Screwed?

[ArPaNET]

Sorry all, I had class this morning...

He is just like I am/was when it comes to computers... mess around with stuff to see the results! He said he went in through safe mode, right clicked on the c: drive and clicked properties, then denied privileges to the user accounts...

He said when he went in, he didn't deny access to administrator, which says to me that the admin account is active, I just don't know how to access it.

@Cider: No UAC is still on but when I go to do something that requires administrator privileges it says access denied!

@nihil: My accounts work, I just can't access my c: drive or anything that has to do with it! (turns out that when the system files are on that drive, that is ALOT)

any ideas, or is it time to get the magic restore/re-install disc out?

[ShagDevil]

Is it possible to temporarily add this machine to a friend's/co-worker's domain? I don't know if Netdom (used in conjunction with runas) or Psexec would work on the Vista systems but, it might be worth a try. Domain Admins will automatically get added to the Administrative group once you add a machine to a domain and maybe you reset the local accounts.

Just a quick thought. I apologize if this is not a plausible idea. I'm a bit busy dealing with Symantec issues today

[ArPaNET]

Okay... I am pretty sure I am screwed here!

this is the update: I activated the administrator account via
'net user administrator /active:yes'

I still have the same problem, even with me being logged in as the admin!
I tried to take ownership of the drive with 'takeown' program, with no success.

So unless someone knows how to change the privileges without having access to the drive, it is time to chalk this one to the loss column and waterboard my little brother lol.

[nihil]

OK, I think that I see a part of it, but it does raise some interesting questions for me.

If he went in through safe mode then I think he would have seen the otherwise hidden "Administrator" account.................. anybody confirm or deny this for Vista?

You have not deliberately activated it, so it is dormant.

This is very interesting, as he seems to have done it almost inadvertently (OK apart from "messing around")............. I am entertaining relatives right now, but will look around in more detail tomorrow.

Thanks for bringing this one up............ if your bro can do it, then I am sure I will be getting some fairly shortly .............. like the kids got it for Christmas............ six weeks to stop complaining that it isn't like XP, and figure out how to get the game controllers and printer to work.............

I guess they will start to serious messin around about now?

So................. I expect to see something similar quite shortly,

Cheers,

Johnno

[ArPaNET]

Darn, my heart started beating a lil faster once I saw nihil post =)

well I am not sure that just any young person could do this, not assuming that your relatives are not completely computer literate, but...

After the torture began, he spilled that he was trying to setup account restrictions like those you see on his school network!

Who said that torture shouldn't be used! a lil plastic wrap and a glass of water can get anything out of people =) just kidding!

turns out that my restore disc is at my house, so until this weekend I will have to resort to saving things on my usb drive... So feel free to add suggestions on fixing this problem until this weekend

[LateNightLurker]

There are differences between an account that has admin privilages, and an account that is admin. The admin account is disabled by default. You can access and enable it via the User Accounts Control Panel. You must also disable ALL other user accounts with admin privilages before you reboot into the admin account.

When your bro booted via safe mode, he was automatically placed into the admin account, which is why he was able to lock out the drive.

[nihil]

Hi there ArPaNET,

I will take a closer look Thursday. Have you tried logging in as "Administrator" or "administrator" with a blank password?

Not my relatives............. those of customers I am thinking

I am afraid that I don't have a Vista box on hand at the moment to check it with, so it will have to wait a little bit.

You can access and enable it via the User Accounts Control Panel. You must also disable ALL other user accounts with admin privilages before you reboot into the admin account.

From what I understand, those options are no longer available?

[Ouroboros]

I think I may have found something.

If you can boot to Windows in safe mode, go to Administrative Tools > Computer Management > System Tools > Local Users and Groups > Users. There you will find the elusive Administrator user. Go into that profile and see your options.

If you can't get that far due to a password lockout, I would ask your little bro to give you the password or discover the default password if he didn't set one. I didn't try to experiment with the settings, as I don't need the headache that you are having right now trying to figure it out.

Hope that helps, and sorry for wasting your time if I'm just suggesting things that you've already tinkered with.

O

I did succumb to my curiosity and tinker with the settings. I'm kind of thinking that if you re-disable the super-Admin account (and check yours to make sure that little bro didn't tinker with it), that things may return to normal. I'm not certain of this, as I've been using Vista in one form or another for 6 months and just now discovered this area of the OS. It's like a hyper-paranoid version of Ubuntu Linux, while being more vague and touchy.

[moxquito]

I'm not sure if you would have to boot to safe mode or if its possible in normal mode as I dont have a Vista Box to play with. have you tried right clicking on the drive and going to the security tab... and make sure your account is in the "group or account" list and that it has full control. you may have to attempt to take ownership of the drive.

I know you will run into this issue if you remove all accounts from this list in
2k/XP just not sure about vista... Its worth a shot though.

[mohaughn]

Have you tried right clicking on the folder as administrator and adding your account back by using the "security" tab? Or tried using cacls to give yourself permissions?

http://technet2.microsoft.com/window....mspx?mfr=true

http://technet2.microsoft.com/window....mspx?mfr=true

If you have been specifically denied access to a file, you will have to remove that explicit deny before you can take ownership.


I just checked, the "administrators" group has ownership right on the my c: root. I also checked, and you can restrict an administrator from having the "take ownership" right by doing a deny on full control for the "users" group. By default the administrator account will always have the "take ownership" privilege, but you can override that with an explicit deny.