Difference between ‘Run as administrator’ vs. being logged in as admin?

Topic

New Reply

Today I upgraded a software program on a Windows XP SP3 PC. I was logged in as the local administrator to do the install. There were no errors shown during the installation. After rebooting the PC (running XP SP3) and logging back in as local admin, the program would not run. When you double clicked either the start menu icon or the exe in the program files folder the hour glass would show for just a fraction of a second and then go away- No program launch. The weird thing is, is that I found that if I right click the exe and chose runas and enter the local admin password, then the program launches and works fine.

It would seem to me that there is a privilege issue here. What I don’t understand is what’s different about the security context between being logged in as the local admin and using runas the local admin?

Reply | Quote

Replies

While you are logged as admin, the programs you execute do not run with the fullest privileges possible. This is a security measure, as most people run Windows under administrator accounts and this was meant to diminish the risk associated with that, albeit just by a small amount.

Reply | Quote

I know that its true in Vista and Win7 that the admin account does not have full admin rights resulting in the UAC prompts when needed. However, I did not think that was true for XP.

Reply | Quote

Rui is correct. Even in XP, the program will run at higher privlivges than just running in an administrator account. That’s why the “run as administrator” option is there.

Jerry

Reply | Quote

And hence another reason not to run from an Administrator Account when not doing system maintenance.

BTW, in all my Windows OS versions, the effect of running a program in a Limited or Standard User Account varies by program. Some run just fine without excessive UACs (or Windows XP Log In As Admin popups). Others cause endless issues with privilege elevation popups, even when run in an Administrator Account. So it’s not a Windows issue, but a software issue.

I wouldn’t trust a program which doesn’t ask for privilege elevation permissions even in Windows XP, before engaging in System level operations or changes, even under Windows XP. Too much chance for mischief which might only come to light after a reboot.

-- rc primak

Reply | Quote

I’m running Win 7 Pro, SP1. There is only my user account on this machine (mine), and it shows as Administrator. On my previous XP machine, there were at least 2 user accounts, mine (also shown as Administrator) and a separate Administrator account.
Does this mean that on Win 7 I have full admin privileges, or is there some superset of privileges that I don’t have? If so how can I give my user account maximum privileges all the time? I’m not worried about protecting myself from making stupid mistakes, it’s more important to me that I not be prevented from making them. I’ll live with and learn from the consequences.

Reply | Quote

There is still a separate Administrator account in Windows 7, but it’s disabled and hidden: Enable / Disable the Local (Hidden, Built-In) Administrator Account in Windows 7

The arrangement is not just to protect you from yourself though; but also from anyone hacking into your account, including malware.

Bruce

Reply | Quote

Thanks for that link, Bruce.
Currently, I boot into my account directly, with no password. I want that account to have 100% admin privileges (same as the hidden admin account), and I still want to boot into it directly, with no password. How do I make that happen?
I understand the pitfalls of doing this, but for argument’s sake, I don’t care.

Reply | Quote

Sometimes if you right click on the program, it will ask you to run as adminstrator and it will then install properly.

Reply | Quote

One sure way to accomplish what you want is to give your acct administrator rights, then do the install. Then after the install is complete, lower the rights to what you had before.

Group "L" (Linux Mint)
with Windows 10 running in a remote session on my file server

Reply | Quote

MJSabol, I’m not talking about running individual programs here, I want my current user (me) to have FULL admin privileges for all tasks, all the time (indistinguishable from the privileges given to the hidden admin account).

Jim, I guess I don’t understand what you’re saying here. How do I give my account more administrative rights than it currently has, when it already has administrative rights (just not as many rights as the true, hidden administrator account)? And to what install are you referring (see my comment to MJSabol)? And why would I want to lower my rights after the install (again, see my comment to MJSabol).

Reply | Quote

Jim, I guess I don’t understand what you’re saying here. How do I give my account more administrative rights than it currently has, when it already has administrative rights (just not as many rights as the true, hidden administrator account)? And to what install are you referring (see my comment to MJSabol)? And why would I want to lower my rights after the install (again, see my comment to MJSabol).

If your account already has administrator rights, then you can’t go any higher than that.

I remember in the XP days, on my job the users were given “user” rights. However, there were times when I would install something on the user’s computer, and it wouldn’t install right, or I couldn’t configure it right, unless that user had administrative rights. So I would temporary add administrator rights to their account, do the install, configure everything, and then take away the administrator rights from the user account.

That’s what I was talking about. I guess I missed the fact that you already have administrator rights.

BTW, I have no idea why you had to “run as” the local admin, if you were already logged in as the local admin. Perhaps a registry error in Windows? I’d try to uninstall and reinstall the program to see if that clears up the problem.

Group "L" (Linux Mint)
with Windows 10 running in a remote session on my file server

Reply | Quote

To some extent, because the software is proprietary and designed to be prudent for a targeted market, you are stuck with what Microsoft will allow you to do. If that software is in product line for home users, less latitude. With the business class product, there is an effort to meet the IT needs to edit policy.

The terms “rights” and “privileges” BTW, are vague esoteric terms that Microsoft uses in its somewhat all or nothing approach to reduce policy editing to simple choices. That’s a strategy that’s probably wise for the majority of the market of home users.

That means that your request is viewed as less than prudent, so not likely to be accomodated. There’s always Open Source.

Reply | Quote

I have Win7 and an ‘administrator’ account. UAC prompts disabled through Windows.

I run into this same problem. No UAC prompt during installing and it appears to install.

Go to run it- nothing happens.

Right click it, run as admin, still nada

Uninstall it, reinstalled with “run as admin”
Runs.

What IS going on?

Well, my app is original from W95 days. It has been patched to run on each new Windows.
It currently supports W95 all the way to Win8.

Is your program usable on earlier Windows? Might be a bug between Windows…?

Same results with XP.

Might be by design is my point.

Reply | Quote

The (default) Administrator account in XP is visible, and that account is disabled by default in Windows 7. However, in both OS’s, even though you might be logged in as the default Administrator, that account does not run at the highest privilege level continuously. The UAC prompts are a good hint of that.

One of the tools I use has instructions for installation and use. To install, right-click the installation executable and select “Run as administrator”. After installation, to run the program, even when logged on as a member of the Administrators group, right-click the shortcut and select “Run as administrator, or click the “Advanced” button on the shortcut’s property sheet and put a tic in the box by “Run as administrator”, and from then on the UAC will ask if you want to allow the program to make changes to the computer.

I know of no registry tweak or hack that will allow one to run at the highest privilege level routinely, even logged in as the default Administrator.

That is to say, even if your account has Administrator rights, there is a higher level that can be accessed, but cannot be maintained. The level drops back down when the task for which it was invoked has completed. It is behavior by design, and there’s nothing to be done to change that behavior to my knowledge.

Disabling the UAC prompts doesn’t disable the default behavior of the Administrator account.

Always create a fresh drive image before making system changes/Windows updates; you may need to start over!

We all have our own reasons for doing the things that we do with our systems; we don't need anyone's approval, and we don't all have to do the same things.

We were all once "Average Users".

Computer Specs

Reply | Quote

That is to say, even if your account has Administrator rights, there is a higher level that can be accessed, but cannot be maintained. The level drops back down when the task for which it was invoked has completed. It is behavior by design, and there’s nothing to be done to change that behavior to my knowledge.

What possible protection would this give? If a hacker temporarily has full access, or if spyware has full access for the duration of the process it is running, then it is no protection at all.

On the other hand, it is a major hassle for the user.

Group "L" (Linux Mint)
with Windows 10 running in a remote session on my file server

Reply | Quote

What possible protection would this give? If a hacker temporarily has full access, or if spyware has full access for the duration of the process it is running, then it is no protection at all.

On the other hand, it is a major hassle for the user.

”Run as administrator” gives the higher privilege to the task that is being “Run as administrator”, and no other task. It is a specific elevation of privilege for a specific task, only. If one takes the time to read the UAC prompt that pops up, it names the executable and publisher (or lists the publisher as unknown), asking if you want to grant permission for this program (only) to make changes to the computer.

It does not place the entire system at the higher privilege level, only the one specific application. You can test this quite simply for yourself. Choose a particular program that you know will ask for higher privileges, OK it to run, and then while that program is running, try to start another which you know will ask for higher privileges. You will get another UAC prompt, asking if you want to allow the second program to make changes to the computer.

Always create a fresh drive image before making system changes/Windows updates; you may need to start over!

We all have our own reasons for doing the things that we do with our systems; we don't need anyone's approval, and we don't all have to do the same things.

We were all once "Average Users".

Computer Specs

Reply | Quote