Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

When i am logged in as an administrator on windows 2008R2 I NEVER EVER WANT permissions to be denied for any access modifications configurations or changes I make EVER. If I delete a printer I want it deleted. PERIOD. I don't care if I'm not its owner. I don't care if I'm not int the print operators group or whatever. Do what I tell you to do and shut up Windows!

I never want to ever encounter any type of access issues ever. Is there a way to force Windows 2008 R2 to act this way? I want full permissions to everything and the entire concept of denying access to be disabled when I am logged in as an administrator.

I can turn off UAC but that doesn't cut it. I need to turn off the whole permissions concept, At least temporarily so I can get stuff done and stop googling obscure registry settings permissions and trying to guess what the problem is.

share|improve this question
2  
This really sounds like a XY Problem, why don't you ask instead about the "obscure registry settings permissions" or even go to the even bigger picture and explain what you are trying to do that required you to change the registry in the first place. –  Scott Chamberlain Dec 29 '13 at 6:54

2 Answers 2

up vote 2 down vote accepted

Booting from a linux CD such partedmagic mounting and accessing the files from there is offers the most amount of flexibility accessing files.

REGISTRY: http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx

PsExec.exe -i -s regedit

This will launch regedit as the system account. Which has more access than the admin account.

These 2 methods will give you easier access to 2 parts of your system. However, security is built in and an unavoidable part of the system.

share|improve this answer
2  
to take this answer one step further, if you closed explorer.exe and did psexec -i -s explorer then windows explorer would be running with SYSTEM level privileges. (Very dangerous and I REALLY do not recommend it, but it is a option.) –  Scott Chamberlain Dec 29 '13 at 6:51
    
I will try this –  GGB667 Dec 29 '13 at 21:15

Can't be done, ACL is integral to Windows and is there for 'your protection'. Plus they made it so 2008 cannot install to FAT32 (avoiding NTFS style ACL's).

Anyways the best alternative for files/folders is the right click take ownership shell extension.

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\*\shell\runas]
@="Take Ownership"
"NoWorkingDirectory"=""

[HKEY_CLASSES_ROOT\*\shell\runas\command]
@="cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant *S-1-5-32-544:F"
"IsolatedCommand"="cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant *S-1-5-32-544:F"

[HKEY_CLASSES_ROOT\Directory\shell\runas]
@="Take Ownership"
"NoWorkingDirectory"=""

[HKEY_CLASSES_ROOT\Directory\shell\runas\command]
@="cmd.exe /c takeown /f \"%1\" /r /d y && icacls \"%1\" /grant *S-1-5-32-544:F /t"
"IsolatedCommand"="cmd.exe /c takeown /f \"%1\" /r /d y && icacls \"%1\" /grant *S-1-5-32-544:F /t" 

But for registry you'll have to learn how to take ownership from powershell. For instance this snip will allow me to delete a LOCKEDKEY.

$key = "registry::HKCU\Software\Microsoft\LOCKEDKEY"

$acl = Get-Acl -Path $key
$permission = 'Administrators','FullControl','ContainerInherit, ObjectInherit','None','Allow'
$accessRule = New-Object System.Security.Accesscontrol.RegistryAccessRule $permission;$acl.SetAccessRule($accessRule)
$acl | Set-Acl -Path $key
Remove-ItemProperty -Path $key

That is the way it works for the past 6 years with TrustedInstaller.

Alternatively you can spawn your regedit or batch scripts via TrustedInstaller token using a third party app like Devxexec.exe. This way you can avoid any permissions changes as TrustedInstaller has access to everything that you do not (and vice versa)

@ECHO OFF

devxexec.exe /user:TrustedInstaller regedit.exe

PAUSE
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.