1

I have the following situation on a set of servers (Windows Server 2008 R2):

  • Domain User A (local administrator) launches cmd.exe on server 1. This is as elevated (seen in title Administrator:*)
  • Domain User B (local administrator) launches cmd.exe on server 1. This is as elevated command prompt.
  • Domain User A (local administrator) launches cmd.exe on server 2. This is NOT launched as elevated command prompt.
  • Domain User B (local administrator) launches cmd.exe on server 2. This is NOT launched as elevated command prompt.
    • Builtin administrator launches cmd.exe on server 2. This is as elevated command prompt.

All cmd.exe launches are without prompting. For all command prompt shortcuts the advanced setting for "Run as Administrator" is switched off.

There seems to be a different setting that causes the same effect as the "Run as Administrator" checkbox. I cannot find the setting however (neither in the system nor online). The machines are part of the same domain (and domain policy). It seems to be a machine setting, since for the normal users the behavior is equal. Only the builtin\administrator works differently.

What is the setting?

ps. The setting "Run as administrator" works fine to mimic the behavior, but I would like to understand the situation as I have it.

Things checked (based on comments):

  • What I also see is that if you launch the run dialog it already displays the message "This task will be created with administrative privileges"
  • I have also checked this AppCompatFlags setting, but it has not been set: https://superuser.com/a/697002/1030237
  • Is user A a local account or a domain account? If it is a local account, is it the built-in Administrator account? If you're not sure, run whoami /all and check the SID shown under "User Information"; if it ends in -500 then the user is the built-in Administrator. – Harry Johnston Jun 18 at 19:30
  • No it is a domain account and not builtin administrator. But yes it is a member of the local administrators group – Ben Ootjers Jun 18 at 19:31
  • To help narrow down the exact nature of the unexpected behaviour: is user A's explorer.exe process on server 1 running with elevated privileges? You can use Process Explorer (available from the MS web site) to check this, look on the Security tab to see whether the BUILTIN\Administrators group is flagged as "Owner" (elevated process) or "Deny" (non-elevated process). – Harry Johnston Jun 18 at 21:14
  • @Harry Johnston. Yes that is a difference. Yes User A on server 1 has an elevated explorer.exe as well. On server 2 this is not the case. – Ben Ootjers Jun 19 at 7:46
  • Hmmm. That shouldn't ought to be possible. Could you double-check the state of explorer.exe for user B on server 1? Is BUILTIN\Administrators flagged as "Deny"? Or perhaps not present at all? – Harry Johnston Jun 19 at 7:49
1

While there might be multiple possible causes for command windows being administrative by default, if Explorer is running elevated that is a sure sign that User Account Control has been disabled.

On Windows 7 or Server 2008 R2 this may be because the UAC slider has been set to "Never Notify".

On Windows 10 or Server 2016 the only way to disable UAC that I am aware of is by setting the local security policy option "UAC: Run all administrators in Admin Approval Mode" to Disabled.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.