Run as administrator needed for IE8 workaround but user is in Administrators group

Question

I'm running IE8 on Windows 7 and logging in under a company domain account (not the machine domain). The domain account is assigned to the machine's administrators group. As a workaround for the issue noted in IE 8 Issues, I discovered that if I started IE8 using "Run as administrator," that the IE8 issue noted go away.

Question: With the login account assigned to the Administrators group, why can't I just start IE8 and already be running "as administrator." Is there something I've overlooked in setting up my domain account in Windows 7 that would eliminate the need to use "Run as administrator?"

On a side note, using "Run as administrator" has also worked around a problem I was having with SQL Server Management Studio 2005.

Answer 1

In Windows 7 (and Vista) you do not run as administrator by default. You have the ability to elevate your privileges as necessary to perform tasks (Run As Administrator). There is extensive information about User Account Control at Understanding and Configuring User Account Control in Windows Vista. It's a bit different in 7, but the concept is the same.

Answer 2

I think you can right-click the IE shortcut and choose properties. On the properties there should be a checkbox that lets you 'Run as administrator'. In this way you don't keep having to explicitly launch it in this way.

Answer 3

Even though the account may be an Administrator, if UAC (User Account Control) is active (and it is by default in both Vista and Windows 7), then the process will not be granted administrator privileges unless you choose to run the process with such privileges via "Run as administrator", as well as confirm the UAC dialog that appears.

If you don't want the hassle of the dialog to confirm administrator privileges, then you could disable UAC and set the shortcut to always start the program as an administrator. However, there are good security reasons to keep UAC enabled.

Answer 4

Firstly, it sounds as if UAC is enabled. For any machine connected to a domain, I would disable UAC - it offers you no real protection in a domain environment. (especially since you probably have a group policy that would overlap in many areas, and users are running as administrator anyways, which defeats the purpose of it wholly and solely.

If you have added the Domain Account to the Local Administrator's Group, then there's no reason that you should not be running at Administrator Level.

I personally find it easier to add a Domain Group to the Local Administrator's Group - for Example, I can add "DOMAIN\Domain Users" to Local Administrators, and that will give all my users logon rights (this is useful when you're having people swap computers).

In short:

• Disable UAC
• Possibly add a group instead of a single user?

You can also hard code the shortcuts using /runas:DOMAIN\Username password (or similar) to get around this issue - but I understand that's probably a pain in the neck.