Cannot mount password-protected backup as non-admin user

William, welcome to these user forums.

I have just tried this on my own system where I created a local password protected backup of a small folder, then switched user to a non-admin account and was able to double-click on the password protected backup in Windows Explorer - this prompted me immediately for the password which I entered, then I could navigate inside the backup contents without any futher prompts.

Was ATIH 2017 installed from within the Administrator account on your system?

Hi Steve,

Actually, I'm referring to the mount capability.  That is, right-click on the backup image and select Acronis True Image -> Mount.  For me, this gives my Windows credentials prompt (for an account with admin privileges).  But following that, there is no prompt for the backup password.

If I simply double-click on the password-protected backup image, then I get the prompt for the backup password.  This action doesn't require administrative privileges, and works fine for me.

Hi William, sorry getting late here in the UK and I didn't register about mounting the image.

Please raise a support ticket for this issue directly with Acronis Support by clicking on the Support link at the top of the forum pages, then scroll down to where you see Contact Support.  Reference this forum topic in your ticket.

I am able to replicate the same issue as you have reported, and unfortunately Acronis have removed the option from the ATIH GUI to be able to Mount an image in that way.  I will raise my own support ticket when I have time sometime tomorrow and will reference this topic too.

Edit: My case number is 02867869 with Acronis Support for this issue, if you want to reference this too.

I've filed an email support request.  I do not yet have a case number.  However, I did reference this forum link.  Thanks.

William, that's good, thanks for doing so.  You should get a case number back in a confirmation email - that is what I did yesterday evening as it was much too late in the day for me to start getting into a live chat discussion with one of the Acronis Customer Central agents.

I got a case number:  02868254

However, even with the detailed steps in the report, they were unable to reproduce.   :-/

William, I have just repeated my steps to recreate this problem and submitted an Acronis System Report to their FTP site for my case after being requested for more information.

This may be a Windows limitation.  At work, we have seperate regular and admin accounts.  It is a pain to switch back and forth whenever the "run as administrator" option does not work in certain situations.  There is a work-a-round though which I use often and it makes life grand.  You can launch a sepearate Windows Explorer instance via command prompt (make a .bat file of the command so you can just double click it and go from there). 

1. Take ownership of reg key HK_CLASSES_ROOT\AppID\{CDCBCFCA-3CDC-436f-A4E2-0E02075250C2 and grant yourself Full Control. This key controls how explorer is allowed to launch. You have to do this in the advanced permissions/owner page of the folder that contains the runas subkey.

2. rename the subkey runas to _runas 

3. copy into notepad and change from .txt to .bat (be sure to enter your actual username).  Save to a convenient place (like your desktop)

runas /user:ENTERUSERNAME "c:\windows\explorer.exe /separate"

When you click on it, you'll be prompted for credentials to launch a new Windows Explorer window. Once you authenticate with the admin account (enter your password), then use that window to navigate to to the .tib file and try to mount it.  

if you use smart cards to authenticate, then add the /smartcard switch to your .bat file

runas /user:ENTERUSERNAME /smartcard "c:\windows\explorer.exe /separate"  

(be sure to include your domain if you are a domain user as well, such as /user:domain\username)

-----------------------------------------

http://superuser.com/questions/290940/how-to-launch-windows-explorer-with-the-privileges-of-a-different-domain-user

https://social.technet.microsoft.com/Forums/forefront/en-US/2a366967-f9fb-4010-81f3-94dc15c86ad3/run-explorer-as-a-different-user?forum=w7itprosecurity

_runas

Ahh, the good old "explorer /separate" trick.  I've used that in the past, but was annoyed to see that it didn't work in newer Windows versions.  Good to know that there's a registry workaround to re-enable it.  I have to wonder, however, why Microsoft took the steps to disable it.  Given the existing "TrustedInstaller" ownership of the key, perhaps there was some problem with elevated-privilege installers doing something with explorer.exe running as a different user?

Anyway, I can confirm that this workaround does work, without needing to switch users.   Thanks.

Rob, thanks for the tip about the registry change and explorer /separate - I can also confirm that this does get round the issue but it would make more sense if Acronis gave a message such as 'You do not have the necessary permissions...' when you try to access something that needs Administrator level access, rather than asking for the admin user credentials then doing nothing!

Agreed - needs some polish to avoid confusion and a warning that admin access is not found would make a lot of sense.  

Response from Acronis to my case # 02867869 - now closed!

Thank you for your response. 

I checked with my resources and I would like to inform you that
we need to have admin privileges for any actions using Acronis True Image application.
I understand that it would make more sense if Acronis gave a message such as
'You do not have the necessary permissions' when we try to access something that needs
Administrator level access, rather than asking for the admin user credentials then doing nothing. 

I will take this as feedback. To ensure that the management team is aware of this,
I am going to enter your comments into our ‘Customer Listening System’. 
The feedback we submit is used to drive major changes in support and Acronis as a whole.
It is a vital initiative in Acronis and is taken very seriously.
I am sorry, your experience did not meet your expectations, as I said;
I will make sure your concerns are reviewed by the management team.

I got a similar email message.

The way that I'm interpreting it is that they have confirmed my behavior, and are marking the issue as "fixed" without actually fixing anything?   Maybe they'll just update the documentation to indicate that you can't do a thing that you should be able to do?

That would be my guess - probably a KB article or something.  It appears to be "working" "by design", but should have better clarification somewhere in the documneation that it requires the use of an adminisrtative account for features, such as mount, to function correctly. 

I have asked for a KB document for my support case which is still open because of this request.  I am not expecting any change to the messages provided within the application as this would require a new build, and wouldn't be retrofitted to earlier versions either, but it would be good if the user guides (online) were updated in the System Requirements section.

Hello Everyone,

We replicated the problem on our side and it was decided to fix it in one of the next updates. It is still unknown whether it will be the nearest or the one after that.

Regards,

Slava

Thanks for the update Slava, glad to hear that your team was able to reproduce and will produce a fix for this issue.