Accessing administrative shares, again


AndreyT

Member
Local time
11:58 AM
Posts
24
Location
Santa Clara, California
OS
Windows 11 Pro
I have two machines in LAN. One is a file server called `FILES`, which runs Windows 10 Pro. Another is a workstation called `MAIN`, which runs Windows 11 Pro.

Both machines have two user accounts registered on them: `Admin` (member of `Administrators`) and `Alice` (member of `Users`). All accounts use identical passwords on both machines. The `FILES` machine exposes a number of regular network shares, which are accessible by members of `Users` group.

Alice is logged into the `MAIN` machine as `Alice`. Alice can immediately see and access all shares of `FILES`. Everything works perfectly. Alice does not have to enter any passwords for accessing these shares, they are just accessible right away (I presume they are accessed using `Alice` credentials).

Now, Alice on `MAIN` would like to occasionally access full drives through administrative shares on `FILES` machine (i.e. \\FILES\`C$`, `\\FILES\D$` and so on). To facilitate that the well-known change was made: a `LocalAccountTokenFilterPolicy = 1` was added to HKLM in `FILES` registry.

However, when Alice tries to access `\\FILES\C$` from `MAIN`, Windows 11 immediately displays an extra dialog asking for access credentials. Since this is about an administrative share, Alice specifies `Admin` as username and the corresponding password. However, such attempts to always fail with an error message

thumbnail.webp

The message kinda makes sense, since Alice is already connected to `FILES` as `Alice`, so a "parallel" attempt to connect as `Admin` goes against the restrictions mentioned in the error message.

So, the question is: can Alice somehow still access the administrative shares on `FILES`? Is there a workaround (besides simply going to `FILES` and creating regular shares for all drives)? Make `Alice` a member of `Administrators` on `FILES`?

P.S. If Alice logs out of `Alice` account on `MAIN` and re-logs in as `Admin` on `MAIN`, then all administrative shares on `FILES` immediately become accessible without any issues or additional dialogs.
 
Last edited:

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    CPU
    Intel(R) Core(TM) i7-5930K CPU @ 3.50GHz
    Motherboard
    EVGA X99 Micro
    Graphics Card(s)
    NVIDIA GeForce GTX 970
Not surprisingly, adding `Alice` to `Administrators` group on `FILES` immediately solves the problem - `Alice` on `MAIN` can now see and access all administrative shares of `FILES`.

This is probably how it is intended to work... However, just a couple of weeks ago `MAIN` was a Windows 10 Pro machine. Everything else was exactly the same. And somehow `Alice` was able to see both the regular shares and administrative shares on `FILES` without being a member of `Administrators` on `FILES`... Somehow it worked (and I don't remember if I took any special steps to make it work).

Now `MAIN` has received a clean install of Windows 11 Pro and things changed.
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    CPU
    Intel(R) Core(TM) i7-5930K CPU @ 3.50GHz
    Motherboard
    EVGA X99 Micro
    Graphics Card(s)
    NVIDIA GeForce GTX 970

Latest Support Threads

Back
Top Bottom