I want to have a folder with access privilegs for all members of Administators group without running in highest privilege mode / UAC elevation.

If I just add "Administrators" in ACL, this does not work. Details can be found here: File permissions "Administrators: Full Control". Why isn't it always sufficient?

  • Running accessing processes in elevated mode (or disabling UAC) is no option.

  • Manually adding every member of Administrators to ACL (as Windows Explorer does when confirming dialog) is no option, either.

I could create my own "CustomAdministrators" group and add all members of Administrators there, but this is a maintenance problem.

Is there some other option (e.g. another built-in SID)?

  • Changing folder ACLs needs elevated permission. This is ok. I want to allow read privilege on one folder for all admins (members of Administrators) without the need for privilege elevation. So I would like to use Administrators group the same way I can use other groups (e.g. Users) -- or something similar working. – stb Sep 25 '17 at 20:04
  • @Ramhound: I think you are wrong. Test it or have a look at the superuser question I linked above. If you have privileges set for Administrators group you (as a member) will not have direct access. Windows explorer will give you an option to elevate and add your personal account to ACLs. An elevated process will have access, a non-elevated one won't. You can test this with cmd.exe. – stb Sep 25 '17 at 21:52
  • Alright, I withdraw my comments, good luck. I can no longer help you – Ramhound Sep 25 '17 at 21:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.