1

Possible Duplicate:
Why do I need to run commands as administrator if my account is member of administrator group?

Silly question here: why in Windows 7 (and presumably Vista/Server2008) are user accounts that are part of the Administrators group given an option to "Run as Administrator" when running executables, etc? My understanding is that the Administrator group (local administrator) is the highest privledge level already, so what does explicity selecting "Run as Administrator" do. I know I can't perform some actions unless I "Run as Administrator" so this implies that the Administrator group is not by default as powerful as it was in Windows XP?

If an account that is part of the Administrators group does not explicity run a process as Administrator then what privledges does it run under?

I can understand a user with lesser privileges being prompted to run something under a higher privledge using the administrator account/password (this uses the built in Administrator account?) and I understand that UAC prompting Administrators to proceed with actions is valuable, but not getting an Administrator to explicity run things as an Administrator.

Thanks

Improve this question
0

1 Answer 1

Reset to default
5

When you're logged in as an administrator, you have all rights over the OS, but programs you run do not. UAC does this by isolating programs from accessing things they shouldn't, regardless of your access level.

When you click Run as Administrator, the program you are running has un-restricted access to the system and can do virtually anything. Use it with care.

Improve this answer
1
  • This is based on a critically-important philosophy of permissions -- even a person who has a power should not use it unless they intend to. There's no reason every program an administrator runs should have every power an administrator has. (On UNIX systems, you handle this with multiple accounts. On Windows systems, with multiple permission contexts within an account.)
    – David Schwartz
    Jan 17, 2012 at 5:40