Hot answers tagged

11

Right, UAC is triggered when a program requests administrator privileges. Such as Explorer, requesting administrator privileges, because that's what the NTFS ACLs on those files and folders require. You have four options I'm aware of. Disable UAC on your servers. I do this anyway (in the general case), and would argue that if you need UAC on a server, ...


11

PRE-2012/8 (images and original idea from http://kb.cadzow.com.au:15384/cadzow/details.aspx?Print=Y&ID=2343) 1. Open an administrative command prompt. 2. Ctrl+Shift+Rt-click on Shutdown in the start menu. 3. Choose Exit Explorer 4. type explorer in the elevated command prompt and press enter. Explorer is now running in the elevated context that ...


11

Start your batch: powershell.exe -Command "Start-Process cmd -Verb RunAs" ... rest of script ... This will open an elevated command prompt Keep in mind for this to work the user would need to have admin privilege on the box. If the user is not a local admin you will have the use the /savecred switch, this is a big security hole as then the user and can ...


9

You mention local users and groups, so setting aside Active Directory. You should always need to re-authenticate in order for the user's security token to contain the new group membership. This typically means you need to re-login. LSASS only hands this token out when the user authenticates, which is usually only at logon but you can do something like C:\&...


7

I don't think it is a good idea to turn off UAC or run the whole Windows Explorer shell in elevated mode. Instead think about using a different tool to do your file management. I think Explorer is not a good tool to do serious work with many files anyways. A program with two panes side by side is much better suited for this. There are many Explorer-...


6

The best way is to define a new group containing members that you consider to be administrators of that folder. If you have an AD domain, you can create this group in AD and then add that group to the Administrators group (of the local machine) and avoid having to administer two groups. Note: If you're trying this locally, remember you have to log off and ...


6

You should map the drive from within your administrative CMD session instead, as it is using a different user context (the one of the administrative user obviously) and thus has no access to the environment of your "regular" user. From http://msdn.microsoft.com/en-us/library/windows/desktop/ms685143(v=vs.85).aspx : Drive letters are not global to the ...


6

You could do it from a command prompt: runas /user:DOMAIN\youraccount "REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"


6

As per one of the comments, your best bet is likely to be using Sysinternals' Process Monitor to see what is being tried and failing due UAC. Download Process Monitor from http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx Run process monitor, run your borked, obsolete, badly coded app, go to process monitor > filter > if Process Name is <...


5

tIn addition to Blue's answer, there are tools for migrating applications to Windows 7. Even though your app says it's Windows 7 compatible, running it through this ringer would tell you what is needed for your app to correctly function with UAC on. You may even be able to create a 'shim' which modifies certain settings when your app runs. I believe the tool ...


5

You also need to disable Admin Approval Mode Disable Admin Approval Mode To disable AAM Start>Run> Type "secpol.msc">hit enter In the interface double click Local Policies> double-click Security Options. Scroll down and double-click User Account Control: Run all administrators in Admin Approval Mode. Select the Disabled option, and then click OK. ...


5

No, there is not. The only real solution is using something other than Windows Explorer for file browsing (and to run it elevated, of course). The problem comes from the fact that explorer.exe is initially launched with a non-administrator access token (in order to display the GUI), and any new sessions, even those launched as an administrator, inherit ...


4

The Built-in Administrator accounts on Windows 7 and 2008 R2 by default run always in privileged mode, while the accounts you create by hand and put in Administrator group don't they run as standard user if UAC and Admin Approval is on and you need to authorize privilege elevation by clicking Yes on the Consent UI or running applications by right clicking ...


4

The solution is to simply manage the server remotely. The UAC filtering of the administrator privileges only applies when you are accessing the local system. With the release of Server Core, Microsoft has been strongly encouraging people to remotely administer servers instead of connecting to them directly to manage them. Of course if you have a really ...


4

Short of rewriting the program, no. Writing to protected areas (including program files) requires elevation, regardless of the NTFS ACLs. Here is a list of actions that trigger UAC.


4

On Windows 7, if UAC is enabled and you open Command Prompt with "Run as Administrator", you won't see the mapped drives either. On Windows 8, you'll notice that even when UAC is disabled, you still have to "Run as Administrator". The reason why Administrator doesn't see the mapped drives is explained in the Technet article you linked. In a nutshell, you ...


4

You can do this by creating two OS-specific GPOs and using WMI filters to assign them to the appropriate machines. One GPO will include the settings for Windows 7, and have a WMI filter that ensures it only applies to machines running Windows 7. Likewise, the second GPO will include the settings for Windows 10, and have a WMI filter that ensures it only ...


3

You can't, natively, using just Cmd.exe. Cmd.exe is from an ancient time long before things like "privilege escalation" were ever contemplated in Windows. Here, have some VBscript. Set objShell = CreateObject("Shell.Application") objShell.ShellExecute "C:\Windows\System32\cmd.exe", "", "", "runas", 1 That "Runas" verb is the trick. However, If you want ...


3

Privilege Elevation yields a logon event, so look after the last occurrences of Event ID 4648 (interactive logon) and 4624 (successful logon attempt) in the Security Log. Otherwise, change the UAC policy back and check what events are generated in the event log - then search for similar events Update: If you have large volumes of event log entries to ...


3

This is a bug that was fixed in a Windows update released in February 2013. Please refer to KB2795944 (archived here). This update package resolves the following issues: Network Drive mappings that are created by using Group Policy Preferences Mapped Drive items do not connect for administrative users. This occurs when the Mapped Drive item is ...


3

Yep, that is UAC. Explorer windows don't really accept admin tokens via UAC.


3

Assuming it's a .NET application, the developer likely embedded a manifest that causes the application to request elevation when run. The manifest is named application.exe.manifest and needs to define the AssemblyName as the name of the program itself, so naturally renaming the .exe file will break the manifest and cause it not to prompt. The workaround is ...


3

Try making him or her a member of the local group: 'Network Configuration Operators'.


3

If you must have a GUI, then the correct way to handle this is to have a GUI app and a separate system service. The service does the actual work, and the GUI just passes commands to it. Impersonation can be used to allow the service to act as the user. If the only reason you need admin access is to write to an HKLM key, then admin access is the wrong way to ...


2

Also you can define an undocumented environmental variable __COMPAT_LAYER. From the cmd.exe command line: set __COMPAT_LAYER=RunAsInvoker mycommand.exe


2

A logon script will run in the current user's context, which will trip UAC. You should use Group Policy Preferences Registry Settings or a Startup Script, which will run as SYSTEM instead. The GPP way is "preferred" in most cases.


2

Sounds like a legacy application. Your best bet is going to be to not over complicate it, and just schedule downtime for updates.


2

There are two options to work around this limitation easily: Use a file manager of your choice (total commander, eg) and run it as administrator (preferred) Disable the explorer UAC restriction: http://www.msfn.org/board/topic/144776-unable-to-open-an-elevated-windows-explorer-window/


2

This is what you need: http://sites.google.com/site/eneerge/home/BatchGotAdmin


2

Unfortunately this problem of inconvenience is not easily solved, as you're really talking about misbehaving software -- not meant for the enterprise environment where workstations are locked down. You will need to choose software that can run without aggressively applying patches, then you can manage the schedule and push them out yourself after having ...


Only top voted, non community-wiki answers of a minimum length are eligible