10

I am profoundly annoyed by UAC and switch it off for my admin user wherever I can. Yet, there are situations where I can't - especially if those are machines not under my continuous administration.

In this case, I am always challenged with the task of traversing directories using my administrative user via the Windows Explorer where regular users do not have "read" permissions. The possible two approaches to this problem so far:

  1. change the ACLs to the directory in question to include my user (Windows conveniently offers the Continue button in the "You don't currently have permissions to access this folder" dialog. This obviously sucks since more often than not I do not want to change ACLs but just look into the folder's contents

  2. use an elevated cmd.exe prompt along with a bunch of command line utilities - this usually takes a lot of time when browsing through large and / or complex directory structures

What I would love to see would be a way to run Windows Explorer in elevated mode. I have yet to find out how to do so. But other suggestions solving this problem in an unobtrusive way without changing the entire system's configuration (and preferably without the need for downloading / installing anything) are very welcome, too.

I have seen this post with a suggestion for altering HKCR - interesting, but it changes the behavior for all users, which I am not allowed to do in most situations. Also, some folks have suggested using UNC paths to access the folders - unfortunately this does not work when accessing the same machine (i.e. \\localhost\c$\path) as the "Administrators" group membership is still stripped from the token and a re-authentication (and thus the creation of a new token) would not happen when accessing localhost.

  • 1
    Agree with the frustration. I know of a pre-2012/8 way...see here: kb.cadzow.com.au:15384/cadzow/details.aspx?Print=Y&ID=2343 – TheCleaner Nov 5 '13 at 14:29
  • 1
    @TheCleaner that method still works in 2012, you just need to use task manager to close Explorer. – Scott Chamberlain Nov 5 '13 at 15:49
  • @TheCleaner nice find. Too bad Scott has stolen it and is taking credit for it :) – the-wabbit Nov 6 '13 at 12:40
  • @syneticon-dj - no worries here, I even upvoted his answer. I'm secure in my SFhood. :) – TheCleaner Nov 6 '13 at 14:10
  • 1
    Perhaps I'm missing something but why would anyone want to disable UAC? MS have finally added a level of protection to the system that makes it as secure as other OSes which is pretty unintrusive. Maybe I just use Windows differently but it's rare to get a UAC prompt if I'm not installing anything, and if I do, it's a single click. In exchange, I get an assurance that malware can't do anything serious unless I approve a UAC prompt I wasn't expecting. Do you think that malware won't ever target you? Do you not care? Or am I missing something obvious? – Basic Aug 24 '14 at 0:09
11

PRE-2012/8

(images and original idea from http://kb.cadzow.com.au:15384/cadzow/details.aspx?Print=Y&ID=2343)

1. Open an administrative command prompt.
2. Ctrl+Shift+Rt-click on Shutdown in the start menu.

enter image description here

3. Choose Exit Explorer
4. type explorer in the elevated command prompt and press enter.

Explorer is now running in the elevated context that the elevated command prompt had.


2012/8

1. Open an administrative command prompt.
2. Start the task manager and expand out More details
3. Rt-click Windows Explorer and choose End task
4. Type in explorer in to the elevated command prompt and press enter.

Explorer is now running in the elevated context that the elevated command prompt had.


Take note, once you do this you may have a hard time not running a program elevated. Any program you double click or open via file association will also run elevated.


Caveat

If Explorer is set to "Launch folder windows in a separate process" (Folder Options > View), the folder windows will not be elevated even though the main explorer process is. Workaround is to disable this option so that all folder windows are part of the elevated explorer process.

  • 1
    The latter method indeed works on 2008 and up - nice. Certainly will speed me up when doing work on foreign machines. – the-wabbit Nov 6 '13 at 12:38
  • 1
    i. LOVE. this. Any way to make this happen from boot? – Will Dec 22 '14 at 20:09
  • Sadly, these options appear to no longer work in Server 2016. Anyone found a new method? – Ryan Bolger Nov 30 '17 at 20:06
7

I don't think it is a good idea to turn off UAC or run the whole Windows Explorer shell in elevated mode.

Instead think about using a different tool to do your file management. I think Explorer is not a good tool to do serious work with many files anyways. A program with two panes side by side is much better suited for this.

There are many Explorer-replacement tools out there, some free, some commercial. All of them can be run elevated so permissions are no longer a problem. You may even want to use two different ones. One for normal usage, one for elevated administrative usage.

Also many of them run portable, so you don't need to install them, just copy a few files over and run it.

I'm not making a recommendation for a particular tool, that's a different question

  • for me, turning off UAC or continuously running in an elevated shell would be exactly what I need to have. Most management consoles break without elevation too - having them covered is a nice gimmick. I know about the various commanders out there, but I really like the "out-of-the-box" character of Scott's answer as I would not need to have anything but my hands at the keyboard for it to work. – the-wabbit Nov 6 '13 at 12:43
2

This was frustrating for me as well until I studied up on why UAC interrupts my traversal of folders that I have inherent access to as an administrator. There is a solution:

  1. Leave UAC on
  2. In your folder ACLs, add an ACE that gives the security principle "INTERACTIVE" the permissions to traverse folders and list folder contents.

If you add that to the folder ACLs, your admins will be able to browse the folder structure without getting hit with a UAC prompt.

2

This appears to be by design. See this thread for more information:

http://social.technet.microsoft.com/Forums/windows/en-US/1798a1a7-bd2e-4e42-8e98-0bc715e7f641/

According to poster Andre.Ziegler in that thread:

As I already told you Windows 7 Explorer uses a DCOM based start methode [sic] which prevents you from running windows explorer elevated.

One solution is to use the Explorer++ freeware file manager. Explorer++ has an option to show the current privilege level in its title bar, so you can easily see whether it is running elevated.

Another solution is to use Nomad.NET, another nice freeware file manager based on .NET.

1

Use an elevated PowerShell ISE instance. The File dialog it provides is itself elevated, giving you the ability to traverse directories.

1

I ran into this issue RDPing into servers to do stuff on them.

For me it is a case of don't do that. I can access the files from explorer on my home system and it gives me full access.

\\remote.com\c$ Gets me to the stuff I want as an administrator without restriction.

The remaining issue is that you are transferring files between systems while working on them, but for small files. I don't care.

-Larry

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.