File Transfer Fails With Access Denied for a Local Administrator Account

When a PRA session to a Windows target uses a local Windows account that is a member of the local Administrators group, SMB file transfers from the Transfer Files menu fail with an access denied error. The same transfer succeeds when the session uses the built-in Administrator account, and the local account can otherwise log in to the target without problems.

Cause

This is a Windows limitation. With User Account Control (UAC) remote restrictions enabled, Windows issues a filtered token to any local administrator account that connects over the network, which removes its administrative privileges for the remote connection. The built-in Administrator account is exempt from this filtering, which is why file transfers work with that account but not with other local administrators.

PRA file transfers to Windows targets use SMB, which is a network connection and is therefore subject to this restriction. Domain accounts are not affected.

Resolution

To allow local administrator accounts to receive a full administrative token over the network, set the LocalAccountTokenFilterPolicy registry value to 1 on the target machine. Run the following command in an elevated command prompt on the target:

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

The change takes effect immediately. Launch a new PRA session and retry the file transfer.

Setting LocalAccountTokenFilterPolicy to 1 disables a UAC remote restriction for all local administrator accounts on that machine. If an attacker obtains the credentials of any local administrator account, those credentials can then be used for full remote administrative access to the machine, including administrative shares such as C$, the remote registry, and service management. Review your security requirements before making this change, and consider using a domain account or the built-in Administrator account for file transfers instead.

Before changing this value, confirm that the access denied error is not caused by something else. SMB authentication settings, NTLM restrictions, firewall rules, share and NTFS permissions, and account restrictions on the target can produce the same error, and changing this registry value does not fix those cases.

See Transferring Files With PRA for file transfer prerequisites.