Fix 'Run as Different User Access Denied' in Windows 11

If you encounter "Access Denied" errors when trying to use the runas command, "Run as Administrator," or "Run as a different user" on Windows, follow these solutions to resolve the issue. This guide includes workarounds for both newly upgraded Windows Servers and Windows 11 systems.

How Can I Fix "Access Denied" Errors When Using the runas Command or "Run as Administrator" on Windows 11?​

1. Modify Group Policy Settings​

• Open Group Policy Management Console:
  • Press Windows + R, type gpedit.msc, and press Enter.
• Navigate to the Secondary Logon Service Policy:
  • Go to Computer Configuration > Policies > Windows Settings > Security Settings > System Services.
  • Locate and open the Secondary Logon service.
• Define and Enable the Policy Settings:
  • Check the Define this policy setting box and select Enabled.
  • Set the service startup mode to Manual.
• Expand Security Settings:
  • Ensure the following properties and objects are set to Allow:
    • Authenticated Users: Query Template, Query Status, Enumerate Dependents, Start, Pause, continue, Interrogate, Read Permissions, User-Defined Control.
    • Builtin\Administrators: Full Control.
    • Interactive: Query Template, Query Status, Enumerate Dependents, Start, Pause, continue, Interrogate, Read Permissions, User-Defined Control.
    • Service: Query Template, Query Status, Enumerate Dependents, Pause, continue, Interrogate, User-Defined Control.
    • System: Query Template, Query Status, Enumerate Dependents, Start, Pause, continue, Interrogate, Stop.
• Apply the Security and Group Policy Changes:
  • Click OK to apply the security changes.
  • Click OK again to apply the Group Policy changes.
• Update Group Policy on Affected Computers:
  • Wait for the Group Policy to update automatically or manually update by running gpupdate /force in the Command Prompt.
• Verify the Secondary Logon Service:
  • Make sure you can switch users and that the Secondary Logon service starts correctly.

Although frequent updates may reapply permissions, this solution fixes the incorrect security settings after an upgrade.

2. Take Ownership of Files and Folders​

• Right-Click the File or Folder:
  • Select Properties.
• Navigate to the Security Tab:
  • Click on the Security tab, then click Advanced.
• Change Ownership:
  • Click Change next to the owner's name.
  • Enter your username and click Check Names, then OK.
  • Check the box for Replace owner on subcontainers and objects and click OK.
• Set Permissions:
  • Click Edit in the Security tab.
  • Select your username and check all the boxes for full control permissions, then click OK.
• Apply Changes:
  • Click Apply and then OK to save the changes.

Taking ownership and setting the correct permissions ensure that you have complete access to the files and folders, potentially resolving "Access Denied" errors.

3. Check the services​

• Press Windows key + R and enter services.msc.
  
• Locate the Secondary Logon service and double-click it.
  
• Set the Startup Type to Automatic and click Start to start the service.
  
• Save changes and try to run the service again.

4. Disable Group Policy Restrictions on Removable Storage​

• Open Local Group Policy Editor:
  • Press Windows + R, type gpedit.msc, and press Enter.
• Navigate to Removable Storage Access:
  • Go to User Configuration > Administrative Templates > System > Removable Storage Access.
• Disable Restrictions:
  • Find and set the policy All Removable Storage classes: Deny all access to Disabled.
• Apply Changes:
  • Click Apply and then OK.

Disabling these restrictions ensures you have access to removable storage devices, potentially fixing "Access Denied" errors.

By following these steps, you should be able to resolve various "Access Denied" issues related to the runas command, "Run as Administrator," and "Run as a different user" on Windows systems.