Re: Administrators v Administrator security differences

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 03/25/05 

Date: Thu, 24 Mar 2005 21:52:41 -0600

The administrator is a member of the administrators group but the
administrator account may have different permissions and rights than the
administrators group. What may help is to enable auditing of object access
on that computer and audit the file/files/folder that the user is having
trouble accessing. I would also enable auditing of privilege use for success
and failure until the problem is resolved. Look in the security log of Event
Viewer for pertinent events. Also keep in mind that if the user is a member
of another group with deny permissions/user rights then that can cause
failed access. Filemon and regmon from SysInternals may also help you. The
links below should help more. --- Steve

http://support.microsoft.com/default.aspx?scid=KB;en-us;q248260
http://support.microsoft.com/default.aspx?scid=kb;en-us;301640
http://www.sysinternals.com/ntw2k/source/filemon.shtml

"Glenn Kreisel" <Glenn Kreisel@discussions.microsoft.com> wrote in message
news:EDD99035-45E9-40A1-A240-FD0F7A2999D1@microsoft.com...
>I have this issuing going on where I can access a piece of software
> when I'm logged in as "Administrator" but I can not access it when I'm
> logged in as "user10" who is part of the Administrators group.
>
> Everything I look at says the "user10" should have the same access level
> as the "Administrator" account.
>
> What are the differences from the "Administrator" account and being part
> of
> the "Administrators" group.
>
> HELP
>

Relevant Pages

  • Re: Denying Changes to Group Membership
    ... Built-In Administrators group that would deny the ability for a member ... You can of course go in an put "DENY Modify" permissions ...
    (microsoft.public.win2000.active_directory)
  • Re: cannot add local user to local group
    ... You can control the Local Administrators group with the Restricted Groups Policy. ... This posting is provided "AS IS" with no warranties, and confers no rights. ... One local user account "test" and one domain user ... "Member of" tab is empty. ...
    (microsoft.public.win2000.active_directory)
  • Re: Scheduled tasks in Server 2003 do not run
    ... have just added the user to the local Backup Operators ... I've even gone so far as to reset the permissions ... > Administrators group the task would not run, ... > be able to logon as batch job). ...
    (microsoft.public.windows.server.general)
  • Re: Exchange 2000 & Administrator Rights
    ... >Full Administrator right still needs to be a member of the local machines ... >What I would idealy like to do if specifically grant rights over the ... >Domain which then grants people rights over other stuff that I do not want ... >Administrators group gets over Exchange which make membership of this group ...
    (microsoft.public.exchange2000.active.directory.integration)
  • Re: User Rights in TS
    ... OK - as far as setting those permissions goes, enabling full rights for the ... Regarding deploying the server without Group Policy active. ... If it's the local administrators group, ...
    (microsoft.public.windows.terminal_services)