[OpenAFS] OpenAFS installation messes up Windows 8 file access control

[Tim Adye]

Hi Jeffrey,

Thanks for the information.

> The only interaction between OpenAFS and the Explorer Shell is the =
"AFS
> Shell Extension" which provides the "AFS Context Menu", the "AFS
> Property Sheets", and "Mount Point and Symlink Overlay Icons".  This =
is
> the functionality you would have disabled using "autoruns".

Yes, I tried disabling all of those, but that didn't help.

If, as you suggest, it isn't OpenAFS running, then there must be =
something that the OpenAFS installer and uninstaller do to affect =
Windows Explorer. I installed and uninstalled OpenAFS many times (often =
with no other action except for the reboot) and the problematic =
behaviour I described appeared if, and only if, OpenAFS was installed =
(whether running or not).

Could there be some local policy or groups that are changed by the =
installer? I know that it adds the "AFS Client Admins" group, though =
that can't be it as the uninstaller doesn't remove the group.

Thanks,
Tim.

-----Original Message-----
From: Jeffrey Altman [mailto:jaltman@secure-endpoints.com]=20
Sent: 15 September 2013 23:35
To: Adye, Tim (STFC,RAL,PPD)
Cc: openafs-info@openafs.org
Subject: Re: [OpenAFS] OpenAFS installation messes up Windows 8 file =
access control

Tim,

I'm sorry you are experiencing a problem but the reason you didn't find
any changes that were made by OpenAFS is because OpenAFS doesn't make
any changes.

The only interaction between OpenAFS and the Explorer Shell is the "AFS
Shell Extension" which provides the "AFS Context Menu", the "AFS
Property Sheets", and "Mount Point and Symlink Overlay Icons".  This is
the functionality you would have disabled using "autoruns".

Jeffrey Altman

On 9/15/2013 4:08 PM, Tim Adye wrote:
> Hi,
>=20
> The OpenAFS client installation is doing something nasty to the file =
access
> control on my Windows 8 system. After installing OpenAFS, I can no =
longer
> move, copy, or delete files with the File Explorer in local Windows =
folders
> that require administrator privileges.=20
>=20
> What should happen, and happens again if I uninstall OpenAFS, is that =
I get
> a pop-up message such as "File Access Denied: You'll need to provide
> administrator permission to copy to this folder". I can then then =
select
> "Continue" (perhaps needing an admin password) to copy the file.
>=20
> When OpenAFS is installed, there is no pop-up message and the copy =
silently
> fails. This occurs with drag-and-drop and Ctrl/C+X+V copy and move, =
and
> deleting with the "Delete" key or button. Oddly, the pop-up message =
does
> appear when creating or renaming a file or folder, so those operations =
still
> work. It is also possible to delete files from the context menu (which =
show
> the admin icon and don't normally require confirmation).
>=20
> This is a problem with Windows Explorer (now called File Explorer in =
Windows
> 8) and seemingly nothing to do with OpenAFS, except that it occurs =
whenever
> OpenAFS is installed. I can fix the problem by uninstalling OpenAFS, =
and the
> problem comes back when I reinstall OpenAFS. I tried disabling all the
> OpenAFS components with "autoruns" (and restarting), but the problem
> remained. So I guess it is some change made by the OpenAFS =
installation
> program. What changes does it make to the Windows Account Control and
> authorisation systems that might cause such an issue? I tried =
comparing
> registry dumps before and after uninstalling OpenAFS, but didn't see
> anything obvious.
>=20
> I used the standard OpenAFS IFS install and all the default options =
(all
> enabled, except integrated login), but it didn't help to disable the =
rest.
>=20
> I am using 64-bit Windows 8 Standard Edition (so I can't check for =
user or
> group policy changes, since that control panel requires Windows 8 =
Pro). I
> installed 64-bit OpenAFS 1.7.2600, but had the same problem with an =
older
> version, 1.7.0800, that does not give me this problem on a Windows 7 =
Pro
> system. So, it could be Windows 8 (vs 7) or Standard Edition (vs Pro).
>=20
> Does anyone have any ideas? I would be very grateful for any fix or
> work-around. With OpenAFS installed, it is extremely cumbersome to =
make any
> program file changes on my system. The only way I have to copy or move
> program files in Windows Explorer is by taking ownership and changing =
the
> permissions on all directories and files involved, making the move, =
and
> restoring the original permissions - a cumbersome and risky operation. =
Or
> else to do everything from the command-line from an Admin account.
>=20
> Thanks,
> Tim.
>=20
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D  cut here  =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D
>  Tim Adye      T.J.Adye@rl.ac.uk       http://hepunx.rl.ac.uk/~adye
>  ATLAS Group,  Particle Physics Dept,  Rutherford Appleton Lab
>=20
>=20


-- 
Scanned by iCritical.