1

Why should I run as administrator every time when I use cmd or powershell? What does it do? Does it just give you more permission than the normal cmd that does not run as administrator?

5
  • 3
    its a good bit more complicated than that, but to sum it up yes, you can think about it that way it you want to. and you shouldn't run a shell or other executable as admin unless you actually have reason to. is there a reason you are asking? Oct 26, 2022 at 1:01
  • @FrankThomas I watched Youtube channels, and they said so. Oct 26, 2022 at 1:09
  • 3
    "Why should I use 'run as administrator' every time..." is the same category as "why should I never use a firewall or anti-virus". Very bad advice. Run only as admin, when it's a) absolutely necessary AND b) you know what you do / the program to be executed does. (btw: I watched youtube channels that said to cut the wires of my in-ear headphones to turn them into airpods...)
    – Stephan
    Oct 29, 2022 at 6:07
  • 1
    It sounds like you are not familiar with roles and users in security. You should have a good reason to run things as "administrator." Most things you do will be user level, i.e. based on what your login allows. But there are some things (like accessing system files, etc.) that require extra permissions. Only then should you switch to admin role, i.e. run as administrator. Anyone who says you should always run as administrator is guiding you in the wrong direction.
    – rfportilla
    Oct 31, 2022 at 17:18
  • Could you share some of the videos for context? Might be good to comment there, too.
    – cachius
    Nov 4, 2022 at 14:00

4 Answers 4

4
+50

Why should I run as administrator every time when I use cmd or powershell?

You really should not.

Why does one need Admin rights at all? To change certain system settings and to access/edit certain files. Or, to take it very literally: To perform administrative tasks. This is, by definition, not what you normally do on your PC.

Let’s say you want to change your computer’s IP address on the local network. This requires Admin rights. Or maybe you want to add a new user account to your PC. So yes, it does give you more permissions. A lot more.

On the other hand, opening and editing a Word document, then printing it, does not require Admin rights. There are even some operations that should never be performed with Admin rights, like browsing the web. The separation of rights is a critical security feature.

When you use the Windows graphical user interface, requesting and getting Admin rights (elevated permissions) is often intuitive and you’ll be prompted when needed. On the command line, this is different. Take a look at this example:

C:\Users\Daniel>netsh interface ipv4 set address "Wi-Fi" static 10.0.0.9 255.255.255.0 10.0.0.1
The requested operation requires elevation (Run as administrator).

I couldn’t change the Wi-Fi adapter’s IP address! Instead of prompting for elevation, the operation simply failed. I would have to re-launch Command Prompt as Admin myself to actually do this. The elevated Command Prompt would then run what I type in elevated, like netsh in this example. With PowerShell it’s also important that many operations are performed by the shell itself rather than a dedicated program like netsh.

This is why sometimes you need to launch PowerShell or Command Prompt as Admin.


The rule of thumb is that you would never run something as Admin unless you determined it’s absolutely necessary. You should be especially suspicious of downloaded software and copy-pasted snippets for PowerShell or Command Prompt. In the worst case, they could destroy your system and your data.

1

However an App runs (Command Line or GUI) if it runs as a standard user, there is normally no value in running an Administrator.

If such an app needs to do something requiring admin credentials, there usually is a button to click or a command line parameter to request admin credentials.

Tree Size comes to mind: Standard user does most things, but Tree Size Admin is used for advanced Tree Size options.

If an app will not run in standard mode, then you must run as Administrator.

There are nuances, but these are the three main ways to run an App

This all applies when running in a Command Line or in Power Shell.

1

Yes, put simply, it does just give the program more permission.

You should not always run cmd or PowerShell this way. A program should only have as many privileges as they need to complete a legitimate task. This is the Principle of Least Privilege. The reason for this which is most apparent to users is security: you wouldn't want malware to have administrator privileges, for example.

So if you do need to run a command from cmd or PowerShell with more privileges (and you know it is safe to do so), it's better to open a new window as administrator for that command and use a standard cmd or PowerShell for everything else. That's pretty annoying though which is why things like runAs and gsudo exist.

0

Every object comes with an Access Control List, or the equivalent. The ACL determines whether a would be operator has the privilege of doing something with an operand based on the identity of the operator. Administrator is one such identity, and the Administrator can do just about any operation on just about any object. This can be dangerous as well as beneficial.

For example, supposing a user mistakenly specifies that all files in disk C are to be deleted, in all the folders. If the user is an ordinary user, that task will quickly generate an error, and stop before doing any damage. But is the process is running as an administrator, the chances are it will just go ahead and delete all the files on drive C:. The cost of replacing all those files, assuming that it's possible, could be much much larger than the cost of buying a new computer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.