DirectoryEntry.NativeObject throws access denied for a user in Administrators group in windows 2008

Question

I have a local user, which is member of Administrators local group.

When I run this code:

using System;
using System.DirectoryServices;

namespace nanttest
{
    class Program
    {
     public static void Main(string[] args)
     {
      using(DirectoryEntry entry = new DirectoryEntry("IIS://localhost/W3SVC"))
      {
       object absobject = entry.NativeObject;
       Console.WriteLine("Name: {0}", entry.Name);
      }

      Console.Write("Press any key to continue . . . ");
      Console.ReadKey(true);
     }
    }
}

I receive:

Unhandled Exception: System.Runtime.InteropServices.COMException (0x80070005): Access is denied.

at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail) at System.DirectoryServices.DirectoryEntry.Bind() at System.DirectoryServices.DirectoryEntry.get_NativeObject() at nanttest.Program.Main(String[] args) in c:\Work\nanttest\nanttest\Program.cs:line 20

If I run this code while logged in as Administrator, it works OK.

Also, this code fails if I run it logged in as a DomainAdmin user. I have added MYDOMAIN\DomainAdmins and MYDOMAIN\mydomainuser as members of local Administrators group.

What other permissions should I add for these users, so they can run this code.

Answer 1

To answer my own question, so others can find a solution:

The problem is with the default UAC settings in Windows 2008. Even if a user is in the Administrators group, he/she still needs elevated privileges to run some operations (the one above appears to be among them).

So, solution 1 - run the application using "Run as administrator", or start it from a command prompt, which was started with that option.

Solution 2: Disable UAC for administrators group - I have used method #3 from this article (group policy changes). Remember to reboot the server after these changes.

Answer 2

Thanks.

I was wondering what was going on also. When assigning the logged in user rights in the specific OU that the group was created in I had no problems. Hopwever when thje user was only a memberof the administrators group acces was denied in creating a group. Starting my app with "Run as Administrator" solved this problem right away