I think Windows is confusing the volumes or whatnot. I can't create new users and running
`runas /user:uslap200\testadmin powershell`
caused the following error
`RUNAS ERROR: Unable to run - powershell`
`112: There is not enough space on the disk.`
running with `/noprofile` works
In procmon I see accesses to the ESP volume. I don't understand why Windows is trying to access that during runas
`5:56:03.7124886 PM lsass.exe 904 CreateFile \Device\HarddiskVolume1\EFI\Microsoft\Boot\Policies\UnlockToken.pol PATH NOT FOUND Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a`
Why is it trying to find this `UnlockToken.pol.` Googling links it with SCCM, but we don't use SCCM here.
I'm linking the procmon log here.
[
admin_powershell.PML
