3

This question has been edited based on necessary clarification as received thru below comments.

I have a simple bat file taken from https://stackoverflow.com/questions/4051883/batch-script-how-to-check-for-admin-rights. It tests if the bat script was invoked as a User by simply double-clicking on it or it was run as ‘Run as Administrator’. I have tested it and it works just fine on my Windows 8.1 Home 64-bit laptop under an administrator level user. When I double-click, it indicates that it’s not been run from an Elevated command prompt and says otherwise when ‘Run as Administrator’.

From the below comments it’s understood that the lowest privilege level for Administrator is a User and selecting ‘Run as Administrator’ elevate it to Administrator.

However on my Windows 7 Ultimate 32-bit it’s not behaving the same way! When I just double click on it, it’s still running as Administrator. Is this a security issue and is there any way to set it to default User level?

In my Control Panel UAC is turned off. Also note that I am not creating/running any shortcut set it to always 'Run as Administrator'

On my Windows 7, I would like it to Run as User when I double-click and only as Admin when ‘Run as Administrator’ is invoked.


Note that the script is out of scope for discussion, however just pasting it below for reference.

@echo off
openfiles > NUL 2>&1 
if NOT %ERRORLEVEL% EQU 0 goto NotAdmin 
echo Hello from elevated command prompt 
goto End 
:NotAdmin 
echo This command prompt is NOT ELEVATED
:End
pause
exit 
4
  • A process launched by a user will by default be at the user's lowest privilege level. This means the lowest privilege of an Administrator would be a user. "Run as Administrator" elevates this privilege to an Administrator
    – Ramhound
    Feb 24, 2017 at 0:26
  • @Ramhound You should add an answer with more detail including the access tokens, integrity levels, and UAC relation to the "run as administrator" option and the security context. Being such the expert you are, this should be relatively simple for you to answer with more detail than the vagueness of your comment. I'll +1 your answer once you add it so just hit me back. I look forward to many more of your great answers; you should answer more often!! Feb 24, 2017 at 1:03
  • @Ramhound, your comment has clarified my understanding and I have edited my post to be more specific with my question. Thanks.
    – patkim
    Feb 24, 2017 at 1:40
  • 1
    Windows 8.1 default UAC behavior is different compared to 7 which is what you have discovered. My original comment was with regards to 8.0+ and I mistakenly missed your reference to running Windows 7. What happens also depends on the manifest for the application in question. Additionally disabling UAC on Windows 7 results in the elevated process permissions and the lowest setting on 8.0+ even when UAC is "disabled" (forcefully) enforces the lowest permissions much to the angry yelling from every user who historically ran every application as an Administrator resulting in 50% of the questions
    – Ramhound
    Feb 24, 2017 at 2:01

1 Answer 1

0

The situation you describe is expected behavior when logged on with the built-in Administrator account, even if you have User Account Control (UAC) enabled.

Starting with Windows Vista (and as of this writing, including Windows 10) in the default configuration, applications run with the built-in Administrator account are executed with full administrative privileges. This is because of the default setting of the "Admin Approval Mode" security policy is Disabled:

The User Account Control: Admin Approval Mode for the built-in Administrator account policy setting controls the behavior of Admin Approval Mode for the built-in Administrator account.

The options are:

  • Enabled. The built-in Administrator account uses Admin Approval Mode. By default, any operation that requires elevation of privilege will prompt the user to approve the operation.

  • Disabled. (Default) The built-in Administrator account runs all applications with full administrative privilege.


How to Change the Admin Approval Mode Setting

If you have the Professional/Business/Enterprise/Ultimate edition of Windows: You can change this setting by editing local Group Policy:

  1. Click Start, type secpol.msc in the Search programs and files box, and then press ENTER.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  3. In the console tree, expand Local Policies, and then click Security Options.

  4. In the details pane, scroll down and double-click the Group Policy setting User Account Control: Admin Approval Mode for the built-in Administrator account

  5. On the Properties page, make your selection, and then click OK.

If you have the Home or Starter edition of Windows: You don't have access to secpol.msc and therefore cannot edit the Local Security Policy. However, this Super User answer points us to another fortunately, still accessible link at askvg.com that explains how to change the setting in the Registry:

  1. Type regedit in RUN or Start Menu search box and press Enter. It'll open Registry Editor. Now go to following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies

  2. Under Policies key look for a key with the name "System". If it's not present then create it by right-click on Policies key and select "New -> Key" and give it name "System".

  3. Now select System key and in right-side pane create a new DWORD value to apply the desired tweak as mentioned in following list:

User Account Control: Admin Approval Mode for the Built-in Administrator account

DWORD Value - FilterAdministratorToken

To Enable - 1
To Disable - 0

1
  • 1
    Thank you for the detailed answer. This helped a lot. Since I have Windows 7 Ultimate, I could directly access secpol.msc. Just a few small changes needed in my case were - In addition to ‘Admin Approval Mode for the built-in Administrator account’ policy I also had to Enable ‘Run all Administrators in Admin Approval mode’ (I suppose because I am a user in Administrator group, not a built in Administrator) and Windows had to be restarted for changes to take effect. Now only when I right click and ‘Run ad Administrator’ that my bat file runs in Admin privileges.
    – patkim
    Feb 24, 2017 at 13:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .