I only have 1 account as listed in users - and it is theoretically an admin -
i tried to transfer ownership using this account - it transfers, but still no
access... what is the "real administrator" and how do I access that account?
This is a home computer and I am the only user.
According to Microsoft this is a "feature" not a bug. Time permitting
over the next week or so I'll write a more detailed how-to about UAC
and post it in the microsoft general group. If I don't get a chance
this pretty much gives the basic steps for simpler setup like single
user PC's.
Till then...
Go to the UAC (User Account Control) from Control Panel, User Groups.
Click on where it says Turn User Account Control on or off, and
uncheck the on option if it is already (default) checked.
If you want to play with it while it is still on, the glaring thing I
first seen is a DESIGN issue. Maybe I'm justing messing up, easy to
do, as you'll see in a minute if you keep reading.
If your click on the folder or application you wish to change
permissions on by right clicking on its properties then the security
tab you see a fairly complex window open up that displays in a top and
bottom section. What's confusing to me at least at first is the EDIT
button. This only effects the top section or groups or user names, not
actually change the permissions which is probably what you're trying
to do most of the time. To do that click on the Advanced tab.
Try this experiment yourself and see if you get similar results before
you mess up any of your actual folders or applications. Just create a
new folder, dump a few images or text files in it then rename the
folder to experiment or whatever you want to call it.
For example I created a new folder on my C drive I called experiment.
If I right click on that new folder's properties, then its Security
tab, without any interaction from me Vista added four user classes.
1. Authneticated Users
2. System
3. Administrators
4. Users
If you click on the edit button hoping to change permissions like it
says, a new window opens but it probably won't let you change the
permissions, it just shows them. If you try to make changes from here
they likely will be just grayed out check marks.
Instead click on Advanced. Yet another window opens. You see the four
users from the previous Window listed, their general permission class,
who they inherited the permissions from and what it applies to.
Changes you make in this context is limited to the "user" you are
trying to effect that likely before you start has limted permissions.
In my experiment Vista says Authenticated users have a modifed
permission, while system and Administrators have full control and
Users have only read and execute control.
*Note... these kinds of permissions may be perfectly fine depending on
what the drive, folder or application needs to do. What Vista
thinks it needs in the way of permissions can vary from what
YOU think or need or what the enderlying application needs.
Hence why you're probably getting errors.
Now what has got to confuse a lot of people that never done this
before is if you have administrative rights unlike before in XP where
you could pretty much change anything, in Vista you first need to
"take over" the user that doesn't have rights you wish to give it. So
in effect you (as administrator) become the user who's rights you are
going to change. You still need to be a administrator to do the
following. If if you are logged in as a user that doesn't have
administrative rights, you first need to log in with a user that does
have administrative rights just like before in XP in order to effect
system changes.
Here's how I did that:
1. I clicked on 'Users' that presently just has read & execute
permissions.
2. While 'Users' is hightlighted click Edit. A fourth window opens.
3. Again click on the line that shows users, then the Edit button.
4. A fifth window opens, actually the same one that before only showed
grayed out permissions, only now you can change things.
5. Under the allow column check the permissions you wish to give to
'users'. I elected to give Full control.
** Users in this context can also be confusing. What you actual see
may be the word users if Vista added the "user" or actual names you
may have set up as users of your PC.
6. Once you've changed the permissions, click ok to close this Window.
Important, we now need to backout of this mess of windows and
remember to click ok or apply as we go.
7. Click the apply button from the previous window, then ok.
8. Click ok again on the next window you now see.
9. Click ok to close the properties tab.
10.(optional) curse Microsoft for making this so damn lame and this
was a easy one, it can get harder.
Now right click on the folder you created that you renamed experiment
or whatever you decided to call it, select properties, then the
security tab again. If you did everything right now 'users' or
whatever user name you have that had limited permissions now should
show it has full control or total permission to do whatever it needs
to and should run as it did under XP.
Now you see why for most people probably a lot simple to just turn off
UAC. There is a good side to all this if you take the time you can
assign very specific rights which in theory at least should make your
PC more secure for outside attack or does it?
Well not really. Microsoft has admitted to avoid making this too
complex as if what you just went through was easy, that admit they
allow any application that claims to be a setup.exe have full rights.
This more or less defeats the whole purpose.
Read more on that juicy topic here:
http://blogs.zdnet.com/security/?p=29&tag=nl.e589
http://theinvisiblethings.blogspot.com/2007/02/vista-security-model-big-joke.html