login vsi company logo login vsi company logo 250x40

 

Get the best possible VDI performance, density and availability with Login VSI
Our Solutions

User Account Control Impact on File Access

User Account Control Impact on File Access

In providing Login VSI Support to our customers with complex virtualized desktop environments, we often come across issues that are indirectly related to our product. User Account Control (UAC), and how it affects file access, is one such issue. I'd like to share some insights on this topic, with the goal of helping Login VSI customers succeed in their virtualized desktop implementations.

UAC is a mechanism that was introduced by Microsoft in Windows Vista that is intended to make administrator accounts more secure. The administrator account has (when UAC is enabled) 2 tokens.

A token is a Windows internal structure that describes the rights and permissions for a user or even a program.

Of the two tokens, one has normal User permissions and the other has Administrator permissions. In practice, this means that the non-administrator token has deny permission on the Administrator account and group. Look at the screenshots below. The first screenshot shows cmd.exe while it was explicitly run as Administrator by right clicking it and choosing to run it as Administrator.

cdmd.exe as administrator

The second screenshot shows the token for a non-elevated cmd.exe instance. These are the permissions an application gets when the application is run on a UAC-enabled system without explicitly running the application as an Administrator.

non-elevated cdm.exe instance

As you can see, this token has explicit deny permission on the Administrator group. This can result in some unexpected behavior. Imagine you have an account that is member of the Administrator’s group. You try to secure a folder by only allowing the Administrator group access to the folder.

only allow administrator group access

Since your user account is member of the Administrators group, it should be able to access the folder right? Wrong, the non-elevated instance of cmd.exe is unable to access the directory.

administrator access is denied

The elevated user however does have access to the files.

elevated user does have access

Needless to say, this can be confusing to our customers, as they have made the user account a member of the administrator group. But since UAC puts an explicit deny on the administrators group, it means that the user will not have access unless the process is elevated (in other words, uses the administrator token). We hope you keep this in mind when troubleshooting access issues, whether those problems are Login VSI related or not.

 


 

Start using Login VSI today

Our industry-standard software is built to help you avoid problems, lower costs and improve performance. Request a Quote or get your free Trial below, and benefit from our award-winning services.

Free Price Request  Your Free Trial

 


About the company Login VSI

The company Login VSI provides end-user performance insights for virtualized desktop and server-based computing environments. Enterprise IT departments use flagship product Login VSI (for load testing) and Login PI (for continuity testing) in all phases of their virtual desktop deployment—from planning to deployment to change management—to build and safeguard a good performance, a high availability, and (as a result) a good and consistent end-user experience. For more information about Login VSI or for a free test license contact us.

Tags: How-to, Login VSI, Load Testing, Best Practices, Support

Popular Blogs

Login VSI officially recognized as an integration partner for WVD by Microsoft

Windows Virtual Desktop

I’m excited to share with you that as of this week Login VSI has officially been recognized as an integration partner for Windows Virtual Desktop (WVD) by Microsoft. Continue Reading
Join us at VMworld 2019 - Booth #866

Join us at VMworld 2019 - Booth #866

Join us at VMworld 2019 - Booth #866 Are you attending VMworld in San Francisco next week? Great, we are too! Continue Reading
State Of The Union Survey Results 2019

State of EUC Survey Results

State of EUC Survey Results At community site VDILIKEAPRO.com we recently surveyed almost 600 people who work in the End User Computing (EUC) industry with a focus on VDI and SBC. Continue Reading
Login VSI at VMworld 2019 - Our Debrief

VMworld 2019 - Our Debrief

VMworld 2019 It’s that time of the year again, we’ve just wrapped up VMworld US and it was great meeting many folks on the expo floor, vendor booths, sessions and of course for a drink in the evening. Continue Reading
Windows Virtual Desktop - Update - December 2019

Windows Virtual Desktop Enhanced in the Latest Update

Planning to move to Windows Virtual Desktop and/or Citrix Managed Desktop? A lot has already been written about Windows Virtual Desktop (WVD) in the last months and while I had my initial concerns on this service many people are suggesting that they are willing to move to a platform like WVD in the next two years. Continue Reading
Login VSI - Blog - 4 Things to Consider when Running Office 365 in the Cloud

4 Things to Consider when Running Office 365 in the Cloud

Recently a customer decided to move their entire VDI infrastructure into the cloud. The VDI environment was approximately 20,000 users. As you can imagine there are a lot of design decisions necessary to ensure the success of this migration. Continue Reading
Cookie Settings