Windows Server 2008 R2 File Permissions

Question

I’m having some problems understanding some particular file permissions behaviour. Here are the steps to reproduce:

1. Log into the server using the default Administrator account

2. Create a text file (testfile.txt) in C:\ProgramData containing some arbitrary text

3. Create a new user account and make it a member of the Administrators group

4. Log in using new account and open C:\ProgramData\testfile.txt

5. Edit the text and try to save

Upon clicking save I’m presented with the save as dialog, which indicates that i do not have the necessary permissions to edit the file. This seems odd considering that the new user account is a member of Administrators.

When I view the permissions of the file I can see the there are three groups listed, System, Administrators and Users. SYSTEM and Administrators have full permissions, however, Users only has the Read & Execute and Read permissions checked.

It would appear that when I open the testfile.txt from the new users account, it opens in the context of the Users group, despite being a member of Administrators, is this correct? It would certainly explain the behaviour.

The reason that this is an issue for me is that if I deploy an application via 'Run as Administrator', will normal users be able to edit the text files I install to ProgramData.

Is this behaviour confined to Windows server or is it the same in Vista and Win7.

Answer 1

I just tested on Windows 7 and can write to files under ProgramData without issue. You can test whether you're having a UAC issue by launching an elevated notepad (right click in the start menu and Run As Administrator.) If the elevated notepad can write the file, then the application you plan to have Run As Administrator will also be able to. If elevated notepad can't write it, then elevating your app won't help.

Answer 2

Hi, ive tested it on windows 2008 r2. this is how it suppose to be. its called uac. youve created normal user and want to edit (even with local administrator group) file which owner is administrator. you cannot do this but you can grant administrator privilidges and edit that file.

More details http://en.wikipedia.org/wiki/User_Account_Control