Purpose:
When supplying the appropriate user credentials that have local administrator access, you attempt to access a Windows 7, Windows 8x, Windows 10, Server 2008/2008 R2, Server 2012/2012 R2, or Server 2016 computer and receive either the error, “Access Denied – Failed to connect to ADMIN$ share” or, “Access to the path ‘\\TARGET\\ADMIN$’ is denied.“
Resolution:
The resolution section assumes the following:
- Firewall Exceptions are set up correctly: Windows Firewall Ports and Exceptions.
- File and Printer Sharing is enabled.
- GPO/SRP or Antivirus is not blocking access to the ADMIN$.
- Using \\X.X.X.X\ADMIN$, where X.X.X.X is the IP address of the target machine throwing the error, does not work.
- Appropriate credentials of local administrative user have been set (and tested).
If the target computer is not a member of a Windows 2003 or later Active Directory domain, the most likely cause is that the target computer has Remote UAC enabled. Remote UAC prevents local administrative accounts from accessing ADMIN$ by preventing local admin accounts from running in an elevated mode from a network connection. To access ADMIN$ using a local account, Remote UAC will need to be disabled. This in no way impacts regular GUI-based (userland) UAC.
To disable Remote UAC, an entry will need to be made in the registry of the affected target computer:
Navigate to,
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Create a DWORD value called LocalAccountTokenFilterPolicy and assign it a value of 1.
A reboot is recommended but not required, however, restarting the Server service is necessary.
NOTES:
* By default, when local credentials are used to access a Windows Vista (or later OS) system that is a member of a Windows Domain, this problem does not exist. Your Windows domain may still disable Remote UAC.
* Remote administrative access is denied to local accounts when a Windows Vista (or later OS) is NOT a member of a Windows 2003 or later domain.
it solutions 