Accessing C drive as a domain admin - no permissions.

[garethEds]

Following an earlier thread, I have a machine that is connected to the domain with Domain Admin account part of the local administrators group. I assumed everything was working fine.

 

We have turned UAC off for administrators for now until I read some more. This also works (except for drive mapping via gpo).

 

My problem is that the Domain Admin account cannot access the c drive nor edit the Hkey local machine part of the registry as well. I wonder whether they are related?

 

Can anyone advise as to why the domain admin would not be able to access the c drive and if so can it be set via gpo?

 

Many thanks

 

Gareth

[burgemaster]

Sounds like you have "Loopback Processing" applied in one of your group policies

 

As this will apply to any user...

 

Do a Result of Group Policy and check:

Administrative Templates, System, Group Policy, Loopback Policy

[SYNACK]

Assuming you mean writing to the C: root directory then both of these things are tasks that require privilage elevation, although you have disables UAC thses lockouts may remain you just won't get the UAC dialogue to elevate your request and make it work.

[garethEds]

Sounds like you have "Loopback Processing" applied in one of your group policies

 

As this will apply to any user...

 

Do a Result of Group Policy and check:

Administrative Templates, System, Group Policy, Loopback Policy

 

Hi,

 

We might have - I have been told by the LEA that we have to have 'Merge Mode' so I have set this in:

 

Computer Configuration > Adminitrative Templates > Policies > System Group Policy > User Group Policy Loopback Processing Mode

 

This is set to enabled.

 

But how would this stop the DomainAdmin accessing the C drive? Can anyone advice how to get around it as apparently this setting has to be done in our AD (which is provided by the LEA).

 

[Edit: OKay - I lie. I can access the C drive, but cannot access or write to certain areas - I assume these are the protected areas. Program Files is one of them]

 

Many thanks

 

Gareth

Edited June 29, 2010 by garethedmondson

[srochford]

Not absolutely sure but I think this is "working as designed" - you really need to have UAC turned on.

 

When you go to write a file to (eg) c:\program files UAC should pop up saying "are you sure", you say yes and you're allowed to write (simplifying a bit!)

 

As @synack; says, if you turn off UAC then you don't get the prompt and you're not allowed to write.

 

What are you trying to do?

 

If you want something to be automated (and thererfore the UAC prompt gets in the way) then you can enable the administrator account and use that - this account can make changes to the file system without prompting.

[SYNACK]

Yeap, running as a domain admin does not automaticly get past those restrictions but running as the local administrator on the machine does. If you want to test this a quick way would be to use the runas program from the command prompt to run things as the local administrator manually, this will emulate what UAC does for you automaticly. Long term I would be looking at using UAC though although it does sound like your county AD has been setup in every way possible to be an impediment to use of anything other than their preffered OS.