Unable to "Run as" "Administrator"

[John Pollard]

My new install of XP Pro is not behaving like previous install (I had
someone else do the install).

When I right-click an install.exe file to install some third party software,
the click "Run as", then "The following user" which says "Administrator", I
get the following error:

"Unable to log on"
"Logon failure: user account restriction. Possible reasons are blank
passwords not allowed, logon hour restrictions, or a policy restriction has
been enforced."

I did not have this problem before the reinstall, and I don't have it on my
other pc running XP Pro.

How can I determine which restriction is preventing the "Run as" and how do
prevent the restriction from occuring in the future?

 

[Rich Barry]

John, see if this helps

a.. If the runas command fails, the Secondary Logon service might not be
running or the user account you are using might not be valid. To check the
status of the Secondary Logon service, in Computer Management, click
Services and Applications, and then click Services. To test the user
account, try logging on to the appropriate domain using the account.

 

[John Pollard]

a.. If the runas command fails, the Secondary Logon service might not
be running or the user account you are using might not be valid. To
check the status of the Secondary Logon service, in Computer
Management, click Services and Applications, and then click Services.
To test the user account, try logging on to the appropriate domain
using the account.

Thanks for the response.

Secondary Logon says: Status=started; Startup Type=Automatic; Log On
As=Local System. Is that how it should look?

I have only one active User Account, which is for me and it is a "Computer
Administrator" account.

But I am trying to RunAs THE "Administrator", not as another User Account
with admin rights (the only one of those is the user I am logged on as).
THE "Administrator" is the first named user when I click "RunAs", then "The
following user:".

I was led (by someone) to believe that if I run the third party software
installation program in Safe Mode, I would be running as THE Administrator,
and that using "RunAs" "Administrator" from my XP User Account would
accomplish the same thing.

Since RunAs doesn't require a restart, I'm trying to use that approach. And
it always worked before the Windows reinstall (with this same third party
software install program), and it works fine on my laptop (with the same
third party software install program). I've installed this software quite a
few times as THE Administrator, and it has always worked like a charm.

According to the folks who did my Windows XP reinstall, there is no password
for THE computer Administrator on my pc (as there was not in my previous
installation, and as there is not on my laptop, where this works). And I
know there is no password for my Windows Account User.

Is there some Windows option that can require THE Administrator to have a
password?

Where, in Windows, would restrictions on logon hours be specified?

And what other "policy restrictions" could keep my User Account from doing a
RunAs THE Administrator?

Thanks again for your help.

 

[Shenan Stanley]

<snipped>
<responses inline>

Secondary Logon says: Status=started; Startup Type=Automatic; Log On
As=Local System. Is that how it should look?

I have only one active User Account, which is for me and it is a
"Computer Administrator" account.

But I am trying to RunAs THE "Administrator", not as another User
Account with admin rights (the only one of those is the user I am
logged on as). THE "Administrator" is the first named user when I
click "RunAs", then "The following user:".

In Windows XP - there is no difference in what they can do, really. If you
are an administrator, you can do everything the built-in administrator can
do.

I was led (by someone) to believe that if I run the third party
software installation program in Safe Mode, I would be running as
THE Administrator, and that using "RunAs" "Administrator" from my
XP User Account would accomplish the same thing.

You could log into safe mode as the built-in administrator - sure. Don't
have to though. Whomever lead you to believe that - particularly if they
knew you have Windows XP Professional - led you astray.

Since RunAs doesn't require a restart, I'm trying to use that
approach. And it always worked before the Windows reinstall (with
this same third party software install program), and it works fine
on my laptop (with the same third party software install program). I've
installed this software quite a few times as THE
Administrator, and it has always worked like a charm.

Shouldn't need to be installed as the built-in administrator. If it does -
then they coded atround that in some way - hopefully not by username - since
that can be changed.

According to the folks who did my Windows XP reinstall, there is no
password for THE computer Administrator on my pc (as there was not
in my previous installation, and as there is not on my laptop,
where this works). And I know there is no password for my Windows
Account User.

So - log on as the built-in administrator.

Log off - if you get to the "Welcome Screen", either choose the built-ion
administrator (which will likely not be shown - but juts in case) or more
likely - Press CTRL+ALT+DEL twice in a row to get the classic logon screen
and type the username "Administrator" in the username area and make sure the
password area is blank (since you claim the password is blank) and logon.

Is there some Windows option that can require THE Administrator to
have a password?

Require it - yes. For all users.

Where, in Windows, would restrictions on logon hours be specified?

I doubt this is the case. Google for it though.

And what other "policy restrictions" could keep my User Account
from doing a RunAs THE Administrator?

None that I know of - and it is the built-in administrator, not "THE"
administrator. You could have 50 administrative level users on that
machine - not one of them can do anything that rest of them couldn't...

So - in short...

- Prove the administrator user exists:
- Start --> RUN --> Control UserPasswords2 --> Click OK --> Users tab -->
Administrator listed?
- Log on as the administrator
- Log off the current user --> if you get a Welcome screen, press
CTRL+ALT+DEL twice and type in the username "Administrator" with no password
(as those that install claim it to be.)

If those two things work - then you should be able to utilize runas.
Although I personally would assign a password to at least all your
administrative level accounts. My guess is that is all you have anyway.

Which brings me to the point that you should not have to install any
application as the built-in administrator vs. any other local administrator.
Whatever application that is must have something hard-coded into it (if that
is true) - bad form in my opinion.

 

[John Pollard]

My new install of XP Pro is not behaving like previous install (I had
someone else do the install).

When I right-click an install.exe file to install some third party
software, the click "Run as", then "The following user" which says
"Administrator", I get the following error:

"Unable to log on"
"Logon failure: user account restriction. Possible reasons are blank
passwords not allowed, logon hour restrictions, or a policy
restriction has been enforced."

I did not have this problem before the reinstall, and I don't have it
on my other pc running XP Pro.

How can I determine which restriction is preventing the "Run as" and
how do prevent the restriction from occuring in the future?

Let me try again.

I have now added a couple of new Windows users: one is a Computer
Administrator, the other is a Limited User. So I now have 3 Windows users:
2 Computer Administrators and one Limited User.

No Windows user can use "Run As" to run as any other Windows user. A
Computer Administrator can not Run As another Computer Administrator, nor
can it Run as a Limited User. And the Limited User can not run as either
Computer Administrator.

The error in each case is the same as originally reported:

"Unable to log on"
"Logon failure: user account restriction. Possible reasons are blank
passwords not allowed, logon hour restrictions, or a policy
restriction has been enforced."

I have determined (I believe) that the Secondary Logon service is running.
Its status is "Started" and its Startup Type is Automatic.

How can I get back to being able to use "Run as"?

 

[chaoco]

Similar Problem

I see the same error when I try to login as the adminstrator even though i am already logged in as the computer adminstrator under a different name. Here's the deal though...
Firstly I have two folders in the recycle bin after a reboot that to delete them there must use unlocker, they contain 0bytes and it says access denied in the order of which they were download dd17 Access Denied, some words about being logged in as the administrator though worded in the same way.
The second being the install of security update capicom, ran nearly untill finished then said i must have administrator rights to complete the install, then it saved it in a longnamed folder in the D:/ drive, and the exe that says setup wont run, now when I try to login as the administrator from properties run as it says the exact message the original posted search results, though when I just press right-click run as it scans with avast, but i have not tried to reinstall from windows updater. This was not an issue in all previous reboots that i have had before sp3.
Even tweakui powertoys does not say what the page make hidden names visible, it onyl shows the current account i am using, but the page says it differently than what the app actually shows.
WinXp Home Service Pack 3

It says above that the current account has as many rights as the administrator as that is part of what the nonsafe mode using user shows up as in the particular name, how can administrator in safe even see the files in the recycle bin as the supposedly now lesser computer adminstrator under the default name HP_OWNER... and how could one change this to have more rights and gain access to deleting the files from out of the recycle bin and make the capicom update exe finish running?

 

[chaoco]

Possible Cause

I believe this may have been caused by a stalling sp3 install, that did not finish cleaning up.

 

[chaoco]

I have figured out a remedy to Access Denied files which cannot be delete or restored from Recycle Bin,
First do not follow cmd command prompt remedies as they still say Access Denied Dc or Dd (some number)

Secondly go to any the Drive it was deleted from and open Tools > Folder Options > View and uncheck Hide protected operating system files and Apply then Ok.

You will see the folder called Recycler NTFS, Recycled Fat32...
Delete the folder by using a program like Unlocker, or File Assassin and it will erase the folder,

To remake the folder, if in main hardrive restart computer, if in another drive, just delete a file from that same drive that Recycler is in and it will make a new Folder...

 

[anirudh4444]

found solution for windows 7... maybe xp'll work too

goto any admin acct, run gpedit.msc

in the group policy editor, Goto Computer Configuration>Windows Settings>Security Settings>Security Options
"
set the property "user account control:behaviour of elevation prompt...." to "Prompt for Credentials"

Xpanni