I know that User Account Control should not be turned off, but let's just say it's off for the sake of argument. With UAC off, I still have the option to "Run as administrator" on executable files, even though I have an Administrator account type. Additionally, there is a checkbox under the Compatability tab (via Properties) labeled Run this program as an administrator. Do either of these options actually do anything if UAC is off?
Yes. When you use the slider to set UAC to "Never notify", it's not really turning UAC off - it's just turning the UAC notification level down to zero. UAC is still on and UAC events still appear in the Windows event log. If you have the slider all the way down so that you get no UAC notifications and then do a "Run this program as an administrator", UAC will still elevate the user's privileges in order to perform the action. It will just be done silently.
By default, UAC removes certain abilities from a administrator. These include the ability to write to restricted paths amongst other things.
Run as administrator gives the process the additional security privileges needed to accomplish theses tasks.
Turning of UAC basically does the same job as running as administrator (when using an account with administrator privileges) and the reason for it being on the menu is probably the same reason as having Paste always visible but sometimes disabled - it is more trouble to remove it...
The reason for it being there in properties is so the setting gets saved - if you ever turn UAC back on, it will remember that setting.
Running as Administrator with UAC turned off is useful for those situations when you log to Windows on a non administrator account. As you might expect certain applications or certain actions require administrator privileges.
With UAC turned off, user level permissions at the file and directory level are still in effect and Run As Administrator becomes a useful tool in order to gain access.
I would just add that no one here really hit on the Admin Approval Mode settings, which is the actual answer to the specific question being asked.
This setting is something the built-in Administrator has turned off by default, and what sets it apart from a standard user-created Administrator account unless that setting is changed.
Here's the complete description of the policy for "User Account Control: Use Admin Approval Mode for the built-in Administrator account" in Local Security Policy editor (Windows OS Build 19042.746) found at [Security Settings>Local Policies>Security Options] :
User Account Control: Use Admin Approval Mode for the built-in Administrator account
This policy setting controls the behavior of Admin Approval Mode for the built-in Administrator account.
The options are:
• Enabled: The built-in Administrator account uses Admin Approval Mode. By default, any operation that requires elevation of privilege will prompt the user to approve the operation.
• Disabled: (Default) The built-in Administrator account runs all applications with full administrative privilege.
This setting can also be changed via the registry by making a REG_DWORD entry at [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] named "FilterAdministratorToken" with the value 1.
The other, related setting found in the same location is "User Account Control: Turn on Admin Approval Mode", which is Enabled by default. For completeness sake, here's the description of that as well:
User Account Control: Turn on Admin Approval Mode
This policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. If you change this policy setting, you must restart your computer.
The options are:
• Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode.
• Disabled: Admin Approval Mode and all related UAC policy settings are disabled. Note: If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced.
That setting can also be changed via the registry by setting the REG_DWORD entry at [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] with the name "EnableLUA" to the value 0.
Using default settings, what this means is that the built-in Administrator account essentially runs everything as Administrator, while a user-created Administrator account still runs programs as a standard user unless instructed to run them as Administrator.
I believe this gets at the heart of what the question is asking. When you create a new "Administrator" user, if Admin Approval Mode is enabled, you still need to "Run as administrator" the programs you want to run as administrator. On Windows 7, setting the User Account Control slider to the most permissive, "Never Notify" also disables Admin Approval Mode; this is not the case in Windows 10, where Admin Approval Mode stays enabled unless turned off via Local Security Policy.
If that setting (the second one shown above) is disabled, then every Administrator account works like the built-in Administrator account does by default, running everything with full privileges. By the way, this is incredibly insecure and almost never something you want to disable, even on a personal computer.
I still have the option to "Run as administrator" on executable files, even though I have an Administrator account type.
To clarify this: "Run as administrator" is not the same as running a program from an account with administrator rights - it means to execute a program from the built-in Administrator account which in Windows Vista/7 is disabled by default (not visible).
You really shouldn't use this account for anything other than troubleshooting. In fact, you probably shouldn't use it at all.
For some reason, good old "Run as ..." is now hidden; to access this option, press Shift and right click the shortcut/executable to get this:
UAC is in no way related to "Run as administrator" except you will not receive a warning when using the built-in Administrator account, if UAC is disabled or set to "Never notify".