Administrator with full access still can't execute program

[w1r3d]

Hi all!

I'm having a problem with a Windows 7 Professional VM.

I'm trying to "lock down" the permissions of some files (cmd.exe, ftp.exe, etc)

For example, I modify the permissions for C:\Windows\System32\cmd.exe so that only SYSTEM and Administrators have full access. I removed Users, Owner, etc from the list.

Then, if I try to run cmd.exe, I get this message: "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item."


Which is confusing, to say the least. I gave the Administrators group (of which I'm a part of) full access: read, write, execute, etc yet I still can't run the executable. I tried adding other groups such as Users and INTERACTIVE, and THEN it works. However, that defeats the purpose, because then anyone can access the file, which I don't want.

If anyone can shed some light on this issue, I'd greatly appreciate it.


Thanks!
Pedro

 

[w1r3d]

I hate to bump threads, but.. anybody? I'm still stuck with this issue

 

[logicearth]

So everyone has access to cmd.exe...so? Just because they have access to the command line does not mean that can invoke administrative actions. Still bound to their privileges.

 

[w1r3d]

I understand, it's just that I was told to configure it so that only Administrators have access. It's just puzzling to me that even though the *Administrators* have Full Access, they still can't access the file. Ugh.

 

[logicearth]

Administrators are part of the Users group and they are only part of the Administrators group when they use Run As Admin.

 

[Wrend]

Yes, off hand that's probably it.

Was thinking it could be something with the unactivated by default true administrator which is hidden away from normal users, even normal administrator users.

 

[w1r3d]

What I'm seeing is that I can't run cmd.exe even if I do right-click -> "Run as administrator". I *have* to have Users as part of the permissions if I want to be able to run it, even if I'm an administrator. It's quite frustrating. I don't see why I can't just keep Users from being able to access this. The sad part is, it also happens with many other executables, such as ftp.exe.

Edit:
I looked around some, and found a setting called "Prevent access to the command prompt" under User Configuration -> Administrative Templates -> System. I enabled it to see if I could get around the issue, but it still prevents me from accessing the command prompt, even though I'm an administrator (the difference is that now, command prompt starts, but displays a message telling me it's been disabled by an administrator). Same thing happens if I "run as administrator". Again, I just feel like I'm missing something, because this doesn't make sense to me. :/