

Situation:
* I am *the* admin for the Vista installation.

* User Access Control is switched off for my account (for now, in an
attempt to solve the issue).

* I have a directory created under C on the Vista machine (*not* under
Program files, Windows or Windows\System32), which I own and have full
permission for according to the Security tab on the folder's properties.

* I have a network share from another machine, also on which I'm the
admin, and I happen to be using the same username and password on that
machine (thus, shouldn't require extra permission to access it).

Are you in a workgroup or a domain? Is this the same on both machines?

When setting up the connection to the network share, instead of just typing
in the username, try entering "machine\username", where "machine" is the
name of the machine hosting the share, and "username" is the account on that
machine that should have access to the file.

* I'm trying to copy a folder from the network share to the local C drive
folder of the same name (the original attempt at this is what created said
folder under C). I had already done this with another folder and received
no problems whatsoever, even with UAC switched on.

* This network share folder contains DLLs (the other folder did not, which
is obviously why it succeeded).

* The target folder under C is currently empty, so no existing DLL trying
to be replaced (a fairly clear security issue, even though it's not a
system folder).

When I try and copy the DLL, it says "You need permission" and gives me
the Retry, Skip and Ignore options.

Is it looking for permission to read, or permission to write? Right-click
the DLL, and select "Properties". One of the tabs that displays is called
"Details", and lists the file type, version, and other information. If it
displays a version number, it got that from reading the file, so you will
know that you can read the file. If you can see this information, then you
will know that the problem is one of writing, which means you have a local
permissions issue.

Do you have any antivirus software installed on your system?

Two questions:

1. Why do I *need* permission to *copy* a DLL from a network share I
*own*, with *matching* credentials, to a folder I *own*, *not* in a
protection-worthy area of the machine, with *no* existing DLLs to
overwrite, when I *am* the admin with *full* permissions? Yes, that's a
lot of asterisks.

(I'm a programmer, so no need for any glib comments about people blindly
copying files around.)

Do you really own the folder? Try "dir /q" from the command prompt to see a
list of owners along with directories and files.

Do you really have full permissions? Try "icacls dirname" to list the
permissions for the directory called "dirname".

2. Why does the access denied message box not give me any help? It
provides no way to get that permission (such as a Run As... button), or
any links to help or information about why access was denied and how to
potentially rectify it.

As to that, I have no idea, I'm frequently faced with that dialog box, or
one just like it, and it offers to fix things for you, but fails to do so,
then asks you again if you want it to fix things for you. Not good user
experience, that's for certain.

I completely understand what Vista is trying to do here to protect us from
malware, but I do think it's become a bit flawed if it won't let you do
the stuff you should be able to do {:v)

Eh - it's not letting you do the stuff you used to do, and the stuff that
you think you should be able to do, but I'll bet we can find a reason as to
why it's denying you.

Alun.
~~~~

 

[Jason Teagle]

Thank you for your response.

Are you in a workgroup or a domain? Is this the same on both machines?

Network share - workgroup.
Vista local - workgroup. Since you had me checking, I noticed it was not
using the same workgroup name - so I changed it and rebooted, but no
difference.

Note that I can copy a plain text file from the same share to the same local
directory with no problems - it's just reacting to DLLs and EXEs.

Interestingly (or worryingly!), the window saying I need permission is
titled "Destination Folder Access Denied". Of course, I didn't get this when
copying the text file.

When setting up the connection to the network share, instead of just
typing in the username, try entering "machine\username", where "machine"
is the name of the machine hosting the share, and "username" is the
account on that machine that should have access to the file.

Hopefully the info above about the plain text file copying OK will prove
that the share itself isn't a problem.

Is it looking for permission to read, or permission to write? Right-click
the DLL, and select "Properties". One of the tabs that displays is called
"Details", and lists the file type, version, and other information. If it
displays a version number, it got that from reading the file, so you will
know that you can read the file. If you can see this information, then you
will know that the problem is one of writing, which means you have a local
permissions issue.

It displays type, size and date modified, but not the version number on the
Details tab.

Given the caption of the error message mentioned above, though, I suspect
the problem is about writing the file on the local drive.

If I was trying to copy to the root of a drive, Program Files, Windows or
System32 then I could understand; but this is a subfolder under C that my
first copy attempt created - so it managed to create a folder under C root,
but refuses to copy DLL files to that subfolder.

Do you have any antivirus software installed on your system?

Only Windows Defender, from the vanilla installation.

Do you really own the folder? Try "dir /q" from the command prompt to see
a list of owners along with directories and files.

The result shows

computer_name\XXX

against the dir, and XXX matches my login (not literally, of course)

Do you really have full permissions? Try "icacls dirname" to list the
permissions for the directory called "dirname".

Not quite sure how to interpret the result here - here's what it showed:

C:\folder_name BUILTIN\AdministratorsI)(F)
BUILTIN\AdministratorsI)(OI)(CI)(IO)(F)
NT AUTHORITY\SYSTEMI)(F)
NT AUTHORITY\SYSTEMI)(OI)(CI)(IO)(F)
BUILTIN\UsersI)(OI)(CI)(RX)
NT AUTHORITY\Authenticated UsersI)(M)
NT AUTHORITY\Authenticated UsersI)(OI)(CI)(IO)(M)

My login isn't explicitly mentioned here, but as mentioned above, the folder
was created by my first attempt to copy the entire directory (it's simply a
personal directory, nothing system-related), and so it would have been
created in the same context as I'm running now when trying to copy the DLL.
Even if I had somehow ended up with elevated privilege before that first
copy attempt, (a) why did it not allow the DLL copy in that same elevated
state, and (b) why does it not offer an elevation prompt now, if that is the
issue?

As to that, I have no idea, I'm frequently faced with that dialog box, or
one just like it, and it offers to fix things for you, but fails to do so,
then asks you again if you want it to fix things for you. Not good user
experience, that's for certain.

True. And a little embarrassing, since I'm supposed to be computer literate!

Eh - it's not letting you do the stuff you used to do, and the stuff that
you think you should be able to do, but I'll bet we can find a reason as
to why it's denying you.

For that I live in hope {:v)

Thank you for your time.

 

[Jason Teagle]

I tried copying the DLL into the same share folder, i.e., what would
normally create "Copy of xxx.dll" - it denied me that, same Destination
Folder Access Denied message.

But here's the odd thing - I could copy a DLL from the Windows Sidebar
folder on my local drive to the same local subdirectory I had been trying to
use - no problem there.

So it does seem to be something about the network share, but in one case it
won't let me copy from it, and another it won't let me copy to it - not
exactly consistent. Unless, of course, the error message is deceiving and
it's the copy-from-source part that is the issue all along - something that
you were thinking about...

 

[James Matthews]

You need to set the premissions on the folder!