Standard user - start Explorer as Admin doesn't work

[David Hearn]

I have 2 users on my Vista RTM box - 1 Admin, 1 Standard.

Admin user can type Explorer into the search/run box, right click on
Windows Explorer and select Start as Administrator. UAC pops up, I
click OK and it starts as expected.

When I try the same steps using the Standard user, I get the same menu
options, UAC pops up asking for the password of the Admin user (as
expected), but when I enter it, nothing happens. Disk accesses for a
bit and then nothing. Explorer doesn't appear and no error is displayed.

I tried to start Cmd from Standard user in same way - that worked fine,
but when I type 'start Explorer' or 'start c:\' neither do anything
(except trigger disk access). No errors displayed nothing. If I do
'start calc' it works fine.

I can do other UAC stuff as this Standard user (eg. I modified the page
file settings via Control Panel using it, and password was requested,
entered and worked fine).

Any idea why a Standard user cannot start Explorer as an Admin?

Thanks

David

 

[David Hearn]

But why, when doing it as an Admin user after accepting UAC, does it
display a new Explorer window (no idea what privs it has) - but as a
Standard user, after handling UAC, nothing appears.

It just seems inconsistent - I'm not disputing the 'unable to get
elevated Explorer' statement.

Thanks

D

 

[David Hearn]

Okay - thanks. I'll just accept it as an oddity.

Thanks again,

David

 

[Lionel Fourquaux]

I think it's mostly a side effect of a previous implementation decision:
explorer was supposed to be (mainly) a single-process program which creates
a new window whenever it is started. Basically, it checks for another
explorer running in the same session and asks it to open a new window.

When you try to start it as Administrator, it does the same thing, and since
you already have an explorer instance in your session, you get another
non-privileged explorer window.

You might ask why this wasn't changed. Well, I don't know. Maybe it's a
matter of deadlines and it will be fixed in the future. One could also point
out that explorer is a quite complex program, possibly with many plugins,
and thus has a lot of room for vulnerabilities. The current design (per-task
elevation) looks safer.

If you hit so many elevation prompts that you want to run explorer as Admin,
maybe you should consider changing the permissions for the duration of the
task, to grant your account full access.