The security Permissions aren’t the same when I use Robocopy /copyall or robocopy /Sec.

BenParker — Wed, 01 Jul 2009 23:43:00 GMT

I see this when using Robocopy.exe version XP027 and trying to copy inherited permissions. In the XP026 and earlier versions inherited permissions from the source would be copied to the destination. This is no longer the case in XP027.

Why Does this Happen?

This is the result of a design change to prevent another bug. It looks like there are no plans to change this at this time.

How to Workaround:

You can use the /MIR switch to get a similar behavior and in my tests it did work with the inherited permissions but realize that this will delete anything on the destination that isn’t on the source. There is also some odd behavior with this switch. I’ve seen a few references to this blog here that spells it out

How to Repro:

Make 2 directories

Md a

Md b

On c:\a add a textfile

On c:\b uncheck “Include inheritance permissions from this object’s parent” and remove the inherited permissions and grant yourself full control

Use robocopy.exe XP027

Robocopy.exe c:\a c:\b /copyall

View the permissions on c:\b they will remain unchanged

Delete the textfile from c:\b

Use robocopy.exe XP026

View the security settings on c:\a and c:\b and they will match

Vista or Server2008 stuck at a black screen and the desktop never renders.

BenParker — Thu, 03 Jul 2008 20:49:00 GMT

I’ve seen this a few times now and there isn’t any good documentation that I’ve found that helps resolve or explain this. This occurs when the Administrator doesn’t have user privileges so it is being denied access when it tries to launch explorer.exe

Symptoms;

UAC in enabled on the target machine and it is configured to allow remote desktops. When you TS or logon to the machine with an administrator account, the logon process seems normal and when the desktop should render all you see is a blank screen. You are able to bring up the menu to launch Task Manager with Ctrl + alt + Del or Ctrl + Alt +End but Task manager never launches. The target computer will have a 4006 event logged and the security log will show a successful login.

Log Name: Application

Source: Microsoft-Windows-Winlogon

Date: 6/13/2008 10:30:26 AM

Event ID: 4006

Task Category: None

Level: Warning

Keywords: Classic

User: N/A

Computer:

Description:

The Windows logon process has failed to spawn a user application. Application name: . Command line parameters: C:\Windows\system32\userinit.exe.

If you logon using THE Local administrator account or disable UAC the logon session works as expected.

Why does this happen?

This happens when the account that is a member of the local administrator group but doesn’t have the proper user privileges on the target machine. Vista and 2008 will now create two tokens for an administrator when they logon, one standard user and one full administrator and the standard user token is used to launch the desktop. When the account doesn’t have the proper user privileges it fails to launch the desktop with access denied.

Here is a doc

How to fix:

By default Windows Vista and Server2008 have NT Authority\Interactive in the local users group which account for this. If this is missing re-add it or add another account or group to the local users group that contains the account you are using to login.

How to recreate this: (Don’t try this at home, go to a friends house)

You will need two machines a target and a host.

On the target:

The target must be running vista with UAC and remote desktops enabled. Make sure you know THE local administrator account, password and that it is enabled (This will be the easiest way to get back into your computer). Remove all accounts from the local users group and create a new account in the Administrators group or add a domain account there.

On the Host:

Remote Desktop into the target machine and provide the credentials of the account you added to the local admin account. You should see the logon process function normally and when you would expect the desktop never loads and you are stuck waiting.

Ben Parker's Blog : 2008

The security Permissions aren’t the same when I use Robocopy /copyall or robocopy /Sec.

Vista or Server2008 stuck at a black screen and the desktop never renders.