Windows 7 Security – Access Denied Even as Administrator

The Answer

The final answer it is control by UAC. If you don't want to be prompted then turn off UAC. Which is basically the 'toggle' that was asked about. This has been confirm though testing. Not to mention the UAC Shield Icon, that is on the Continue button when trying to access the folder, should have given it away from the beginning.

When clicking on a install/setup application or opening an application that requires admin access, the UAC prompt opens and ask for permission. Access a user folder isn't different. You need admin permissions just like installing an application. The only difference is, with UAC on, the accessing user will be added to the ACL of the user's profile folder. Which isn't the case when UAC is toggled off.

The reason for Microsoft change towards UAC is found with in this document: Understanding and Configuring User Account Control in Windows Vista. I know it says Vista, but they're one in the same when it comes to UAC. It seems it all comes down to the way UAC works.

The Fix...

I believe this will fix the issue. I can not be sure since I don't have the ability to test it out at this time. Please be careful and remember revert it back. You can open Command Prompt in Admin Mode, then type in the following :net user administrator /active:yes. Please reverse this action by changing yes to no when finish doing what you need to do. This will help with security.

The only fix is to turn off UAC.

Administrator does not mean "you get all rights to do anything." Administrator happens to be an account (or in your case, most likely the Local Administrators group) which by default is given some sensitive privileges like SeDebugPrivilege and similar. However, as far as the security subsystem is concerned, it is just an account. (Very much unlike root in Unix-like operating systems) If you aren't the owner of the key in question, and your account does not have WRITE_DAC access to the registry key in question, then you won't be able to change the access control list on the key in question.

Try taking ownership first. By default, the local administrators group has SeTakeOwnershipPrivilege, which allows taking ownership of any object even without the WRITE_OWNER permission being granted by the object's discretionary access control list. Once you are the owner, you should be implicitly granted READ_CONTROL (which allows you to read the security descriptor on the object in question), and WRITE_DAC (which allows you to write to the DACL on the key in question). (Assuming the OWNER_RIGHTS SID isn't in use; that's extremely unlikely)