Vista - Run as Administrator under a Standard User with UAC disabled.

I am unsure of the expected behaviour when choosing "Run as
administrator" on a standard user with UAC disabled. At first I
thought that I would get an UAC prompt anyway, but that didn't happen.
Instead, it seems to silently run as a standard user, without ever
notifying me that the "Run as administrator" part failed. In that
case, why would the "Run as Administrator" option be there in the
first place?

Hi Eric,

In Vista you are considered a Standard user even as a Administrator. The Run as Administrator is just a way to elevate the item you selected it for to run in the actual Administrator account instead of the default standard (want to be Administrator) account listed as Administrator. The UAC doesn't affect this, it just asked to confirm before. It's only a checkpoint that asks you everytime for confirmation when a program tries to run and make changes to the system.

Hope this helps,
Shawn

So, a standard user, without administrative privilege, can run
applications as an administrator... Without ever getting a prompt for
an admin password? Doesn't that defeat the purpose of having a non-
admin account in the first place?

On May 15, 12:19 pm, brink <brink.2qm...@no-mx.forums.net> wrote:
> Hi Eric,
>
> In Vista you are considered a Standard user even as a Administrator.
> The Run as Administrator is just a way to elevate the item you selected
> it for to run in the actual Administrator account instead of the default
> standard (want to be Administrator) account listed as Administrator.
> The UAC doesn't affect this, it just asked to confirm before. It's only
> a checkpoint that asks you everytime for confirmation when a program
> tries to run and make changes to the system.
>
> Hope this helps,
> Shawn
>
> --
> brink
>
> "Practice makes perfect, then you reinstall"
> Vista 64 Home Premium
> 1.5 Gig DDR2 533 Mhz (PC4200) RAM

No,

Only a Administrator account can. It's just in Vista, the Administrator account is treated like a standard account by default making you give the application or action Administrator permissions first. There is another account that is a Administrator account that is treated as a actual Administrator account. but not by default or selection. But it's not recommended to run in such an account all the time for security issues. For nothing will need permission to run in such an account.

Shawn

Hello,

To answer your question,

Run As Administrator is tied into UAC to perform elevation from both
admin accounts and non-admin accounts, so it doesn't work when UAC is
disabled.

As a workaround, you can use the runas command-line tool to run
programs under alternate credentials.

To go into some more detail about UAC,

Programs cannot be "elevated" from inside a standard user account
without asking you for the credentials of an administrator.

When logged in as a standard user, "elevation" is simply running a
program under the credentials of an administrative user, just like one
may have done in Windows XP, but with some extra security goodness
thrown in to help protect these elevated programs from attack.

When logged in as an administrator, elevation is simply allowing the
program to run with the full rights of whatever administrator is
logged in.

Apps that don't run elevated inside of an administrator account are
"filtered" so that they can only use "standard user" privileges.

In the context of an administrator account, both elevated and
non-elevated programs are running inside of the currently logged in
administrator's account. UAC does not actually change the privielges
assigned to administrator accounts, it just filters these privileges
down for non-elevated apps. Administrator accounts are still
administrator accounts (there is no seperate or hidden "root
administrator" account being used to make this hapen).


- JB
Microsoft MVP - Windows Shell

On 15 May 2007 09:42:07 -0700, ericfournier4@gmail.com wrote:

>So, a standard user, without administrative privilege, can run
>applications as an administrator... Without ever getting a prompt for
>an admin password? Doesn't that defeat the purpose of having a non-
>admin account in the first place?
>
>On May 15, 12:19 pm, brink <brink.2qm...@no-mx.forums.net> wrote:
>> Hi Eric,
>>
>> In Vista you are considered a Standard user even as a Administrator.
>> The Run as Administrator is just a way to elevate the item you selected
>> it for to run in the actual Administrator account instead of the default
>> standard (want to be Administrator) account listed as Administrator.
>> The UAC doesn't affect this, it just asked to confirm before. It's only
>> a checkpoint that asks you everytime for confirmation when a program
>> tries to run and make changes to the system.
>>
>> Hope this helps,
>> Shawn
>>
>> --
>> brink
>>
>> "Practice makes perfect, then you reinstall"
>> Vista 64 Home Premium
>> 1.5 Gig DDR2 533 Mhz (PC4200) RAM
>

Thank you! This does answer my question, and is the behaviour I had
come to expect. It's just a shame that the "Run as administrator" menu
item is still present, and fails without any warning whatsoever,
though it does somewhat follows MS' own guidelines of not trying to
filter out UI elements through admin/UAC checks.

On May 15, 2:41 pm, Jimmy Brush <j...@mvps.org> wrote:
> Hello,
>
> To answer your question,
>
> Run As Administratoris tied into UAC to perform elevation from both
> admin accounts and non-admin accounts, so it doesn't work when UAC is
> disabled.
>
> As a workaround, you can use the runas command-line tool to run
> programs under alternate credentials.
>
> To go into some more detail about UAC,
>
> Programs cannot be "elevated" from inside astandard useraccount
> without asking you for the credentials of an administrator.
>
> When logged in as astandard user, "elevation" is simply running a
> program under the credentials of an administrative user, just like one
> may have done in Windows XP, but with some extra security goodness
> thrown in to help protect these elevated programs from attack.
>
> When logged in as an administrator, elevation is simply allowing the
> program to run with the full rights of whatever administrator is
> logged in.
>
> Apps that don't run elevated inside of an administrator account are
> "filtered" so that they can only use "standard user" privileges.
>
> In the context of an administrator account, both elevated and
> non-elevated programs are running inside of the currently logged in
> administrator's account. UAC does not actually change the privielges
> assigned to administrator accounts, it just filters these privileges
> down for non-elevated apps. Administrator accounts are still
> administrator accounts (there is no seperate or hidden "root
> administrator" account being used to make this hapen).
>
> - JB
> Microsoft MVP - Windows Shell
>
> On 15 May 2007 09:42:07 -0700, ericfourni...@gmail.com wrote:
>
> >So, astandard user, without administrative privilege, can run
> >applications as an administrator... Without ever getting a prompt for
> >an admin password? Doesn't that defeat the purpose of having a non-
> >admin account in the first place?
>
> >On May 15, 12:19 pm, brink <brink.2qm...@no-mx.forums.net> wrote:
> >> Hi Eric,
>
> >> In Vista you are considered aStandard usereven as a Administrator.
> >> TheRun as Administratoris just a way to elevate the item you selected
> >> it for to run in the actual Administrator account instead of the default
> >> standard (want to be Administrator) account listed as Administrator.
> >> The UAC doesn't affect this, it just asked to confirm before. It's only
> >> a checkpoint that asks you everytime for confirmation when a program
> >> tries to run and make changes to the system.
>
> >> Hope this helps,
> >> Shawn
>
> >> --
> >> brink
>
> >> "Practice makes perfect, then you reinstall"
> >> Vista 64 Home Premium
> >> 1.5 Gig DDR2 533 Mhz (PC4200) RAM