Link to home
Start Free TrialLog in
Avatar of AncientFrib
AncientFribFlag for United States of America

asked on

Domain User Cannot Write to C - Windows 7

Hello,

We run in a restricted windows environment.  Users are not allowed to have administrative rights to their machine.  For some reason, I cannot modify the C drive permissions to allow a user to write to the root of the C drive only.  They have an application that needs to write a text file to the C drive and modify it quite often.  No matter what I do I cannot get Windows 7 to allow a user to write to the root of the C drive without adding them to the adminstrators group.

I have tried adding them to the Power users group, I have tried modifying the permissions several times giving them modify rights to the root of C only to no avail.  Any thoughts??
Avatar of Alan Henderson
Alan Henderson
Flag of New Zealand image

The root directory is a protected area in Vista and Windows 7.

You'd have to enable the Administrator account and log in as Admin to be able to write to it.

I hope someone can come up with a workaround, but I wouldn't bank on it.

:)
Have you tried turning off User Account Control?
i would recommend seeing if you can create a new folder under the root and give this user the read/write permissions, or if the application has the ability to run as a service you could set it to run under the administrator account. what is the application you are working with that needs to write to the root?

from some user :
I've since found half a solution to this problem. If I go into the Computer Management console, there is a "New Share" option when you right-click the active shares sub-folder. From that wizard, I can add a share to anything, including drives.
...however 'sharing' a root drive is a very very bad practice.....
     Hi there AncientFrib,,,,

Firstly,, if the users need to write on the C: you have to contact the "Windows Administrator" and check with him if there is a GPO preventing them from doing so and let him change/modify it
Secondly , you can contact the " win admin" and make him modify the permissions for some particular users or if possible let him create some certian folders on the C: drive and make them writable by the users .
Thirdly, if the users need to run some applications on the C: they can run them as Administrators
http://www.sevenforums.com/tutorials/11841-run-administrator.html

Best Wishes  


It's the same question coming up for years. The ACL for c: says admins:full and system:full. This was the same with win xp.
What is different in win7 and vista is that admin = user until elevation takes place. Also, there are integrity levels attached to the root of c: So either
-elevate your application (rightclick and select "run as administrator")
-modify permissions on c: !!!this folder only, don't propagate to folders and files below!! using this command from an elevated command prompt:
icacls c:\ /setintegritylevel M
-turn off UAC
-stop using apps that write to c: as it is not recommended.

By the way: the power users group... open help and enter power users.
Avatar of AncientFrib

ASKER

I have attempted to change permissions, I have disabled UAC, and I have elevated the application to "run as an administrator".  All to no avail.  Will let you know if I come up with something.
All three attempts failed? Literally: this cannot be. What did you do to your system?
Not sure what you mean - I disabled UAC, gave a group (that the users belong to) privileges to write to the root of C (only).  Selected the option to run the program as an administrator but yet the program still fails to write the file to C.  In fact the user is still unable to manually create a file on C.  It only works once I add the users to the local administrators group.
ASKER CERTIFIED SOLUTION
Avatar of McKnife
McKnife
Flag of Germany image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Ok - did all of that previosly, however I neglected the following step:

icacls c:\ /setintegritylevel M

Out of curiosity, what does this do?

I will give option 2 a try again - this time with the command.  Will let you know.
icacls c:\ /setintegritylevel M sets the integrity level of c: to Medium. Integrity levels are a new protection layer additional to NTFS. See http://www.minasi.com/apps/ or wikipedia (mandatory integrity control)
Thanks.