Standard user - start Explorer as Admin doesn't work

I have 2 users on my Vista RTM box - 1 Admin, 1 Standard.

Admin user can type Explorer into the search/run box, right click on
Windows Explorer and select Start as Administrator. UAC pops up, I
click OK and it starts as expected.

When I try the same steps using the Standard user, I get the same menu
options, UAC pops up asking for the password of the Admin user (as
expected), but when I enter it, nothing happens. Disk accesses for a
bit and then nothing. Explorer doesn't appear and no error is displayed.

I tried to start Cmd from Standard user in same way - that worked fine,
but when I type 'start Explorer' or 'start c:\' neither do anything
(except trigger disk access). No errors displayed nothing. If I do
'start calc' it works fine.

I can do other UAC stuff as this Standard user (eg. I modified the page
file settings via Control Panel using it, and password was requested,
entered and worked fine).

Any idea why a Standard user cannot start Explorer as an Admin?

Thanks

David

Yep. Explorer is special-cased and can't be run as an admin by anyone. If you
look at a task list you will find that you don't get a new instance of
Explorer at all and that the existing one still has the Administratorseny
ACE in the ACL. The only way to get an elevated Explorer is to turn off UAC.

"David Hearn" wrote:

> I have 2 users on my Vista RTM box - 1 Admin, 1 Standard.
>
> Admin user can type Explorer into the search/run box, right click on
> Windows Explorer and select Start as Administrator. UAC pops up, I
> click OK and it starts as expected.
>
> When I try the same steps using the Standard user, I get the same menu
> options, UAC pops up asking for the password of the Admin user (as
> expected), but when I enter it, nothing happens. Disk accesses for a
> bit and then nothing. Explorer doesn't appear and no error is displayed.
>
> I tried to start Cmd from Standard user in same way - that worked fine,
> but when I type 'start Explorer' or 'start c:\' neither do anything
> (except trigger disk access). No errors displayed nothing. If I do
> 'start calc' it works fine.
>
> I can do other UAC stuff as this Standard user (eg. I modified the page
> file settings via Control Panel using it, and password was requested,
> entered and worked fine).
>
> Any idea why a Standard user cannot start Explorer as an Admin?
>
> Thanks
>
> David
>

But why, when doing it as an Admin user after accepting UAC, does it
display a new Explorer window (no idea what privs it has) - but as a
Standard user, after handling UAC, nothing appears.

It just seems inconsistent - I'm not disputing the 'unable to get
elevated Explorer' statement.

Thanks

D

Jesper wrote:
> Yep. Explorer is special-cased and can't be run as an admin by anyone. If you
> look at a task list you will find that you don't get a new instance of
> Explorer at all and that the existing one still has the Administratorseny
> ACE in the ACL. The only way to get an elevated Explorer is to turn off UAC.
>
> "David Hearn" wrote:
>
>> I have 2 users on my Vista RTM box - 1 Admin, 1 Standard.
>>
>> Admin user can type Explorer into the search/run box, right click on
>> Windows Explorer and select Start as Administrator. UAC pops up, I
>> click OK and it starts as expected.
>>
>> When I try the same steps using the Standard user, I get the same menu
>> options, UAC pops up asking for the password of the Admin user (as
>> expected), but when I enter it, nothing happens. Disk accesses for a
>> bit and then nothing. Explorer doesn't appear and no error is displayed.
>>
>> I tried to start Cmd from Standard user in same way - that worked fine,
>> but when I type 'start Explorer' or 'start c:\' neither do anything
>> (except trigger disk access). No errors displayed nothing. If I do
>> 'start calc' it works fine.
>>
>> I can do other UAC stuff as this Standard user (eg. I modified the page
>> file settings via Control Panel using it, and password was requested,
>> entered and worked fine).
>>
>> Any idea why a Standard user cannot start Explorer as an Admin?
>>
>> Thanks
>>
>> David
>>

I've asked that question too, and I can't get a really good answer to it. Let
me try again. It is inconsistent. It displays a UAC dialog, and then just
pops up a new window on the existing process, without elevating.

"David Hearn" wrote:

> But why, when doing it as an Admin user after accepting UAC, does it
> display a new Explorer window (no idea what privs it has) - but as a
> Standard user, after handling UAC, nothing appears.
>
> It just seems inconsistent - I'm not disputing the 'unable to get
> elevated Explorer' statement.
>
> Thanks
>
> D
>
> Jesper wrote:
> > Yep. Explorer is special-cased and can't be run as an admin by anyone. If you
> > look at a task list you will find that you don't get a new instance of
> > Explorer at all and that the existing one still has the Administratorseny
> > ACE in the ACL. The only way to get an elevated Explorer is to turn off UAC.
> >
> > "David Hearn" wrote:
> >
> >> I have 2 users on my Vista RTM box - 1 Admin, 1 Standard.
> >>
> >> Admin user can type Explorer into the search/run box, right click on
> >> Windows Explorer and select Start as Administrator. UAC pops up, I
> >> click OK and it starts as expected.
> >>
> >> When I try the same steps using the Standard user, I get the same menu
> >> options, UAC pops up asking for the password of the Admin user (as
> >> expected), but when I enter it, nothing happens. Disk accesses for a
> >> bit and then nothing. Explorer doesn't appear and no error is displayed.
> >>
> >> I tried to start Cmd from Standard user in same way - that worked fine,
> >> but when I type 'start Explorer' or 'start c:\' neither do anything
> >> (except trigger disk access). No errors displayed nothing. If I do
> >> 'start calc' it works fine.
> >>
> >> I can do other UAC stuff as this Standard user (eg. I modified the page
> >> file settings via Control Panel using it, and password was requested,
> >> entered and worked fine).
> >>
> >> Any idea why a Standard user cannot start Explorer as an Admin?
> >>
> >> Thanks
> >>
> >> David
> >>
>

Okay - thanks. I'll just accept it as an oddity.

Thanks again,

David

Jesper wrote:
> I've asked that question too, and I can't get a really good answer to it. Let
> me try again. It is inconsistent. It displays a UAC dialog, and then just
> pops up a new window on the existing process, without elevating.
>
> "David Hearn" wrote:
>
>> But why, when doing it as an Admin user after accepting UAC, does it
>> display a new Explorer window (no idea what privs it has) - but as a
>> Standard user, after handling UAC, nothing appears.
>>
>> It just seems inconsistent - I'm not disputing the 'unable to get
>> elevated Explorer' statement.
>>
>> Thanks
>>
>> D
>>
>> Jesper wrote:
>>> Yep. Explorer is special-cased and can't be run as an admin by anyone. If you
>>> look at a task list you will find that you don't get a new instance of
>>> Explorer at all and that the existing one still has the Administratorseny
>>> ACE in the ACL. The only way to get an elevated Explorer is to turn off UAC.
>>>
>>> "David Hearn" wrote:
>>>
>>>> I have 2 users on my Vista RTM box - 1 Admin, 1 Standard.
>>>>
>>>> Admin user can type Explorer into the search/run box, right click on
>>>> Windows Explorer and select Start as Administrator. UAC pops up, I
>>>> click OK and it starts as expected.
>>>>
>>>> When I try the same steps using the Standard user, I get the same menu
>>>> options, UAC pops up asking for the password of the Admin user (as
>>>> expected), but when I enter it, nothing happens. Disk accesses for a
>>>> bit and then nothing. Explorer doesn't appear and no error is displayed.
>>>>
>>>> I tried to start Cmd from Standard user in same way - that worked fine,
>>>> but when I type 'start Explorer' or 'start c:\' neither do anything
>>>> (except trigger disk access). No errors displayed nothing. If I do
>>>> 'start calc' it works fine.
>>>>
>>>> I can do other UAC stuff as this Standard user (eg. I modified the page
>>>> file settings via Control Panel using it, and password was requested,
>>>> entered and worked fine).
>>>>
>>>> Any idea why a Standard user cannot start Explorer as an Admin?
>>>>
>>>> Thanks
>>>>
>>>> David
>>>>

I think it's mostly a side effect of a previous implementation decision:
explorer was supposed to be (mainly) a single-process program which creates
a new window whenever it is started. Basically, it checks for another
explorer running in the same session and asks it to open a new window.

When you try to start it as Administrator, it does the same thing, and since
you already have an explorer instance in your session, you get another
non-privileged explorer window.

You might ask why this wasn't changed. Well, I don't know. Maybe it's a
matter of deadlines and it will be fixed in the future. One could also point
out that explorer is a quite complex program, possibly with many plugins,
and thus has a lot of room for vulnerabilities. The current design (per-task
elevation) looks safer.

If you hit so many elevation prompts that you want to run explorer as Admin,
maybe you should consider changing the permissions for the duration of the
task, to grant your account full access.


"David Hearn" <david.hearn@newsgroup.nospam> wrote in message
news:50g0cbF1fsgicU1@mid.individual.net...
> Okay - thanks. I'll just accept it as an oddity.
>
> Thanks again,
>
> David
>
> Jesper wrote:
>> I've asked that question too, and I can't get a really good answer to it.
>> Let me try again. It is inconsistent. It displays a UAC dialog, and then
>> just pops up a new window on the existing process, without elevating.
>> "David Hearn" wrote:
>>
>>> But why, when doing it as an Admin user after accepting UAC, does it
>>> display a new Explorer window (no idea what privs it has) - but as a
>>> Standard user, after handling UAC, nothing appears.
>>>
>>> It just seems inconsistent - I'm not disputing the 'unable to get
>>> elevated Explorer' statement.
>>>
>>> Thanks
>>>
>>> D
>>>
>>> Jesper wrote:
>>>> Yep. Explorer is special-cased and can't be run as an admin by anyone.
>>>> If you look at a task list you will find that you don't get a new
>>>> instance of Explorer at all and that the existing one still has the
>>>> Administratorseny ACE in the ACL. The only way to get an elevated
>>>> Explorer is to turn off UAC.
>>>>
>>>> "David Hearn" wrote:
>>>>
>>>>> I have 2 users on my Vista RTM box - 1 Admin, 1 Standard.
>>>>>
>>>>> Admin user can type Explorer into the search/run box, right click on
>>>>> Windows Explorer and select Start as Administrator. UAC pops up, I
>>>>> click OK and it starts as expected.
>>>>>
>>>>> When I try the same steps using the Standard user, I get the same menu
>>>>> options, UAC pops up asking for the password of the Admin user (as
>>>>> expected), but when I enter it, nothing happens. Disk accesses for a
>>>>> bit and then nothing. Explorer doesn't appear and no error is
>>>>> displayed.
>>>>>
>>>>> I tried to start Cmd from Standard user in same way - that worked
>>>>> fine, but when I type 'start Explorer' or 'start c:\' neither do
>>>>> anything (except trigger disk access). No errors displayed nothing.
>>>>> If I do 'start calc' it works fine.
>>>>>
>>>>> I can do other UAC stuff as this Standard user (eg. I modified the
>>>>> page file settings via Control Panel using it, and password was
>>>>> requested, entered and worked fine).
>>>>>
>>>>> Any idea why a Standard user cannot start Explorer as an Admin?
>>>>>
>>>>> Thanks
>>>>>
>>>>> David
>>>>>