Administrator with full access still can't execute program

w1r3d · 12 Jun 2012

Hi all!

I'm having a problem with a Windows 7 Professional VM.

I'm trying to "lock down" the permissions of some files (cmd.exe, ftp.exe, etc)

For example, I modify the permissions for C:\Windows\System32\cmd.exe so that only SYSTEM and Administrators have full access. I removed Users, Owner, etc from the list.

Then, if I try to run cmd.exe, I get this message: "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item."

Which is confusing, to say the least. I gave the Administrators group (of which I'm a part of) full access: read, write, execute, etc yet I still can't run the executable. I tried adding other groups such as Users and INTERACTIVE, and THEN it works. However, that defeats the purpose, because then anyone can access the file, which I don't want.

If anyone can shed some light on this issue, I'd greatly appreciate it.

Thanks!
Pedro

w1r3d · 15 Jun 2012

I hate to bump threads, but.. anybody? I'm still stuck with this issue

logicearth · 15 Jun 2012

So everyone has access to cmd.exe...so? Just because they have access to the command line does not mean that can invoke administrative actions. Still bound to their privileges.

w1r3d · 15 Jun 2012

I understand, it's just that I was told to configure it so that only Administrators have access. It's just puzzling to me that even though the *Administrators* have Full Access, they still can't access the file. Ugh.

logicearth · 15 Jun 2012

Administrators are part of the Users group and they are only part of the Administrators group when they use Run As Admin.

Wrend · 17 Jun 2012

Yes, off hand that's probably it.

Was thinking it could be something with the unactivated by default true administrator which is hidden away from normal users, even normal administrator users.

w1r3d · 18 Jun 2012

What I'm seeing is that I can't run cmd.exe even if I do right-click -> "Run as administrator". I *have* to have Users as part of the permissions if I want to be able to run it, even if I'm an administrator. It's quite frustrating. I don't see why I can't just keep Users from being able to access this. The sad part is, it also happens with many other executables, such as ftp.exe.

Edit:
I looked around some, and found a setting called "Prevent access to the command prompt" under User Configuration -> Administrative Templates -> System. I enabled it to see if I could get around the issue, but it still prevents me from accessing the command prompt, even though I'm an administrator (the difference is that now, command prompt starts, but displays a message telling me it's been disabled by an administrator). Same thing happens if I "run as administrator". Again, I just feel like I'm missing something, because this doesn't make sense to me. :/