I encountered a bug using the 'As Administrator' option when trying to access a shared folder. I created a shared folder on our server and gave myself deny access rights on this folder. So when I doubleclick the folder I get the 'As Administrator' option, and I enter administrator account plus password.
ghisler(Author) wrote:This means that the entered user name or password are incorrect, or that the program tcmadmin.exe wasn't found.
Nope that's not it. As I've entered administrator account and pass several times. Account and pass are just working fine elsewhere.
And the tcmadmin.exe is exaclty where the error points to.
It's more something with acces rights. Admin has full access to the folder, yet it does not work. If I put my domain in front of the admin account I don't get the error yet I still don't get to enter the folder. While only my own account has "List Folder Contents" set to deny. So every other account should work, yet it does not.
My beta testers have confirmed that tcmadmin works with domains. Does the user which you gave really have admin rights on this PC? Can you run Total Commander with this user's rights (by setting "run as different user" in the lnk file to Tc on the desktop)?
ghisler(Author) wrote:My beta testers have confirmed that tcmadmin works with domains. Does the user which you gave really have admin rights on this PC? Can you run Total Commander with this user's rights (by setting "run as different user" in the lnk file to Tc on the desktop)?
Yes as its the main administrator account.
If I do Run As via the lnk file it works just fine. So account is OK and has all the rights.
1) Created a folder on the server.
2) Gave one user account(which is also in the admin group) DENY Access for "List Folder Contents"
3) I logged on to the server with that user account
4) I doubleclicked the folder and I get the As Administrator dialog
5) I enter "administrator" account and it's password
6) I get the "Error executing program!" error
7) Than I use "MY DOMAIN\administrator" and it's password
8) I don't get the error anymore yet I still can't access the folder
I can doubleclick all I want but no entry and Tcmd does not ask me if I want to logon As Administrator so the "MY DOMAIN\Administrator" was accepted by Tcmd as valid logon.
So as you see the admin account is accepted yet it's rights are not used.
Hmm, interesting - do the other functions of tcmadmin.exe work with the account "MY DOMAIN\administrator"? For example, can you copy a file to a directory to which you have only read rights, but the admin has write rights?
Yes for a normal user this works OK. Tested it with giving a default user(no admin) read rights and also tested it with deny read and deny write option set.
Using "MY DOMAIN\administrator" then works just fine. If use just "administrator" also works. Tcmd then takes the local administrator account, correct?
1)
So the "As Administrator" only seems to stop working when I give a user who is also in the admin group deny rights on a folder. Thus the administrator account does not overrule an account which is also in the admin group.
2)
Tcmd also lets me use a different account than the admin account when I use "As Administrator" option. What I mean is, if I use a simple useraccount who is not an admin, tcmd just let's me use that account, logs in with the result that I cannot acces the specific folder.
Tcmd then does not tell me that i'm still not allowed to enter the folder, as the current user has not the valid rights. So I only can doubleclick and nothing happens. By design?
1) Problem is that the real administrator account has no deny set. So I would say using a different admin account who has no deny set should not be affected by the deny of an other admin.
2) Ok. Yet can't Tcmd check if the user I use has enough rights to enter the folder? I mean if I use a user on a folder who has no entry to that folder, Tcmd tells me this and shows me the admin option. Yet when I then log in with a user who also does not have the correct rights, Tcmd tells me nothing. So only way to get into the folder via another user is by closing Tcmd. Would be helpful if Tcmd could inform you if the other user you use has enough rights.
1) Problem is that the real administrator account has no deny set. So I would say using a different admin account who has no deny set should not be affected by the deny of an other admin.
Your tests seem to prove the contrary. Tcmadmin.exe is run under the user account which you specify, and then calls FindFirstFile/FindNextFile/FindClose, which apparently fail...
Ok. Yet can't Tcmd check if the user I use has enough rights to enter the folder?
No, TC just tries to read the folder's contents. There is no other reliable way to determine whether a user is allowed to read from the folder. For example, the user may be allowed to read the folder contents, but not the folder's access control list...
Your tests seem to prove the contrary. Tcmadmin.exe is run under the user account which you specify, and then calls FindFirstFile/FindNextFile/FindClose, which apparently fail...
So this is a problem with Tcmadmin then?
As I did one more test.
I logged on to a pc with the user account who is an admin but has READ set to DENY for a specific folder. I doubleclick that folder --> get As Admin dialog --> log in with "MY DOMAIN\Administrator" --> still no access to the folder. So I start Tcmd via Run As and use "MY DOMAIN\Administrator" and access on the folder is granted.
So for some reason Tcmadmin.exe does not use the provided administrator correctly...
ghisler(Author) wrote:Hmm, can you find out under what name it is logged on - maybe as local administrator? You can test this by granting the local admin read rights.
The username I use is my personal account, which is admin on my local pc and admin on the network. I'm logged on to the domain network. The folder i'm testing is on a network share. So the local admin rights I can not set on this folder as it only shows me the domain accounts. (Domain admin has Full Control)
If I test all this on my local pc, all is OK. So I gave my account Read Deny on the folder on my local pc. No read allowed --> use As admin --> read allowed.
Both "administrator" and "MY DOMAIN\administrator" work local.
So this issue only seems to appear on folders that are on a network share.
1) Folder on Local pc --> "administrator" and "MY DOMAIN\administrator" works OK
2) Folder on network share --> "administrator" and "MY DOMAIN\administrator" both don't work, Tcmd accepts accounts yet still no read allowed.
Note that the main administrator (local/domain) account has Full Control on the folder (local folder and network share folder)
No idea either. Just happen to notice it. Perhaps Tcmadmin.exe is not taking the correct rights when switching between different users who are all admin.................
If we'd like to find the answer we'd have to go deep like Jacques Cousteau.....
