Vista - What is the differences between default admin and limited admin

Hi,

I'd like to ask you about "Administrator groups" on Vista RTM. It is too
complicated account for me to understand it corectlly. So,could you please
teach me the definition of them and differences between elevated
admin,default admin and limited admin?

Thanks in advance.

In article <1D45203D-A1D5-4969-A0A4-7A8EA0304070@microsoft.com>,
îYÇflÇÈéqór <@discussions.microsoft.com> wrote:

> Hi,
>
> I'd like to ask you about "Administrator groups" on Vista RTM. It is too
> complicated account for me to understand it corectlly. So,could you please
> teach me the definition of them and differences between elevated
> admin,default admin and limited admin?
>
> Thanks in advance.

Nothing has really changed in regards the administrator group. The
default administrator (a built-in account named Administrator that is
created by the operating system) is very similar to past versions of NT
based versions of Windows.

What has changed is the addition of UAC - User Access Control. If not
familiar with this feature, the "access denied" messages that an
administrator will see can be surprising. Suggest reading about UAC. I
think that doing so will quickly knit your understanding of the "old"
methods with the "new" ones introduced in Vista.

--
Sharon F
MVP - Windows Shell

Hello,

Administrators in Windows Vista now run in what's called Admin Approval
Mode, which is powered by User Account Control (UAC).

In this mode, Windows only allows programs to run with your administrator
powers if you explicitly authorize them through a permission prompt
("Windows needs your permission to continue"). If a program does not prompt
automatically or you do not manually give the application permission, it
cannot use your administrator power.

Programs that automatically prompt or programs that you explicitly start
with admin power by right-clicking them and clicking Run As Administrator
will be able to use your administrator power.

As an example, notepad.exe does NOT automatically prompt you for admin
power. If you start notepad and attempt to use it to modify a system file
(such as your HOSTS file), you will receive an access denied message,
because notepad needs administrator power to do this, and you have not
granted it this power.

However, if you right-click notepad and click Run As Administrator, you will
be able to use it to modify system configuration files because you have
granted it permission to use your administrator powers.

Another good example is the command prompt - if you are going to use the
command prompt to perform system administration tasks, you will need to
right-click command prompt and click Run As Administrator - otherwise, the
tools that you run from within command prompt will not be able to perform
their tasks, because they have not been granted permission to use your admin
powers.

Programs that require admin permission to start will be shown with a
security-shield icon. Also, some programs will run without admin powers but
are programmed so that doing admin actions inside of them will automatically
prompt you for permission. These actions will also be shown with a security
shield icon. For example, when using Windows Explorer, changing security
settings on a file will generally need to use your admin power, and so the
edit button on the security properties dialog will display a security shield
and prompt you for permission when you click on it.

Right-clicking a program and clicking Run As Administrator is called
'elevating' that application.

The built-in Administrator account runs OUTSIDE of Admin Approval Mode by
default - when logged in as the built-in administrator, all programs that
you run will be able to use your admin power, without prompting. This is the
same behavior that exists in Windows XP. However, the built-in administrator
account is depreciated and disabled by default, and can only be used in safe
mode if (and only if) the computer is not part of a domain and there are no
other administrator accounts that can be used to log in at that time.

--
- JB

Windows Vista Support Faq
http://www.jimmah.com/vista/

"Jimmy Brush" wrote:

> Hello,
>
> Administrators in Windows Vista now run in what's called Admin Approval
> Mode, which is powered by User Account Control (UAC).
>
> In this mode, Windows only allows programs to run with your administrator
> powers if you explicitly authorize them through a permission prompt
> ("Windows needs your permission to continue"). If a program does not prompt
> automatically or you do not manually give the application permission, it
> cannot use your administrator power.
>
> Programs that automatically prompt or programs that you explicitly start
> with admin power by right-clicking them and clicking Run As Administrator
> will be able to use your administrator power.
>
> As an example, notepad.exe does NOT automatically prompt you for admin
> power. If you start notepad and attempt to use it to modify a system file
> (such as your HOSTS file), you will receive an access denied message,
> because notepad needs administrator power to do this, and you have not
> granted it this power.
>
> However, if you right-click notepad and click Run As Administrator, you will
> be able to use it to modify system configuration files because you have
> granted it permission to use your administrator powers.
>
> Another good example is the command prompt - if you are going to use the
> command prompt to perform system administration tasks, you will need to
> right-click command prompt and click Run As Administrator - otherwise, the
> tools that you run from within command prompt will not be able to perform
> their tasks, because they have not been granted permission to use your admin
> powers.
>
> Programs that require admin permission to start will be shown with a
> security-shield icon. Also, some programs will run without admin powers but
> are programmed so that doing admin actions inside of them will automatically
> prompt you for permission. These actions will also be shown with a security
> shield icon. For example, when using Windows Explorer, changing security
> settings on a file will generally need to use your admin power, and so the
> edit button on the security properties dialog will display a security shield
> and prompt you for permission when you click on it.
>
> Right-clicking a program and clicking Run As Administrator is called
> 'elevating' that application.
>
> The built-in Administrator account runs OUTSIDE of Admin Approval Mode by
> default - when logged in as the built-in administrator, all programs that
> you run will be able to use your admin power, without prompting. This is the
> same behavior that exists in Windows XP. However, the built-in administrator
> account is depreciated and disabled by default, and can only be used in safe
> mode if (and only if) the computer is not part of a domain and there are no
> other administrator accounts that can be used to log in at that time.
>
> --
> - JB
>
> Windows Vista Support Faq
> http://www.jimmah.com/vista/
> I have used the default Admin account with every version of Vista I have tested in the Ultimate version and never went into safe mode and have always enabled the accoount and used it to run vista to avoid the problem with disabling UAC, but when i ran Premium could not find the disabled account to enable and log into.

Hi Jimmy,
Thank you for replying my question.
You have a wide knowledge..I really appreciate your comment.

Thanks a lot.

"Jimmy Brush" wrote:

> Hello,
>
> Administrators in Windows Vista now run in what's called Admin Approval
> Mode, which is powered by User Account Control (UAC).
>
> In this mode, Windows only allows programs to run with your administrator
> powers if you explicitly authorize them through a permission prompt
> ("Windows needs your permission to continue"). If a program does not prompt
> automatically or you do not manually give the application permission, it
> cannot use your administrator power.
>
> Programs that automatically prompt or programs that you explicitly start
> with admin power by right-clicking them and clicking Run As Administrator
> will be able to use your administrator power.
>
> As an example, notepad.exe does NOT automatically prompt you for admin
> power. If you start notepad and attempt to use it to modify a system file
> (such as your HOSTS file), you will receive an access denied message,
> because notepad needs administrator power to do this, and you have not
> granted it this power.
>
> However, if you right-click notepad and click Run As Administrator, you will
> be able to use it to modify system configuration files because you have
> granted it permission to use your administrator powers.
>
> Another good example is the command prompt - if you are going to use the
> command prompt to perform system administration tasks, you will need to
> right-click command prompt and click Run As Administrator - otherwise, the
> tools that you run from within command prompt will not be able to perform
> their tasks, because they have not been granted permission to use your admin
> powers.
>
> Programs that require admin permission to start will be shown with a
> security-shield icon. Also, some programs will run without admin powers but
> are programmed so that doing admin actions inside of them will automatically
> prompt you for permission. These actions will also be shown with a security
> shield icon. For example, when using Windows Explorer, changing security
> settings on a file will generally need to use your admin power, and so the
> edit button on the security properties dialog will display a security shield
> and prompt you for permission when you click on it.
>
> Right-clicking a program and clicking Run As Administrator is called
> 'elevating' that application.
>
> The built-in Administrator account runs OUTSIDE of Admin Approval Mode by
> default - when logged in as the built-in administrator, all programs that
> you run will be able to use your admin power, without prompting. This is the
> same behavior that exists in Windows XP. However, the built-in administrator
> account is depreciated and disabled by default, and can only be used in safe
> mode if (and only if) the computer is not part of a domain and there are no
> other administrator accounts that can be used to log in at that time.
>
> --
> - JB
>
> Windows Vista Support Faq
> http://www.jimmah.com/vista/
>

<snip>
>> I have used the default Admin account with every version of Vista I have
>> tested in the Ultimate version and never went into safe mode and have
>> always enabled the accoount and used it to run vista to avoid the problem
>> with disabling UAC, but when i ran Premium could not find the disabled
>> account to enable and log into.

Hello,

Enabling the built-in admin account and then running Vista using the
built-in admin account does the same thing as disabling UAC - when you are
logged in with the built-in admin account, you get NONE of the benefits of
UAC.

If you want the benefits of UAC, you should log in with your normal
administrator account. You should be able to do everything you need to do
from a "normal" administrator account; if you are having trouble performing
a certain task, running the program you are using "as administrator" by
right-clicking it and clicking Run As Administrator should allow it to work.

It is best to only enable and use the built-in administrator account for
very short periods of time. You should be able to enable the built-in admin
account using the following command, if the local users and groups mmc
snap-in is not available:

- Click start
- Find command prompt
- Right-click it and click Run As Administrator
- Type: net user administrator /active:yes
- Press enter


--
- JB

Windows Vista Support Faq
http://www.jimmah.com/vista/

You're welcome


--
- JB

Windows Vista Support Faq
http://www.jimmah.com/vista/