Thank you for the explanation. However, I don't see why if access is
allowed to the target of a junction, access isn't allowed to the junction (I
can traverse "c:\users," so why can't I traverse "c:\documents and
settings," which is a junction to c:\users?).

On a related point, in trying to move the Documents folder ("Personal" in
regedit) using the properties option to move it, I noticed that Vista failed
to update the junction to point to the new location. In correcting that, I
ended up creating a link rather than a junction, but then corrected it back
to a junction. However, I don't have the attributes right, I added H and
S, but Vista seems to use "N" on the junctions under the user's folder--what
is the "N" attribute and how do I add it to the junction's attributes?


"Jimmy Brush" wrote in message
...
Hello,

As Jeff pointed out, the reason access is denied to Documents and Settings
is because it is a junction - basically a pointer to the Users folder,
which replaces Documents and Settings in Vista. There are very good
reasons why this security restriction was put in place, and unfortunately
Explorer doesn't help you out very much in this regard.

You should not change the security on these junctions. You will need to
learn and use the new Windows Vista locations instead.

As Kurt pointed out, admin accounts are basically split right down the
middle. All applications run as if they were a standard user - they can
only use admin powers when they request the power from you via a UAC
prompt.

Here's how file operations work in Explorer using this "admin-lite" mode.

You can do anything that your username explicitly has permission to do. If
you try to do something that you cannot explicitly do, there are a few
things that may happen:

1) You are browsing into a folder that you don't have access to

Windows will ask you if you want to "elevate" to full admin power and then
give yourself explicit permission to access the folder. This changes
security on the folder/files within that folder to allow you read access.
If not even the "full admin" power is enough to change the security on the
folder, you will not be able to access it. This could be the case if the
administrators group does not have permission to change the folder. In
this case, you would have to take ownership of the folder and possibly
child folders/files first and then try to access the folder.

2) You are doing a folder/file operation that the administrators group has
permission to do, but you do not

Windows Explorer will tell you that the operation is restricted and that
you need admin privileges to complete the operation. You will then go thru
a UAC dialog and use your "full admin" power to complete the operation.
The "full admin" power is only good on that one specific operation, and
does not apply to any further operations.

3) You are doing a folder/file operation that the administrators group
DOES NOT have permission to do

You will receive an access denied error - neither you explicitly nor the
administrators group have permission. You will need to change the
permissions on the file/folder manually to give either yourself or the
administrators group permission. You may need to take ownership of the
file/folder in order to do this.


--
- JB

Windows Vista Support Faq
http://www.jimmah.com/vista/

ok, I realized that Vista probably has "documents and settings" junction for
backward compatibility for programs hard-coded to look there, and the
security restriction isn't for security purposes, but to prevent users from
deleting or renaming it.

You're right, the security isn't in place for security purposes ... it's
actually put in place for application compatability purposes.

That's right ... an app compat hack has an app compat hack .

It's fine for programs to traverse OVER an app compat junction - for
example, accessing c:\documents and settings\username\ works fine. However,
attempting to do a directory listing on an appcompat junction returns access
denied.

This is to prevent programs that do not understand junctions from getting
confused. Imagine the case where a backup program backs up your hard drive
and runs over both Documents and Settings and Users - it thinks it is
accessing 2 different folders, when in fact they are the same.

Also, some app compat junctions point back into themselves creating a
recursive situation - some programs probably wouldn't like this very much
.


--
- JB

Windows Vista Support Faq
http://www.jimmah.com/vista/

Vista seems to use "N" on the junctions under the user's folder--what is
the "N" attribute and how do I add it to the junction's attributes?

N is the "do not index contents" attribute, it shows up as I using the
attrib command-line tool.

This attribute is accessed from Advanced button in the properties screen in
the attributes section ... clearing the "Index this folder/file for faster
searching" checkbox sets this attribute.


--
- JB

Windows Vista Support Faq
http://www.jimmah.com/vista/

You can, if you so wish, take ownership of C:\documents and settings, but,
AFAICS nothing is gained by so doing.

--
Leo
If at first you do succeed, try not to look astonished.






"Manuel Lopez" wrote in message
...

Thank you for the explanation. However, I don't see why if access is
allowed to the target of a junction, access isn't allowed to the junction
(I can traverse "c:\users," so why can't I traverse "c:\documents and
settings," which is a junction to c:\users?).

On a related point, in trying to move the Documents folder ("Personal" in
regedit) using the properties option to move it, I noticed that Vista
failed to update the junction to point to the new location. In
correcting that, I ended up creating a link rather than a junction, but
then corrected it back to a junction. However, I don't have the
attributes right, I added H and S, but Vista seems to use "N" on the
junctions under the user's folder--what is the "N" attribute and how do I
add it to the junction's attributes?


"Jimmy Brush" wrote in message
...
Hello,

As Jeff pointed out, the reason access is denied to Documents and
Settings is because it is a junction - basically a pointer to the Users
folder, which replaces Documents and Settings in Vista. There are very
good reasons why this security restriction was put in place, and
unfortunately Explorer doesn't help you out very much in this regard.

You should not change the security on these junctions. You will need to
learn and use the new Windows Vista locations instead.

As Kurt pointed out, admin accounts are basically split right down the
middle. All applications run as if they were a standard user - they can
only use admin powers when they request the power from you via a UAC
prompt.

Here's how file operations work in Explorer using this "admin-lite" mode.

You can do anything that your username explicitly has permission to do.
If you try to do something that you cannot explicitly do, there are a few
things that may happen:

1) You are browsing into a folder that you don't have access to

Windows will ask you if you want to "elevate" to full admin power and
then give yourself explicit permission to access the folder. This changes
security on the folder/files within that folder to allow you read access.
If not even the "full admin" power is enough to change the security on
the folder, you will not be able to access it. This could be the case if
the administrators group does not have permission to change the folder.
In this case, you would have to take ownership of the folder and possibly
child folders/files first and then try to access the folder.

2) You are doing a folder/file operation that the administrators group
has permission to do, but you do not

Windows Explorer will tell you that the operation is restricted and that
you need admin privileges to complete the operation. You will then go
thru a UAC dialog and use your "full admin" power to complete the
operation. The "full admin" power is only good on that one specific
operation, and does not apply to any further operations.

3) You are doing a folder/file operation that the administrators group
DOES NOT have permission to do

You will receive an access denied error - neither you explicitly nor the
administrators group have permission. You will need to change the
permissions on the file/folder manually to give either yourself or the
administrators group permission. You may need to take ownership of the
file/folder in order to do this.


--
- JB

Windows Vista Support Faq
http://www.jimmah.com/vista/

Thanks. (In my simplicity, I would have used the same letter for the same
attribute, but there was probably a reason for not doing that.)

p.s. actually, for junctions, you cannot use the property sheet to make an
attribute change, only the command line attrib works.

"Jimmy Brush" wrote in message
news
Vista seems to use "N" on the junctions under the user's folder--what is
the "N" attribute and how do I add it to the junction's attributes?

N is the "do not index contents" attribute, it shows up as I using the
attrib command-line tool.

This attribute is accessed from Advanced button in the properties screen
in the attributes section ... clearing the "Index this folder/file for
faster searching" checkbox sets this attribute.


--
- JB

Windows Vista Support Faq
http://www.jimmah.com/vista/

"N" in explorer seems to be a mistake by Microsoft, that wasn't caught by
the beta testers. Both the SDK and Microsoft's own attrib.exe command use
"I" for "not indexed."
It should be corrected, since "N" was used for normal (meaning no file
attributes).

"Jimmy Brush" wrote in message
news
Vista seems to use "N" on the junctions under the user's folder--what is
the "N" attribute and how do I add it to the junction's attributes?

N is the "do not index contents" attribute, it shows up as I using the
attrib command-line tool.

This attribute is accessed from Advanced button in the properties screen
in the attributes section ... clearing the "Index this folder/file for
faster searching" checkbox sets this attribute.


--
- JB

Windows Vista Support Faq
http://www.jimmah.com/vista/

"Manuel Lopez" wrote in message
...

"N" in explorer seems to be a mistake by Microsoft, that wasn't caught by
the beta testers.

Not necessarily an accurate assumption. There were many, many things that
were caught, and bugged, and discussed extensively, by the Vista Beta
testers, however, it is, after all, MS's program, and the MS development
and/or prgramming folks decided not to correct or change a lot the bugs,
many were closed as "Won't fix" So bugs that still exist in Vista are not
totally the fault of the beta testers, who can only find and report the
bugs, they can't force MS to do anything about them, or to what extent. :-)

Jan
MS MVP - Windows IE

good point. at first glance, this doesn't appear to be in one of the
classes of things that they can't quickly fix (it's not complicated, not an
old-standing bug, and has no dependencies that fixing would break)


"Jan Ilacqua [MVP]" wrote in message
...
"Manuel Lopez" wrote in message
...

"N" in explorer seems to be a mistake by Microsoft, that wasn't caught by
the beta testers.

Not necessarily an accurate assumption. There were many, many things
that were caught, and bugged, and discussed extensively, by the Vista Beta
testers, however, it is, after all, MS's program, and the MS development
and/or prgramming folks decided not to correct or change a lot the bugs,
many were closed as "Won't fix" So bugs that still exist in Vista are
not totally the fault of the beta testers, who can only find and report
the bugs, they can't force MS to do anything about them, or to what
extent. :-)

Jan
MS MVP - Windows IE

In fairness to the MS folks who were also in the Beta trenches, there were a
lot of things that the teams were hoping to fix, but, they just ran out of
time. There came a point where they had to lock the code to prepare for
RTM. Many fought just as hard as the BT's on some issues, however, they
were also answering to higher ups. I think we will see some of these things
corrected in the SP1, as you say, they are the type of things that can be
corrected without a lot of in-depth code changes. Until then, we will
either have to work with it, around it, or find some way to get by until the
SP1. Not exactly the most favorable choice, but, for now, the only ones we
may have.

Jan
MS MVP - Windows IE


"Tech_vs_Life" wrote in message
...
good point. at first glance, this doesn't appear to be in one of the
classes of things that they can't quickly fix (it's not complicated, not
an old-standing bug, and has no dependencies that fixing would break)


"Jan Ilacqua [MVP]" wrote in message
...
"Manuel Lopez" wrote in message
...

"N" in explorer seems to be a mistake by Microsoft, that wasn't caught
by the beta testers.

Not necessarily an accurate assumption. There were many, many things
that were caught, and bugged, and discussed extensively, by the Vista
Beta testers, however, it is, after all, MS's program, and the MS
development and/or prgramming folks decided not to correct or change a
lot the bugs, many were closed as "Won't fix" So bugs that still exist
in Vista are not totally the fault of the beta testers, who can only find
and report the bugs, they can't force MS to do anything about them, or to
what extent. :-)

Jan
MS MVP - Windows IE