I’m having a bad hair day. Man, am I frustrated with Vista security today. So in my last post I mentioned that I had problems with my SQL Server not recognizing my login as an administrator login. Well, after some more checking I think I can see that my account is not really an Administrative account.

 

It’s ridiculously hard to trouble shoot this and actually determine what your account status is. Vista itself shows everything as if my account was an administrative account, but (as shown below) it looks like the system itself doesn’t see me as an Administrator. So how do you tell whether you are REALLY an administrator or not?

 

It seems I’m an administrative user: I can run admin tasks like bringing up the Services panel or Device Manager or running IIS Service manager. If I run WHOAMI I get:

 

GROUP INFORMATION                                                                       

-----------------                                                                        

                                                                                        

Group Name                             Attributes                                       

====================================== ==================================================

Everyone                               Mandatory group, Enabled by default, Enabled group

RASVISTA\Debugger Users                Mandatory group, Enabled by default, Enabled group

BUILTIN\Administrators                 Group used for deny only                         

BUILTIN\Users                          Mandatory group, Enabled by default, Enabled group

NT AUTHORITY\INTERACTIVE               Mandatory group, Enabled by default, Enabled group

NT AUTHORITY\Authenticated Users       Mandatory group, Enabled by default, Enabled group

NT AUTHORITY\This Organization         Mandatory group, Enabled by default, Enabled group

LOCAL                                  Mandatory group, Enabled by default, Enabled group

NT AUTHORITY\NTLM Authentication       Mandatory group, Enabled by default, Enabled group

Mandatory Label\Medium Mandatory Level Mandatory group, Enabled by default, Enabled group

 

Looks like I’m part of Adminstrators right?

 

Or am I? Look again at the Group used for deny only. I have no idea what that means but I suspect that’s what the problem is.

 

I also ran some code in an application to check for admin rights by checking for the Administrators group explicitly in code. While running through this I noticed that I wasn’t showing up as Administrators in this list either:

 

WindowsIdentity id = WindowsIdentity.GetCurrent();

 

string Out = "";

foreach(IdentityReference Group in id.Groups)

{              

    NTAccount Account = Group.Translate( typeof(NTAccount) ) as NTAccount;

    Out  += Account.ToString() + "\r\n";

}

 

MessageBox.Show(Out);

 

Which results in:

 

RASVISTA\None

Everyone

RASVISTA\Debugger Users

BUILTIN\Users

NT AUTHORITY\INTERACTIVE

NT AUTHORITY\Authenticated Users

NT AUTHORITY\This Organization

LOCAL

NT AUTHORITY\NTLM Authentication

 

Something missing here???? No Administrators group account.

 

This would explain why SQL Server is having a hell of a time trying to authenticate me as an Administrator.

 

So now I’m really confused as to WTF is going on. In Vista I have:

 

  • UAC off
  • Account type set to Administrator
  • My User Account is part of the Administrators group in the old User Manager
  • Run all administrators in Admin Approval Mode group policy option is disabled

 

What else do I need here to get my admin acount status back properly?