I want to have a folder with access privilegs for all members of Administators group without running in highest privilege mode / UAC elevation.
If I just add "Administrators" in ACL, this does not work. Details can be found here: File permissions "Administrators: Full Control". Why isn't it always sufficient?
Running accessing processes in elevated mode (or disabling UAC) is no option.
Manually adding every member of Administrators to ACL (as Windows Explorer does when confirming dialog) is no option, either.
I could create my own "CustomAdministrators" group and add all members of Administrators there, but this is a maintenance problem.
Is there some other option (e.g. another built-in SID)?