Windows 10 UAC elevation prompts moving folders TO network shares

Googling has found some answers on this forum but none seem to be able to solve my issue.

Situation:
[ul]

  • I'm running as a Standard User in Windows 10.
  • Moving a folder from local machine to a network share triggers UAC prompt (multiple times if I say no to the prompt). Eventually the folder successfully moves. I've tried using the "Move" button on top bar, shift-left-click drag, and right-click drag->choose Move. All three trigger UAC prompt.
  • Copying same folder does not trigger UAC.
  • Moving same folder from network share to local machine does not trigger UAC.
  • Moving same folder from local machine to another drive on local machine does not trigger UAC.
    [/ul]

Notes:
[ul]

  • This is a long-running setup that I've exported and imported to many machines. I have no desire to lose it.
  • Moving same folder with Windows Explorer does not trigger UAC
  • Moving same folder with TeraMove does not trigger UAC.
  • "Copy metadata" option is OFF, as is "Update permissions/encryption"; And were off before I started experiencing this issue. See screenshot of my Copy Attributes preferences.
  • I've verified my effective permissions for parent folder and folder in question are "full". This is confirmed by the move between local drives with DOpus, using File Explorer with network, or using TeraMove with network do not trigger UAC prompts.
    [/ul]

Any thoughts on other changes I should try with DOpus?


If copy works OK but move triggers unexpected UAC prompts, it sounds like something is causing temporary access-denied errors when deleting the source files/folders.

Does it happen if you do a copy and then do a delete? (Do the delete without using the recycle bin to make it most like a move operation.)

Does disabling your antivirus scanner stop the UAC prompts? If not, is Opus or anything else doing anything to the source files/folders other than copying them? (e.g. Moving around the folders in Opus, or thumbnails/metadata being extracted in the background?)

Process Monitor could be used to find the operation(s) resulting in access-denied errors, which could shine a light on where they are coming from. We can look at .PML format log files for you, if you link your account.

I've linked my account.

Now, I'm not sure what changed. Copy is now triggering UAC prompts.
Delete does not trigger UAC prompts.

I've switched to Copy as my test case since that is less API calls.

I'm copying from lib://Downloads/Downloads to \tasha\Software\Internet

(excuse the typo in the filenames, hehe)
ProcMonLogFiles.zip/DOpuse Logfile1.PML
[ul]

  • I chose "NO" to every UAC prompt
  • Filtered to "entries containing Downloads"
  • Appeared to me that Windows Defender might be the problem
    [/ul]

I then learned that Microsoft, as usual, is worse than a virus. I could not disable Windows Defender because I was not an Admin and they don't provide any way to elevate. So I installed Norton 360, rebooted, disabled realtime protection.

ProcMonLogFiles.zip/DOpuse Logfile2.PML
[ul]

  • I chose "NO" to every UAC prompt
  • Filtered to "entries containing Downloads"
  • Nothing obvious
  • Windows Defender disabled
  • Norton real-time protection disabled
  • CrashPlan service shut down
    [/ul]

DOpuse Logfile-all.zip/DOpuse Logfile-all.PML
[ul]

  • That is no filtering and tried to be quick about getting the copies done to limit the log size
  • I chose "NO" to every UAC prompt
  • Windows Defender disabled
  • Norton real-time protection disabled
  • CrashPlan service shut down
    [/ul]

Here are my permissions seen in the Downloads\Fonts folder:

[code]
[C:\Programs\SysinternalsSuite]accesschk -v C:\Users\mzaleski\Downloads\Fonts

Accesschk v6.01 - Reports effective permissions for securable objects
Copyright (C) 2006-2016 Mark Russinovich
Sysinternals - www.sysinternals.com

C:\Users\mzaleski\Downloads\Fonts\andale32.exe
Medium Mandatory Level (Default) [No-Write-Up]
RW NT AUTHORITY\SYSTEM
FILE_ALL_ACCESS
RW BUILTIN\Administrators
FILE_ALL_ACCESS
RW KIRA\mzaleski
FILE_ALL_ACCESS
C:\Users\mzaleski\Downloads\Fonts\consolefonts
Medium Mandatory Level (Default) [No-Write-Up]
RW NT AUTHORITY\SYSTEM
FILE_ALL_ACCESS
RW BUILTIN\Administrators
FILE_ALL_ACCESS
RW KIRA\mzaleski
FILE_ALL_ACCESS
C:\Users\mzaleski\Downloads\Fonts\georgi32.exe
Medium Mandatory Level (Default) [No-Write-Up]
RW NT AUTHORITY\SYSTEM
FILE_ALL_ACCESS
RW BUILTIN\Administrators
FILE_ALL_ACCESS
RW KIRA\mzaleski
FILE_ALL_ACCESS
C:\Users\mzaleski\Downloads\Fonts\SourceCodePro_FontsOnly-1.010
Medium Mandatory Level (Default) [No-Write-Up]
RW NT AUTHORITY\SYSTEM
FILE_ALL_ACCESS
RW BUILTIN\Administrators
FILE_ALL_ACCESS
RW KIRA\mzaleski
FILE_ALL_ACCESS
C:\Users\mzaleski\Downloads\Fonts\ttf-bitstream-vera-1.10
Medium Mandatory Level (Default) [No-Write-Up]
RW NT AUTHORITY\SYSTEM
FILE_ALL_ACCESS
RW BUILTIN\Administrators
FILE_ALL_ACCESS
RW KIRA\mzaleski
FILE_ALL_ACCESS
C:\Users\mzaleski\Downloads\Fonts\verdan32.exe
Medium Mandatory Level (Default) [No-Write-Up]
RW NT AUTHORITY\SYSTEM
FILE_ALL_ACCESS
RW BUILTIN\Administrators
FILE_ALL_ACCESS
RW KIRA\mzaleski
FILE_ALL_ACCESS
[/code]
DOpuse Logfile-all.zip (12.5 MB)
ProcMonLogFiles.zip (949 KB)

Thanks for the procmon logs.

They show that trying to set the attributes on some of the folders results in an access denied error, which is triggering the elevation prompts.

If you turn off the option to preserve attributes, I expect you'll stop seeing the UAC prompts.

It's possible the folder permissions on the remote server do not allow the attributes to be changed on those folders. If it's a non-Windows server, it's also possible that the filesystem or SMB implementation do not support setting attributes on folders, or that they have some kind of bug where they support it but will fail under certain situations (e.g. something reading from the folder at the same time the attributes are set).


Thanks Leo. That fixed it. I apologize for not saying Samba share in my OP. I thought I did.

Apparently according to some web searching, if I'm willing to muck around with trying to set up ACLs on my Samba server (enable in ext4 filesystem, then enable in smb.conf), I could fix this. But I really don't think I'm losing much even on local copies if no attributes get set.

Bah, forgot to add the link to configuring ACLs on Samba for the next guy or gal with this problem.

aisalen.wordpress.com/2007/08/10/acls-on-samba/

Glad that's fixed it! Thanks for confirming the theory; it's good to know there isn't a deeper problem there.