User Account Control: Admin Approval Mode for the built-in Administrator account ( disabled by default). 
The first one of them handles the built-in Administrator account, while the other one handles all administrative users: This security behaviour is governed by two distinct policies, both found in this gpedit node:Ĭomputer Settings \ Windows settings \ Security settings \ Local policies \ Security options Such highly counter-intuitive permissions mess is caused by User Account Control, a feature which makes so that, even if a standard user is entitled to have administrative rights, it won’t actually be granted with them unless it explicitly request them. Is there a logic explanation for such odd behaviour? Of course there is: keep reading. Long story short, users in Administrators group have not the same rights as the built-in Administrator account.
IE Enhanced Security Configuration is set OFF for Administrators, ON for Users: with the the built-in Administrator account that setting will be OFF, but it will be ON for all other users, even if they’re member of the Administrators group. If we try to manipulate that file’s permissions with the built-in Administrator account, it will work without problems: if we try to do the same with any other user within the Administrators group, we won’t be able to do that. 
A file is owned by SYSTEM and the Administrators group has full control. This also means that any users we put within the Administrators group will inherit these access rights as well, right?Īs a matter of fact, if we create another user and put it in the Administrators group, it will NOT have the same rights as the built-int Administrator user itself: to be more precise, it will be unable to do a lot of administrative tasks. It goes without saying that such account has full rights, as clearly stated in the Administrators group description:Īdministrators have complete and unrestricted access to the computer/domain. Let’s start with the basics: as everyone knows, all recent Windows versions (Windows Server 2012, Windows Server 2016, Windows 8.x, Windows 10 and so on) come with a built-in Administrator account, which is member of the Administrators group. Here’s a common issue that every Windows System Administrators will experience sooner or later when dealing with Windows Server (or Windows 10) and its odd way to handle the Administrators group and the users within it.
0 kommentar(er)
