login vsi company logo login vsi company logo 250x40
header-03.jpg

User Account Control Impact on File Access

User Account Control Impact on File Access

In providing Login VSI Support to our customers with complex virtualized desktop environments, we often come across issues that are indirectly related to our product. User Account Control (UAC), and how it affects file access, is one such issue. I'd like to share some insights on this topic, with the goal of helping Login VSI customers succeed in their virtualized desktop implementations.

UAC is a mechanism that was introduced by Microsoft in Windows Vista that is intended to make administrator accounts more secure. The administrator account has (when UAC is enabled) 2 tokens.

A token is a Windows internal structure that describes the rights and permissions for a user or even a program.

Of the two tokens, one has normal User permissions and the other has Administrator permissions. In practice, this means that the non-administrator token has deny permission on the Administrator account and group. Look at the screenshots below. The first screenshot shows cmd.exe while it was explicitly run as Administrator by right clicking it and choosing to run it as Administrator.

cdmd.exe as administrator

The second screenshot shows the token for a non-elevated cmd.exe instance. These are the permissions an application gets when the application is run on a UAC-enabled system without explicitly running the application as an Administrator.

non-elevated cdm.exe instance

As you can see, this token has explicit deny permission on the Administrator group. This can result in some unexpected behavior. Imagine you have an account that is member of the Administrator’s group. You try to secure a folder by only allowing the Administrator group access to the folder.

only allow administrator group access

Since your user account is member of the Administrators group, it should be able to access the folder right? Wrong, the non-elevated instance of cmd.exe is unable to access the directory.

administrator access is denied

The elevated user however does have access to the files.

elevated user does have access

Needless to say, this can be confusing to our customers, as they have made the user account a member of the administrator group. But since UAC puts an explicit deny on the administrators group, it means that the user will not have access unless the process is elevated (in other words, uses the administrator token). We hope you keep this in mind when troubleshooting access issues, whether those problems are Login VSI related or not.

About the author

Dennis Geerlings started at Login VSI about 4 years ago and worked as a consultant within Login Consultants. He supported multiple customers in migration projects. Presently, Dennis is support manager and lead consultant at Login VSI. In these roles he supports customers and partners in the US and Canada, co-develops the Login VSI product, and serves as a pre-sales engineer for enterprise customers. 


Tags: How-to, Login VSI, Load Testing, Best Practices, Support

What our customers are saying

Sajad Shah - Cancer Research

"Login VSI has empowered us to make more informed decisions on releasing a new vDisk which we now do on a monthly basis. We have found that Login VSI tests can also flag other issues in our environment that may not be picked up by our standard User Testing which allows us to either make the appropriate changes to the vDisk or workload script adjustments to run successful tests. This has given us peace of mind and allows us to release VDI’s with confidence."

Sajad Shah, Senior Technical Analyst at Cancer Research UK


Eduardo Molina - RoundTower Technologies

"Login VSI support is fantastic. I had one issue, things were not working. I sent an email, got a call the next morning and the guy knew exactly what I was talking about and we just solved the issue in less than an hour. And that was one thing that was really, really great, the support that we get from Login VSI is fantastic."

Eduardo Molina, Virtualization and Cloud Architect at RoundTower Technologies


Jamie Vernon - STARTEK

"Login PI enables us to minimize system downtime and deliver strategic business value like never before."

Jamie Vernon, VP of IT and infrastructure at STARTEK 

Login VSI, Inc.

300 Tradecenter

Suite 3460
Woburn, MA 01801

Phone: +1 844 828 3693

Login VSI B.V.

De Entree 85
1101 BH Amsterdam
The Netherlands

Phone: +31 20 705 1200