{"id":3301,"date":"2017-07-07T13:55:58","date_gmt":"2017-07-07T20:55:58","guid":{"rendered":"https:\/\/www.coretechnologies.com\/blog\/?p=3301"},"modified":"2023-02-04T06:32:51","modified_gmt":"2023-02-04T14:32:51","slug":"onedrive-hates-admin-rights","status":"publish","type":"post","link":"https:\/\/www.coretechnologies.com\/blog\/alwaysup\/onedrive-hates-admin-rights\/","title":{"rendered":"OneDrive Can’t Be Run Using Full Administrator Rights"},"content":{"rendered":"
\"Administrator<\/div>\n

OneDrive hates admin rights<\/b><\/h2>\n

A customer looking to run OneDrive as a Windows Service with AlwaysUp recently contacted our support team for help. Even though he had diligently followed our step-by-step tutorial<\/a>, his files were not being synchronized as intended. OneDrive refused to refused to work as a service!<\/p>\n

After confirming that his files were not being copied<\/a>, our support team launched OneDrive “in this session” — to see the normal tray icon and check if an error was being reported. We were greeted by this puzzling error message:<\/p>\n

\"OneDrive<\/a><\/div>\n<\/p>\n

So it seems that OneDrive doesn’t like to be run with admin rights. And the customer’s account was a member of the Administrators group — which is recommended for smooth operation as a Windows Service with AlwaysUp.<\/p>\n

UAC enables an administrator to run OneDrive normally<\/b><\/h2>\n

But why does OneDrive work at all in the customer’s admin account? Why doesn’t the software complain when he starts OneDrive normally on his desktop?<\/p>\n

The answer lies with Microsoft’s User Account Control (UAC)<\/a> security feature. By default, applications started interactively are run with lower, non-admin privileges. This happens for all accounts — even for administrators. OneDrive seems to require that lower privilege context to do its work. Indeed, in this OneDrive desktop FAQ<\/a>, Microsoft confirms that UAC is what enables OneDrive to be started by an administrator. If we removed UAC from the equation (by by right-clicking on OneDrive.exe and selecting “Run as administrator”) we were able to reproduce the error straightaway.<\/p>\n

But while UAC restricts rights for the desktop user, UAC is not in play when running in the context of a windows service<\/b>. Services are always run with the highest privileges. We must find a way for our customer to start OneDrive with reduced rights to avoid the error.<\/p>\n

How to launch OneDrive with reduced rights from AlwaysUp<\/b><\/h2>\n

Our new Run with Restricted Rights<\/a> command-line utility comes to the rescue. Here are the steps we performed to get the customer up and running:<\/p>\n

    \n
  1. \n

    Download RunWithRestrictedRights.exe<\/a> (it’s free).<\/p>\n

  2. \n

    Start AlwaysUp.<\/p>\n

    Double-click your OneDrive service to edit it.<\/p>\n<\/li>\n

  3. \n

    In the Application<\/b> field, enter the full path to RunWithRestrictedRights.exe.<\/p>\n

    In the Arguments<\/b> field, enter the full path to your OneDrive executable, enclosed in quotes. It should look something like this:<\/p>\n

    “C:\\Users\\[USER-NAME]\\AppData\\Local\\Microsoft\\
    OneDrive\\OneDrive.exe”<\/p><\/blockquote>\n

    where [USER-NAME] is the name of your Windows account.<\/p>\n


    \n\"OneDrive<\/a><\/div>\n<\/p>\n<\/li>\n
  4. \n

    Save your settings.<\/p>\n<\/li>\n<\/ol>\n

    With this new setup, AlwaysUp will start RunWithRestrictedRights.exe, which will launch OneDrive with diminished permissions. You should not see the “full administrator rights” error anymore.<\/p>\n

    Note that we plan to add the capability to run an application with diminished rights directly from AlwaysUp. That feature will probably included in AlwaysUp version 10.3, which should released to all customers in September\/October.<\/p>\n

    \n
    \n\n\n\n
    Read more articles about OneDrive…<\/nobr><\/span><\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n