Run as Administrator under a Standard User with UAC disabled.

[ericfournier4]

I am unsure of the expected behaviour when choosing "Run as
administrator" on a standard user with UAC disabled. At first I
thought that I would get an UAC prompt anyway, but that didn't happen.
Instead, it seems to silently run as a standard user, without ever
notifying me that the "Run as administrator" part failed. In that
case, why would the "Run as Administrator" option be there in the
first place?

 

[ericfournier4]

So, a standard user, without administrative privilege, can run
applications as an administrator... Without ever getting a prompt for
an admin password? Doesn't that defeat the purpose of having a non-
admin account in the first place?

 

[Jimmy Brush]

Hello,

To answer your question,

Run As Administrator is tied into UAC to perform elevation from both
admin accounts and non-admin accounts, so it doesn't work when UAC is
disabled.

As a workaround, you can use the runas command-line tool to run
programs under alternate credentials.

To go into some more detail about UAC,

Programs cannot be "elevated" from inside a standard user account
without asking you for the credentials of an administrator.

When logged in as a standard user, "elevation" is simply running a
program under the credentials of an administrative user, just like one
may have done in Windows XP, but with some extra security goodness
thrown in to help protect these elevated programs from attack.

When logged in as an administrator, elevation is simply allowing the
program to run with the full rights of whatever administrator is
logged in.

Apps that don't run elevated inside of an administrator account are
"filtered" so that they can only use "standard user" privileges.

In the context of an administrator account, both elevated and
non-elevated programs are running inside of the currently logged in
administrator's account. UAC does not actually change the privielges
assigned to administrator accounts, it just filters these privileges
down for non-elevated apps. Administrator accounts are still
administrator accounts (there is no seperate or hidden "root
administrator" account being used to make this hapen).


- JB
Microsoft MVP - Windows Shell

 

[ericfournier4]

Thank you! This does answer my question, and is the behaviour I had
come to expect. It's just a shame that the "Run as administrator" menu
item is still present, and fails without any warning whatsoever,
though it does somewhat follows MS' own guidelines of not trying to
filter out UI elements through admin/UAC checks.