Vista Home Premium and Administrator

[Guest]

I am the Administrator on my computer, yet Vista will not let me uninstall
or install certain programs.
Even if I right click and select run as administrator, it still does not work.
Again, this is not on all programs.

I have a few games that I downloaded and cannot uninstall from control
panel, even if I right click and run as Administrator. This is very annoying.
I am the sole user of this computer and I have no control as I did with XP.

I tried several ideas from other forums and nothing worked.

I just tried to uninstall Itunes and it said:

"The system administrator has set policies to prevent this installation".
"You do not have sufficient access to unistall iTunes. Please contact your
system administrator".

I AM THE SYSTEM ADMINISTRATOR and what policies are they talking about?
I never set anything.
If these policies exist, how do I change them?

 

[Mike Brannigan]

I am the Administrator on my computer, yet Vista will not let me uninstall
or install certain programs.
Even if I right click and select run as administrator, it still does not
work.
Again, this is not on all programs.

I have a few games that I downloaded and cannot uninstall from control
panel, even if I right click and run as Administrator. This is very
annoying.
I am the sole user of this computer and I have no control as I did with
XP.

I tried several ideas from other forums and nothing worked.

I just tried to uninstall Itunes and it said:

"The system administrator has set policies to prevent this installation".
"You do not have sufficient access to unistall iTunes. Please contact your
system administrator".

I AM THE SYSTEM ADMINISTRATOR and what policies are they talking about?
I never set anything.
If these policies exist, how do I change them?

Are you actually logging on with the default automatically created
Administrator account or just an account that you created and have made a
member of the administrators group ?
There is a big distinction between the 2 as the real Administrator account
is not subject to the same degree of restrictions an admin account (even one
that is a member of the administrators group) is subject to.

 

[Guest]

Are you actually logging on with the default automatically created
Administrator account or just an account that you created and have made a
member of the administrators group ?
There is a big distinction between the 2 as the real Administrator account
is not subject to the same degree of restrictions an admin account (even one
that is a member of the administrators group) is subject to.

What do you mean?
When I upgraded from Windows XP SP2 to Vista Premium Home, I created an
account for myself, my husband (never uses it) and a guest.
I created them all as Administrators.
What default administrator are you talking about?
I only see my 3 accounts.

 

[Mike Brannigan]

What do you mean?
When I upgraded from Windows XP SP2 to Vista Premium Home, I created an
account for myself, my husband (never uses it) and a guest.
I created them all as Administrators.
What default administrator are you talking about?
I only see my 3 accounts.

Indeed so you have your 2 accounts and you have made then administrative
accounts (this makes them members of the the Administrators local group),
BUT the newer more secure model within Vista even has these account
restricted to help prevent you doing something untoward or if you accidently
run piece of ,malicious code or virus you may still have a chance to
prevent catastrophic damage.
There is a hidden account actually called Administrator.
Ideally you should learn a little more about the new security before you
consider using this Administrator account.
However if you wish to enable it then open an administrative command prompt
the, run the following command:

net user administrator /active:yes

 

[Lindsay Graham]

This earlier complaint from The Cat's Meow and the reply from Mike Brannigan
echo my concerns very closely. I'm getting increasingly annoyed at the
restrictions that Vista places places on us -- why, oh, why will Microsoft
not allow those who are prepared to take the risk to do as they will,
instead of having any number of (often meaningless) restrictions placed upon
us.

Like Cat's Meow, I'm the only user of my computer and I want to be able to
access all parts of the hard drive. For example, I want to look at the
Documents and Settings folder, but Vista tells me that access is denied!!

Questions for Mike and anybody else who'd like to respond:
1. Where do I learn about the new security that Mike suggests we study
before using the Administrator account?
2. What is so different or so new that deserves all these restrictions, or
is just that Microsoft thinks that we're all new users who need to be
protected from themselves?
3. How do I log on as Administrator? The command below seems to do nothing
for me.
4. Can I log on as Administrator and then always use that account? (ie, so
that I always have complete control over my computer)

Look forward to your help.

Lindsay Graham
Canberra, Australia

 

[Ronnie Vernon MVP]

Lindsay

One thing that you need to understand is with the proliferation of Viruses
in recent years combined with the proliferation of Broadband every computer
user has a responsibility to do everything possible to protect their system.
The first action a virus will perform is to send itself to everyone in your
address book. It will then use your internet connection to 'broadcast'
itself to other unsuspecting victims who are connected to the internet.

The days are long gone when someone can state that "It's my computer and I'm
willing to take the risk".

Go to Google and search for "Blaster Worm" and you'll see what I'm talking
about.

Security : Inside Windows Vista User Account Control -- TechNet Magazine,
June 2007:
http://www.microsoft.com/technet/technetmag/issues/2007/06/uac/default.aspx

The changes to the built-in administrator account in Windows Vista:
http://support.microsoft.com/kb/942956

The administrator account does not appear on the Windows Vista Welcome
screen:
http://support.microsoft.com/kb/926183

Vista Changes:
http://windowshelp.microsoft.com/windows/en-us/search.aspx?=&qu=built-in+administrator

--

Ronnie Vernon
Microsoft MVP
Windows Shell/User

This earlier complaint from The Cat's Meow and the reply from Mike
Brannigan echo my concerns very closely. I'm getting increasingly annoyed
at the restrictions that Vista places places on us -- why, oh, why will
Microsoft not allow those who are prepared to take the risk to do as they
will, instead of having any number of (often meaningless) restrictions
placed upon us.

Like Cat's Meow, I'm the only user of my computer and I want to be able to
access all parts of the hard drive. For example, I want to look at the
Documents and Settings folder, but Vista tells me that access is denied!!

Questions for Mike and anybody else who'd like to respond:
1. Where do I learn about the new security that Mike suggests we study
before using the Administrator account?
2. What is so different or so new that deserves all these restrictions,
or is just that Microsoft thinks that we're all new users who need to be
protected from themselves?
3. How do I log on as Administrator? The command below seems to do
nothing for me.
4. Can I log on as Administrator and then always use that account? (ie,
so that I always have complete control over my computer)

Look forward to your help.

Lindsay Graham
Canberra, Australia

 

[Ronnie Vernon MVP]

Azulyn

OK, plain language.

The first concept that you need to understand is that Windows is not just
another software program, it's an operating system. It's what enables all of
the software and hardware on the computer perform the way it was designed to
perform. In your profession, you can equate this with the controls that
allow your rotary aircraft to perform the way it was designed. Just like
your aircraft controls have rules that must be followed when you operate
them an operating system also has rules that must be followed. If you
violate those rules you crash your aircraft or you crash your computer. If
you get a new aircraft, with a different set of controls, you must learn new
ways of doing things. It's the same way with a computer and a new operating
system.

You can bypass most of the security options in Vista by using the built-in
administrator account. The problem with this is that the security model in
Vista is multi-layered. In other words, if you break one component of this
security model, most of the other parts are also broken, since they depend
on UAC.

Some of these components are:

User Account Control (UAC). This component notifies you if a program you
start is trying to gain systemwide, unrestricted access to every part of the
operating system. If it does this, UAC will ask for your permission before
allowing the program to gain this access.

File Virtualization (Data Redirection). This component provides
compatibility for older programs and by enabling legacy applications to run
in non-administrator accounts. It automatically creates copies of files that
an application can use when it does not have permission to access the
original files that are contained in a restricted folder such as Program
Files.

Registry Virtualization. (Registry Redirection) Similar to file
virtualization except that a program that tries to write to a global,
restricted part of the Registry, such as the HKEY LOCAL MACHINE, system
section of the registry is redirected to the HKEY CURRENT USER, users
section of the registry.

(If you have already installed some older programs, these programs may stop
working, or not work properly, because their configuration files and
settings have already been virtualized.)

Internet Explorer Protected Mode. You will not be able to use IE in
protected mode while you are logged on with this account.

Even when you are using the built-in administrator account, you may still
encounter some access denied messages when accessing certain files or
folders. This is due to the permissions (another part of the security model)
on some files and folders.

All I and many others want to do is delete some files, or upgrade a
program.<

You can delete any files you wish as long as they belong to the user account
that you are using to log onto the system. If they belong to the system,
another user account, or they are located in a restricted section of the
file structure, such as C:, C:\Program Files, or C:\Windows, then you will
need to take ownership of the file and then change the permissions for that
file before you can delete it.

If you are having a problem upgrading a program, then there can be several
causes of the upgrade failing. It is an older program that is not completely
compatible with Vista, you need to elevate the installation file with admin
privileges, or the upgrade file has been corrupted.

There are several ways that you can enable the built-in administrator
account, depending on which version of Vista you are using. I urge you to
NOT use this account for your everyday account. Remember the reasons that I
already described.

1. All Versions. Go to Start/All Programs/Accessories. Right click the
'Command Prompt' item and select 'Run As Administrator'. In the command
window, type the following:

net user administrator /active:yes

(Be sure to type the command exactly as shown, including the spaces and
colon)

Press Enter.

You should see 'the command completed successfully'.

2. Business or Ultimate versions. Press WINKEY+R to open the Run Box.
Type control userpasswords2 in the Open box and click OK.
Click the Advanced Tab in the User Accounts dialog.
Click the Advanced Button.
In the lusrmgr dialog, click Users, in the left column.
Right click Administrator in the center section and click the Properties
item.
Remove the check mark from the 'Account is disabled' option.
Click Apply/OK.

Reboot the computer.

The administrator account should appear on the login screen. This account
does not have a password associated with it, by default. You should set a
password for the account in Control Panel/User Accounts.

 

[Lindsay Graham]

Thanks for these helpful explanations, Ronnie. However, I still have
problems -- rather than once again complain about the strait-jacket that
Microsoft forces us into, let me ask some specific questions:

1. You say that to delete system files or files that belong to another user
account, 'you will need to take ownership of the file and then change the
permissions for that file before you can delete it'. How do I 'take
ownership of the file'? Can I take ownership of a folder and all the files
in it?

2. More specifically, how do I access (and add files to or delete files in)
the Documents and Settings folder? In a user account, Vista will not let me
share this folder. In the b-in Administrator account, I cannot see the D&S
folder at all. How do I get around these barriers?

3. To be more specific again, I want to delete a user account, but move its
files elsewhere before I delete it. How do I get around Vista's barriers to
enable me to do that?

4. You also say 'I urge you NOT to use this account [ie, the built-in
Administrator account]. Remember the reasons that I already described.'
I've read and re-read your 2 posts, and the only reason that I can see for
not using the built-in Administrator account is that I would not be able to
use IE in protected mode. What other reasons are you referring to?

Hope you (or others) can help.

Lindsay Graham
Canberra, Australia

 

[Ronnie Vernon MVP]

Dushyantsr

Parental Controls are designed to restrict a standard user depending on the
way the restrictions are set by the administrator of the system. The only
way to bypass these restrictions is to have the administrator give you
permission. They are working the way they were designed.

 

[Ronnie Vernon MVP]

Lindsay

Sorry for the late reply. Answers in-line.

1. You say that to delete system files or files that belong to another
user account, 'you will need to take ownership of the file and then change
the permissions for that file before you can delete it'. How do I 'take
ownership of the file'? Can I take ownership of a folder and all the
files in it?

You can still delete these files, but you must take ownership and change
permissions on each individual file before you can do this.

First, take ownership:

Right click the file and select Properties.
Select the Security Tab.
Click the Advanced Button.
Click the Owner Tab.
Click the Edit Button.
In the 'Change owner" section, select your administrator account.
Click Apply, click OK twice.
This will return you to the Security Tab view.

Next change the permissions:

Select your administrator account in the 'Group or user names' section.
Click the Edit Button.
Select your administrator account again.
Place a check mark in the Full Control check box.
Click OK twice.

You can now right click and delete the file.

Throughout this process, you will get several permission prompts.

Before you ask, yes this process is long and complicated, but this is
necessary to maintain the integrity of the system.

2. More specifically, how do I access (and add files to or delete files
in) the Documents and Settings folder? In a user account, Vista will not
let me share this folder. In the b-in Administrator account, I cannot see
the D&S folder at all. How do I get around these barriers?

The 'Documents and Settings' folder no longer exists in Vista. What you see
in some accounts is a 'Junction' called Documents and Settings. This folder
is designed for older installation programs that are hard coded to look for
the D&S. When these programs look for the D&S folder, the 'Junction' will
silently re-direct them to the C:\Users folder. You can find more detailed
information on junction points on the following website.

Svrops.com - Windows Vista Junction Points:
http://svrops.com/svrops/articles/jpoints.htm

3. To be more specific again, I want to delete a user account, but move
its files elsewhere before I delete it. How do I get around Vista's
barriers to enable me to do that?

The easiest way to do this is to use the Built-In Admin account.

4. You also say 'I urge you NOT to use this account [ie, the built-in
Administrator account]. Remember the reasons that I already described.'
I've read and re-read your 2 posts, and the only reason that I can see for
not using the built-in Administrator account is that I would not be able
to use IE in protected mode. What other reasons are you referring to?

Almost all of the new security components in Vista are disabled or bypassed
when you use the built-in admin account. Using this account, as your
everyday account, will take you back to the level of security that you had
in XP. Malicous programs that infect the system will be able to operate in
complete silence without you even being aware of them. This accouint is
designed to be a 'safety net' in case something happens to your normal
administrator account. If you are using the built-in account and something
happens to cause corruption, you have no way to recover, except a full
reinstall of Vista or a reinstall from a full back-up.

Besides IE Protected Mode, you will also lose File and Registry
Virtualization as well as most of the compatibility for legacy programs. If
you have already installed programs using a normal admin account, it's
likely that these programs will lose any program specific configuration
settings and they may even need to be reinstalled. If you still use other
standard or normal admin accounts on the system you will also see many more
prompts for admin privileges when using these accounts.