{"id":1367,"date":"2026-04-01T11:24:07","date_gmt":"2026-04-01T09:24:07","guid":{"rendered":"https:\/\/ndk.sytes.net\/wordpress\/?p=1367"},"modified":"2026-04-01T11:24:27","modified_gmt":"2026-04-01T09:24:27","slug":"access-denied-to-administrative-shares","status":"publish","type":"post","link":"https:\/\/ndk.sytes.net\/wordpress\/?p=1367","title":{"rendered":"Access Denied to Administrative Shares"},"content":{"rendered":"\n<p>As described in\u00a0<a href=\"http:\/\/support.microsoft.com\/kb\/951016\" target=\"_blank\" rel=\"noreferrer noopener\">MS KB article 951916<\/a>, Microsoft introduced as part of UAC a little known feature called \u201cUAC remote restrictions\u201d. It filters the access token for connections made with local user accounts or Microsoft accounts (the latter typically have the format\u00a0<em>MicrosoftAccount\\EMailAddress<\/em>). In other words, it removes the SID for \u201cAdministrators\u201d. Connections made with domain accounts remain unchanged.<\/p>\n\n\n\n<p>From KB951016:<\/p>\n\n\n\n<p><em>If the user wants to administer the workstation with a Security Account Manager (SAM) account, the user must interactively log on to the computer that is to be administered with Remote Assistance or Remote Desktop, if these services are available.<\/em><\/p>\n\n\n\n<p>One may like this or not, the solution is luckily pretty simple. UAC remote restrictions can be disabled by setting the registry value\u00a0<code>LocalAccountTokenFilterPolicy<\/code>\u00a0to\u00a0<code>1<\/code>. Open Powershell as Administrator and run:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System \/v LocalAccountTokenFilterPolicy \/t REG_DWORD \/d 1 \/f<\/pre>\n\n\n\n<p>Now the connection for local computer account should work.<\/p>\n\n\n\n<p>Source: <a href=\"https:\/\/helgeklein.com\/blog\/access-denied-trying-to-connect-to-administrative-shares-on-windows-7\/\">https:\/\/helgeklein.com\/blog\/access-denied-trying-to-connect-to-administrative-shares-on-windows-7\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>As described in\u00a0MS KB article 951916, Microsoft introduced as part of UAC a little known feature called \u201cUAC remote restrictions\u201d. It filters the access token for connections made with local user accounts or Microsoft accounts (the latter typically have the format\u00a0MicrosoftAccount\\EMailAddress). In other words, it removes the SID for \u201cAdministrators\u201d. Connections made with domain accounts [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-1367","post","type-post","status-publish","format-standard","hentry","category-windows"],"_links":{"self":[{"href":"https:\/\/ndk.sytes.net\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/1367","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ndk.sytes.net\/wordpress\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ndk.sytes.net\/wordpress\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ndk.sytes.net\/wordpress\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ndk.sytes.net\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1367"}],"version-history":[{"count":2,"href":"https:\/\/ndk.sytes.net\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/1367\/revisions"}],"predecessor-version":[{"id":1369,"href":"https:\/\/ndk.sytes.net\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/1367\/revisions\/1369"}],"wp:attachment":[{"href":"https:\/\/ndk.sytes.net\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1367"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ndk.sytes.net\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1367"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ndk.sytes.net\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1367"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}