Windows 10: Administrator permissions: How do I get full access of my computer?

When trying to rename, copy or delete certain files or folders, I keep getting the annoying "You need administrator permission" prompt. I then click the button and it's done. But it's totally annoying and it seems so random because those files are no important system files or anything. I know there's a lot of threads about ways to turn this off. I've read some of them. I've also read the tutorial about enabling the elevated administrator account. But I am still very confused and don't know which solution would work best for me. I would be grateful if someone could advise me.

Here's my questions:

1) I am getting the UAC prompt every time I try to change anything in the "C:\Program Files" folder. Is this behavoir normal for an administrator account?

2) Which folders or drives are typically "protected" by a UAC prompt?

3) What are generally speaking the ways of getting unrestricted access to a folder, drive or the entire computer (or suppressing the UAC prompt)? I've read about "taking ownership", "granting permission" and logging into the "elevated administrator account".

4) In the case of the "C:\Program Files" folder, which method would be advisable? I don't seem to be able to change the permissions in the context menu, I can only view them. I haven't tried taking ownership because I am not sure what that entails. Using the elevated administrator account doesn't make any sense because logging into that account just to copy a file would take much longer than just clicking away the UAC prompt.

5) Is there a way of converting my administrator account to an elevated admin account so I could use Windows 10 just as I've used all versions of Windows before?

:)

 

Administrative Access

I am the only administrator on my computers. I own and am the only user on the computers. They are all 64 bit running Windows10 Home. I have many files that I am not allowed into but yet I am the only administrator. I get I do not have permission or It
say Go to Security Tab to get full permission. Again I am the only user and administrator. How do I get full access to all of the files on my computers?

 

Administrator access on C drive

I lost Administrator access on C drive. Now only system has full control. I want to set/enable administrator's for full control on hard drive. I want to take permission from system to add administrator for security. How can I do that ?

 

I'm a Windows 7 Professional edition user, I'm only guessing about Windows 10.
Have you been able to activate and get into the built-in administrator account?
WindowsClub has an Ultimate Windows Tweaker just for Windows 10 -- if you download and install it, be very very careful as to what you activate and/or change.
Against the advice of some, I set my admin-level user's acct's UAC to absolute silence; the best setting would be just one notch from the bottom.
Be cautious about using "take ownership" "take admin rights" VBS or BAT utilities, such can backfire - until next Restart.

 

I did activate the built-in administrator account. And deactivated it again. It doesn't seem to be a good solution to constantly have to toggle between two accounts.

UAC is set to the lowest level.

 

Welcome to the forum.

Sorry, but what you are asking for is not a good idea. It would erase most of the security feature introduced in Windows since XP.
It is possible to use the built in Administrator account or fully elevate a normal admin account but this is NOT recommended. You will find that a variety of things, such as all of the modern app, will not work and there will likely be more in the future. This is by design, not a bug. Windows 10 was not designed to work this way. And even then there are some things you would not have access to.

Any modification of "C:\Program files" or it's subfolders will trigger a UAC prompt. This has been the case since Vista.

Certainly having full access is convenient. But it isn't very secure.

By default any software you run has the same rights and privileges as your account. Normally that isn't a problem. But if you happen to run malicious software, and that is very difficult to fully avoid, it will be able to do pretty much anything it wants if you are using an elevated account. That is why UAC was developed. With UAC an Admin account has by default only the rights of a limited account with full rights available only on request, using UAC.

UAC is a reasonable compromise between security and convenience. Security always has it's price.

Be VERY careful with taking ownership or modifying NTFS security settings. There are a variety of ways you can go wrong that are far from obvious. Even experts make mistakes. Best avoided unless really necessary.

Unlike Windows 7, setting UAC to the lowest level does not give you a fully elevated account in Windows 10. This is possible but NOT recommended and I will not describe the process.

There was a time when I turned UAC off in Windows 7. But no more. The risks are just too great. There are even more reasons not to do it in Windows 10.

 

Yes.

All the ones that malware would want to modify.

If there was, malware would have the same unrestricted access as you.

 

Ok, I get you. It's the old security vs freedom dilemma. But in this case, with the "Program files" folder, I do think Windows is exaggerating. I am using a Mac at home and a PC in my music studio. And I think the way OSX is handling this is more reasonable. With OSX I only get those UAC promts when modifying files in system folders.

I have to add that this PC I am setting up right now for my studio will not be connected to the Internet. So the malware threat is much lower than usual.

Anyway, I agree that constantly using an elevated admin account is probably not a good idea. But I do want to be able to move files in the "Program Files" folder without UAC prompts.

So in the meantime I tried two things: 1) I logged into the built-in admin account and tried to give my user account full permission for the "Program Files" folder. This didn't work. I guess because the super admin is not the owner of the folder, right? So only the owner of a folder can change permissions, is that correct?

2) From my user account I changed the ownership of the folder (which was "Trusted Installer") to "Administrators" and gave "Administrators" full access. Still, I got the UAC prompts. Why? Because my user account is not an elevated admin? Then I also gave full access to all "Users" (me being the only one). Finally, I was able to avoid the UAC prompts.

So what exactly does the term "Administrators" in the security tab of a folder mean? Are these normal admin accounts like my user account or elevated admin accounts?

And what are the consequences of changing the ownership of this folder from "Trusted Installer" to "Administrators"?

 

Got OS backups and usb or dvd backup restore boots? If yes, then, if the experiment doesn't work, you can return to a stable Windows.

 

There has always seemed to be a lot of confusion around administrator accounts and the UAC prompt. The most asked question being "I'm an administrator on my computer, but I get the UAC prompt asking for elevated rights, why?" The answer to this question is pretty simple. When you log into a computer with an administrator account you actually have two user access tokens. During normal computer usage you are using a regular user access token to perform regular tasks, and when some task requires elevated rights Windows will pop up the UAC prompt and your account is verified to be an administrator a given process is launched with an second user access token (admin) that can perform the task at hand. This keeps that elevated access isolated to only the process that needs it. Another important part to the UAC prompt is that it runs outside of the interactive user station winsta0 so processes (malware) that do not have SYSTEM access can not access or interact with the UAC prompt which is actually a screenshot of your computer running in winsta1 (services session) with a prompt for the user to click.

 

Good explanation of UAC by Neemobeer.

Even from the early days of the NT platform more than 20 years ago Microsoft has always recommended using a standard account for regular use, reserving the admin level account for those situations where it was needed. As an ideal that still stands. In NT4 and older that was much less convenient than now. If you were logged in with a standard account and needed to do admin work you had to log out (which closed all applications), log into the admin account, do what needed to be done, log out, log into your regular account and reopen your applications. Windows 2000 added the "Run as" ability and XP added Fast User Switching to make this more convenient. UAC introduced with Vista made this even more convenient.

As mentioned previously running with a full time admin account is dangerous, particularly when accessing the Internet. You don't have to download anything to become infected. Merely visiting an infected website is often enough. Even trusted websites with a good reputation have been infected.

You can't trust your AV software to keep you safe. Modern malware, in all it's forms, has become VERY sophisticated in recent years. A high priority for malware is to evade detection, even with the best AV products with the latest updates. And they often do. Some malware has a form of automatic update that updates itself when the author releases a new version. It is war between malware and the software designed to fight it. Most security experts acknowledge that malware is winning.

UAC is not a silver bullet that will defeat all malware. It was never designed to be. Good security, in anything, consists of multiple layers. One layer may be evaded, multiple layers make this more difficult. UAC is one such layer.

 

LMiller7, let's say one is using a standard account, suddenly needs an admin-level acct, would Switch User work? The standard account in in limbo, when the admin-level acct need is done, one returns to the standard account -- that's ok, correct?

 

Ok, ok, thanks. I agree ... partly *Wink I will be careful.

I'd still appreciate some answers to the questions in my previous post. I'm just trying to understand how permissions and owership work in Windows 10.

1) Why wasn't I able to change permissions to the "Program Files" folder from the elevated admin account?

2) What is meant by "Administrators" in the security tab in the context menu of a folder? Are they the super admins (but why plural if there is only one)? Or the "normal" administrator accounts?

3) What are the consequences of changing the ownership of the "Program Files" folder to "Administrators" and giving full permission to all users?

And - here's a new question: How can I change the ownership back to "Trusted Installer"? I was thinking to just give myself full access to one specific program folder instead of the whole "Program Files" and leave the rest in the default state.

 

1. Because the elevated admin account didn't have the rights to do that.
2. In this context "Administrators" refers to any elevated admin account. A non elevated admin account has only the rights of a standard user.
3. You would compromise security. Malware running with standard user rights could do whatever it pleases with the folder and it's contents. Write access to the Program Files folder has been limited to elevated admin level accounts since Vista.

Be aware that file and folder permissions are complex. You won't learn everything by reading a few forum posts.

You really should be leaving these permissions alone.

 

Because Administrators doesn't have the necessary permissions.

Administrators is the name of a Group. Accounts can be members of one or more groups. You cannot log on as a group, only as an individual account. All accounts with admin rights are members of the Administrators group. Administrator (the one you call the 'super admin') is a special built-in account (another is Guest). Ownership and permissions can be granted to a single account or to a Group. Permissions granted to a group apply to all accounts that are members of that group.

Users is another Group. All users would be able to modify the contents of Program Files, including any malware processes they may be running.

You have to type TrustedInstaller's name in full before you will find it when you click 'check names'. It is:
NT SERVICE\TrustedInstaller