Open Software Solutions

This article describes the behavior that occurs in Windows Vista when you are prompted to enter administrative credentials for a directory to which you do not have permissions.

Back to the top

On a computer that is running Windows Vista, assume that you try to browse to a directory that you do not have permissions to view. Windows Explorer prompts you to enter administrative credentials. When you enter administrative credentials, your ID is permanently added to the discretionary access control list (DACL) for the directory.

This behavior is by design. However, the dialog box that prompts you to enter administrative credentials does not correctly explain the consequences of entering these credentials. Therefore, you may believe that you are only temporarily elevating your permissions to view the directory contents and that no permanent change to the directory’s DACL is occurring.

By prompting you for credentials, Windows Vista prevents the following scenario. When you try to view a directory to which you do not have permissions, you receive an access denied error message, and you cannot view the contents of the directory. Assume that you then try to use elevated permissions to open an instance of Windows Explorer. However, Windows Explorer is a single-instance application, and it is already running under User Access Control (UAC). Therefore, you cannot use elevated permissions to open Windows Explorer. To view the directory, you would have to right-click the directory in Windows Explorer, you would have to use elevated permissions to open the DACL editor, and then you would have to add your user ID to the directory.

Note If you were not logged on as an administrator, you would have to follow these steps on an earlier version of the Windows operating system, such as Windows XP.

This feature of Windows Vista simplifies the only real solution for gaining access to the directory.

Back to the top

Known issues

This feature could lead to unwanted and unexpected behavior. For example, assume that you belong to the Administrator group and that you receive elevated permissions to view a directory. Your ID is added to the DACL for that directory. However, if you are then removed from the Administrator group, your ID remains in the DACL for the directory. Therefore, you still have view permissions for that directory.

Back to the top