30

What is the difference between "Run as Administrator" and "Run (As Admin!)"?

enter image description here

  • 18
    If you find out what this was, an update could be nice! – Nat Mar 1 at 11:41
  • 1
    Does that appear in the context menus of all executables, or just one particular program? – Boluc Papuccuoglu Mar 2 at 7:11
  • 1
    Oh, my mistake. I'm behind a work firewall which strips out imgur links, so I didn't see it! – Chris Melville Mar 2 at 13:26
  • @BolucPapuccuoglu, all executables. – Harshal Parekh Mar 2 at 15:57
  • Go to each one path, and send to virustotal.com to check for viruses. – It Wasn't Me May 19 at 2:46
109

"Run as administrator" appears to be a normal Windows 10 context menu entry.

"Run (As Admin!)" is very much not a normal entry - Microsoft does not use exclamation points in commands like that. Whatever it is, it's third party, and I would suggest you don't use it. It's entirely possible it's meant to steal account credentials. You should scour your system, figure out where it came from, and get rid of it if you can't verify it is benign.

| improve this answer | |
  • 18
    Indeed, even without prior knowledge of this context menu, it is obvious from the highly unexpected exclamation mark that this isn't a native Windows menu item. In addition, the capitalization also violates the Microsoft Windows user interface guidelines, since menu items should use sentence-style capitalization, not title-style capitalization (like in the title bar). – Andreas Rejbrand Feb 29 at 19:28
  • 5
    You may be able to find what program added the context entry by searching for "As Admin!" in regedit. – MooseBoys Mar 1 at 5:23
  • As a side-not, exclamation-mark (!) is/was sometimes used in menu-bar/menus to show that the entry was an action, and wouldn't, for example, open a menu. One example was the "Run!" entry in the menu-bar of old Borland C++ (for DOS) - this ran the program directly, while the other entries opened (drop-down) menus and dialogues. BTW, similarly in menus, an arrow (>) denoted a sub-menu, while an eclipse (...) denoted a dialogue. – Baard Kopperud Mar 1 at 16:03
  • 17
    @BaardKopperud: But that practice has not been part of the Windows UI guidelines for at least 25-30 years. It is highly unexpected in this world. – Andreas Rejbrand Mar 1 at 16:12
37

What is the difference between Run as Administrator vs Run (As Admin!)?

  • You need to check the Windows registry entries to find out what Run (as Admin!) and what it does by checking the command line you have there.

Look in these keys.

HKEY_CLASSES_ROOT\Directory\shell\
HKEY_CLASSES_ROOT\Directory\shell\runas\

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\Run

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\ContextMenus\
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\background\shell\

HKEY_CURRENT_USER\SOFTWARE\Classes\Directory\Background\shell\
HKEY_CURRENT_USER\SOFTWARE\Classes\Applications\

Call some support to remove/delete this key, do not try by your self, learn first how to backup/restore windows register before try to learn how to delete anything...

Save this code below as query_reg.cmd and run it; this will make a query on each key (also sub keys),

Thus, it will be possible to compare the commands / values ​​of the normal / standard Windows entry and this strange one in its context menu.

@echo off 

cd.>"%temp%\cmd_from_keys.log"

for %%k in ("HKCR\Directory\shell","HKCR\Directory\shell\runas","HKLM\SOFTWARE\Classes\*",^
    "HKLM\SOFTWARE\Classes\Directory","HKCU\SOFTWARE\Classes\Applications") do echo/%%~k && (
            for /f tokens^=* %%i in ('%__APPDIR__%reg.exe query %%k /s /f "Admin"') do (
               echo/%%i >>"%temp%\cmd_from_keys.log" && echo/%%i
               ))
start "Reg Querys" notepad.exe "%temp%\cmd_from_keys.log"
| improve this answer | |
  • 14
    Using Autoruns from Sysinternals is a nice GUI tool to do what's been outlined here. – user2064000 Feb 29 at 15:57
  • 4
    @ItWasn'tMe It wasn't you who broke the startup of that computer over there by editing the registry? – CausingUnderflowsEverywhere Feb 29 at 16:44
  • 4
    @ItWasn'tMe So it was you. I think you need a new name! :) – CausingUnderflowsEverywhere Feb 29 at 16:57
  • 4
    @CausingUnderflowsEverywhere Let's agree not to tell anyone, okay? I did this on my computer with my computer!! – It Wasn't Me Feb 29 at 16:59
  • 6
    Luckily when I was learning how to use autoruns, I had windows XP so all it took was pressing F8 during startup to choose "last restore point" to rollback my changes. Wish windows was still so easy to use. – CausingUnderflowsEverywhere Feb 29 at 17:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.