Windows 10: Admin elevation

I hate appearing stupid, but it is the only way I learn...

I have two user accounts on this computer, one as Administrator and the other as, well, let's call it "me".

Both are Administrator accounts.

So why is it that I regularly am either told or asked to elevate privileges to an admin account to install, uninstall, delete, and a host of other procedures in order to accomplish them? I made "me" an admin account so I wouldn't have to bother with that stuff!!!

Thank-you! *Smile

:)

 

Window 10 execute Notepad by administrator (right clicking)

I guess if you map a network drive from Explorer which normally runs un-elevated (i.e. non-admin), then that drive will be visible only to other un-elevated apps. Same probably goes for drives mapped from elevated Explorer and apps run as admin.

Question is, why are you running Notepad as admin? Without that can't you modify the files on the drive?

 

Windows 10 apps won't open. "This app can't open" error.

In the GP management editor, go to computer configuration, Policies, Windows settings, security settings, local policies, security options.

Problem started with these settings:

• User Account Control: behavior of the elevation prompt for administrators in admin approval mode; elevate without prompting
• User account control: detect application installations and prompt for elevation: disabled
• User account control: Run all administrators in Admin Approval Mode: Disabled.

This results in disabeling UAC.

Problems where solved with the following;

• User account control: detect application installations and prompt for elevation: ENABLED
• User account control: Run all administrators in Admin Approval Mode: ENABLED
• User Account Control: behavior of the elevation prompt for administrators in admin approval mode; UNDEFINED

gpupdate /force (twice ( just to be sure), then reboot)

 

Even if you are the Administrator Windows does not allow you to make some changes by default. Try adding this to your context menu. Lots of us use this, it just might help you.
https://www.tenforums.com/tutorials/3...dows-10-a.html

 

Thank-you!

They are a bit anal-retentive at Microsoft, aren't they...

 

They can be *Smile

 

There is a very good reason for admin accounts working this way.

By default the applications you run have the same rights and privileges your account does. If your account has full time admin rights then all programs you run have these rights as well. This is convenient and the way XP and older worked. But it isn't very secure. If you happen to run a malicious program, and this is very difficult to prevent, then it will be able to do pretty much anything it wants to. That is bad. And in todays world the risks of doing that are generally greater then than the convenience.

Starting with Vista admin accounts normally have only the limited rights of a standard user. With these limited rights malware is very limited in what it can do. That is good. The full rights of an admin account are available on request.

Yes, this behavior is at times inconvenient but it is a small price to pay for the added security. Security always has it's price, in the real world as well as with computers.

It is possible to give admin accounts full time admin rights but this is not recommended. This essentially lays out the welcome mat for malware. Do not expect that your AV product will keep you safe. It will not. By design Modern Apps will not run in this environment and there are other issues as well. Windows 10 was not designed to run this day, the option being provided only for exceptional circumstances. I will not describe how to do this.

 

I understand, and know the average user is prone to make such a mistake of simply choosing to make their account an admin account without understanding the risks, but if I wanted this safeguard I would have made my account a limited one; I specified Admin for the specific purpose of circumventing the safeguard and accepting the risk. If this is the extra "layer" that they chose to enact, then I would better understand if they didn't call the admin rights to a user account "Administrator", but instead something else. It either is or it isn't, and if not, then provide the distinction and the option, don't treat me like a child that isn't smart enough to be responsible for their own actions; that is an insult - IMHO. (Of course, this wouldn't be the first time in my life that I might be wrong...)

 

The ideal situation would be for users to use a standard account for general use and reserving an admin level account for when it was really needed. Dating back to at least Windows 2000 this is what Microsoft recommended. Windows 2000 had a runas facility and XP added Fast User Switching to make this more convenient. But it wasn't enough.

Many older applications needed to run with admin rights and users conditioned by Windows 9x expected full time admin rights. So most users created and used an admin account for general use. Not the ideal or recommended situation but that was the reality.

To accommodate this reality Microsoft introduced UAC in Vista. This gave the advantages of running with a standard account with most of the convenience of using an admin account. If you really needed a full time admin account you could disable UAC or use the built in Administrator account. Windows 10 mad disabling UAC more difficult.

The large majority of Windows users do not understand the risks of using a full time admin account but only the convenience. The default behavior of Windows was designed for these users. Facilities for changing this are provided for advanced users. It can be reasonably assumed that users who really do understand the risks will understand that an admin account may not be what the name implies. The terminology wasn't intended for such users.

 

I think the Amish have the right idea...

 

Yeah, living without the modern amenities may be a blessing.