Need Help Understanding UAC in Windows 7

[Andaho]

I am organising files on my storage drive, and most files (created before I did a fresh install of windows 7) prompt for permission when moving/renaming.

Of course it's not a problem, just an annoyance when sorting tons of files.

I thought an easy fix for this would be to select the root of the drive, and take ownership of the whole drive including subfolders.

However, I am still prompted for moving/renaming files? - I checked the permissions, and I am the owner.

I'm not looking for a workaround to this, but can anyone help me understand why when I am the owner, that I am still prompted for permission?

Also, can someone explain what the unknown user account is that has a name like S-1-5-21-123456789 etc...? - On googling it, I understand it is an unknown user account using the SID as the name, but why is it there on a clean install of windows?

[aidanjt]

Delete that user and add your current account name on the drives root. That string is how Windows recognises users, the string matches a user name in the system user database, when you reinstall Windows it screws up NTFS permissions. Since UAC 'artificially' restricts an administrative user to a 'standard' user, you can get prompts like that when it seems you're performing administrative actions (like reading/writing files you don't have permissions for).

[Andaho]

I cannot seem to delete the unknown user, probably easiest if I give a screenshot here:



I have read on another forum answer the following:

Normally you should be able to delete the Unknown account from the security list.

See if you can delete from the Security Tab.

Go to the Security Tab by right-clicking on the Account and selecting properties. Do you see Edit button?

Is it also grayed out? If not, click the edit button and click the Remove Button.

If you're told that you can't remove that account because it's being inherited, then close those dialog boxes and go up one folder in the tree and repeat the procedure. Keep doing that until you can
remove the "Unknown Account" SID from the permissions dialog box.
If you still unable to delete from there, perhaps cleaning up the entries from registry should help.

To do so, run registry cleanup scan on your computer.

This Downloads folder in directly on the root of the drive, and looking at properties of the drive, the unknown user is not there, so I cant, as it suggests, go up a folder in the tree.

I wouldn't even be tempted to touch a registry cleaner though I would like to understand what is happening here.

[Paul Adams]

I'm not looking for a workaround to this, but can anyone help me understand why when I am the owner, that I am still prompted for permission?

An owner of an item has the permission to alter its Access Control List (ACL), but it does not mean they are on the ACL.
Privilege to change permissions (and add yourself) is not the same as having permission.

Also, can someone explain what the unknown user account is that has a name like S-1-5-21-123456789 etc...? - On googling it, I understand it is an unknown user account using the SID as the name, but why is it there on a clean install of windows?

It is on the ACL of the item you are looking at, it doesn't come from the current OS installation (but a previous/different one).

If you install Windows and create a user "Bob", a Security Identifier (SID) is generated to refer to this user object - for authentication, ownership, permissions, group membership, etc.
The user "Bob" can be renamed, but this does not change his SID - it would be an administrative nightmare if that happened.

If another computer has a user "Bob" created, it also gets a unique SID - there is absolutely no relationship between the Bobs.

If the first machine is formatted, Windows reinstalled and user "Bob" created, it would have a different SID to the one it had before.


The GUI makes a SID-to-name translation based on the security database (local SAM in the case of most home PCs, Active Directory in the case of corporate PCs), and this is how it is able to decode S-1-22-333-4444-55555 into "Bob" so it makes sense to you.

This is why you can't really use NTFS on removable storage effectively - the ACLs refer to SIDs that only make sense to a particular machine/domain, and other machines are unable do the SID-to-name translation.

The only exceptions to this are "well known SIDs" which are deliberately the same across all versions of Windows, but often can't be used across the network (just because I can authenticate as a member of Administrators on my machine doesn't mean I should be able to access yours remotely as such).

A SID that cannot be resolved doesn't cause any problems.

[12GaugeShotty]

Just take ownership of the root. That will give you full control of the external drive and you will not get UAC prompts anymore. Ensure you check "Replace owner on subcontainers and objects" before you apply.

Here is a Microsoft KB on how to do it: http://support.microsoft.com/kb/308421

Windows 7 will be pretty much the same even though the KB applies to Windows XP.

[pardal51]

Did you upgrade your OS or did a clean install of 7? Did you change accounts?
Have you tried to boot into prompt only and use clacs command?
Let us know how you get on

[Andaho]

Let us know how you get on

Thanks for your help guys (especially to Paul), I will look into it again sometime soon, when I come to finish sorting my files but for now the job is low priority.

I will let you know how I get on, and yes, it was a clean install with a storage HDD from previous XP install.

[aidanjt]

As Paul Adams points out, there's a number of static SIDs you can use on external drives to avoid permission issues, the "Everyone" user, for e.g..

[12GaugeShotty]

As Paul Adams points out, there's a number of static SIDs you can use on external drives to avoid permission issues, the "Everyone" user, for e.g..

Actually, you never want to assign "Everyone" with Full Control to any file/folder...ever. It is the worst security practice that anyone can preach.

[aidanjt]

Actually, you never want to assign "Everyone" with Full Control to any file/folder...ever. It is the worst security practice that anyone can preach.

It's an external drive. Using NTFS with "Everyone" as owner is no worse than using FAT32, except you can address files greater than 4GB.

[12GaugeShotty]

It's an external drive. Using NTFS with "Everyone" as owner is no worse than using FAT32, except you can address files greater than 4GB.

Just taking ownership will give him what he needs. Adding "Everyone" to a NTFS permission on anything is best left forgotten and never repeated.

[aidanjt]

Just taking ownership will give him what he needs. Adding "Everyone" to a NTFS permission on anything is best left forgotten and never repeated.

You're missing the point, his SID for *that* machine is *only* on that machine, which means every time he plugs in the drive to any machine, or even reinstalls windows on that machine means he has to retake ownership *every* time. What if he doesn't have administrative permissions on a given machine he plugs his drive into?.. His data will be inaccessible. The "Everyone" SID does have it's uses, which is why it exists in the first place.

[12GaugeShotty]

You're missing the point, his SID for *that* machine is *only* on that machine, which means every time he plugs in the drive to any machine, or even reinstalls windows on that machine means he has to retake ownership *every* time. What if he doesn't have administrative permissions on a given machine he plugs his drive into?.. His data will be inaccessible. The "Everyone" SID does have it's uses, which is why it exists in the first place.

No, he will not have to take ownership on any future computers. He just needs to do this to get around UAC. He can plug his external drive into a Windows XP PC and will never have any issues. In fact, he can disable UAC on his Windows 7 PC and never have any prompts when writing to the external drive.

Not to mention, in case you didn't see, his Downloads folder already has "Everyone" in the ACL. Yet he's still getting the prompt.

The issue is UAC here and not lack of permissions. The workaround is either taking ownership or disabling UAC.

[aidanjt]

No, he will not have to take ownership on any future computers. He just needs to do this to get around UAC. He can plug his external drive into a Windows XP PC and will never have any issues. In fact, he can disable UAC on his Windows 7 PC and never have any prompts when writing to the external drive.

Not to mention, in case you didn't see, his Downloads folder already has "Everyone" in the ACL. Yet he's still getting the prompt.

The issue is UAC here and not lack of permissions. The workaround is either taking ownership or disabling UAC.

His issues is with the ACLs on the drive, not UAC, stop spreading dangerous misinformation. UAC is doing what it's suppose to.

[12GaugeShotty]

His issues is with the ACLs on the drive, not UAC, stop spreading dangerous misinformation. UAC is doing what it's suppose to.

He came here posting that he kept getting UAC prompts when trying to make changes on an external drive. He didn't say that he got "Access Denied" when trying to make these changes. That makes it a UAC issue and NOT an ACL issue.

UAC's purpose is to prevent applications from installing without approval. I have never understood why it goes to the depth of prompting when trying to make changes on external drives when someone already has full control permissions to that drive. That is not a necessary function of UAC. Perhaps required for the system folders (Windows, Program Files, etc) is understandable.

Pot calling the kettle black BTW. Telling someone to add "Everyone" with full control to an ACL is by far the most dangerous misinformation you can tell someone. Not sure if you fully understand the consequences of doing that.

[aidanjt]

He came here posting that he kept getting UAC prompts when trying to make changes on an external drive. He didn't say that he got "Access Denied" when trying to make these changes. That makes it a UAC issue and NOT an ACL issue.

Of course he's getting "Access Denied" because his ACLs are screwed up, that's what happens when ACLs are screwed up. UAC is giving him a way around it by elevating his privileges to a user who does have access (administrator). That's what UAC does.

UAC's purpose is to prevent applications from installing without approval. I have never understood why it goes to the depth of prompting when trying to make changes on external drives when someone already has full control permissions to that drive. That is not a necessary function of UAC. Perhaps required for the system folders (Windows, Program Files, etc) is understandable.

Wrong. UAC's purpose is to de-escalate privileges of Administrative users, and provide privilege escalation to standard users. It doesn't need to do special voodoo to check which exe is allowed to do something and which doesn't.

Pot calling the kettle black BTW. Telling someone to add "Everyone" with full control to an ACL is by far the most dangerous misinformation you can tell someone. Not sure if you fully understand the consequences of doing that.

Yes, it allows everyone to have the same privileges Everyone has, that's why it's called the Everyone SID. That means anyone who gets their grubby mits on your external drive can read or alter your data (depending on the specific permissions Everyone has). Do you know what?.. I can do that anyway, with, or without permissions, just like FAT32 formated drives. Disabling UAC, on the other hand, opens you up to a world of butthurt.