2

When i am logged in as an administrator on Windows 2008R2, I will NEVER want permissions to be denied for any access modifications configurations or changes I make. If I delete a printer I want it deleted. PERIOD. I don't care if I'm not its owner. I don't care if I'm not in the print operators group or whatever. Do what I tell you to do and shut up Windows!

I do not want to encounter any type of access issues. Is there a way to force Windows 2008 R2 to act this way? I want full permissions to everything and the entire concept of denying access to be disabled when I am logged in as an administrator.

I can turn off UAC but that doesn't cut it. I need to turn off the whole permissions concept, At least temporarily so I can get stuff done and stop googling obscure registry settings permissions and trying to guess what the problem is.

4
  • 2
    This really sounds like a XY Problem, why don't you ask instead about the "obscure registry settings permissions" or even go to the even bigger picture and explain what you are trying to do that required you to change the registry in the first place. – Scott Chamberlain Dec 29 '13 at 6:54
  • It's NOT an XY Problem. I don't want to deal with permissions during a particular session. There is NOTHING I can do when in that session that should not be allowed. I just want to act with confidence that actions I take will occur without any static from the OS about any sort of access restrictions There's no need for the OS to check, as I am in "god mode". I don't want Windows to protect me from myself. The particulars of the situation are beside the point, I am looking for a way to not care about permissions for a session or account. – ggb667 Feb 22 '17 at 16:24
  • 1
    I turned my comment from the accepted answer in to a full answer. If you want a way to run in "god mode" windows then launching Explorer as system will do that. – Scott Chamberlain Feb 22 '17 at 17:01
  • Not really. Even with files you may have to take ownership and set the ACLs, but it was really with regards to other things like deleting a printer or other things that I was concerned about. – ggb667 Feb 27 '17 at 19:26
2

Booting from a linux CD such partedmagic mounting and accessing the files from there is offers the most amount of flexibility accessing files.

REGISTRY: http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx

PsExec.exe -i -s regedit

This will launch regedit as the system account. Which has more access than the admin account.

These 2 methods will give you easier access to 2 parts of your system. However, security is built in and an unavoidable part of the system.

3
  • 2
    to take this answer one step further, if you closed explorer.exe and did psexec -i -s explorer then windows explorer would be running with SYSTEM level privileges. (Very dangerous and I REALLY do not recommend it, but it is a option.) – Scott Chamberlain Dec 29 '13 at 6:51
  • I will try this – ggb667 Dec 29 '13 at 21:15
  • @ScottChamberlain I think this is probably more of a "Fed up with X, ergo Y" problem :) – Mahmoud Al-Qudsi Jan 2 '16 at 18:47
2

Can't be done, ACL is integral to Windows and is there for 'your protection'. Plus they made it so 2008 cannot install to FAT32 (avoiding NTFS style ACL's).

Anyways the best alternative for files/folders is the right click take ownership shell extension.

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\*\shell\runas]
@="Take Ownership"
"NoWorkingDirectory"=""

[HKEY_CLASSES_ROOT\*\shell\runas\command]
@="cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant *S-1-5-32-544:F"
"IsolatedCommand"="cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant *S-1-5-32-544:F"

[HKEY_CLASSES_ROOT\Directory\shell\runas]
@="Take Ownership"
"NoWorkingDirectory"=""

[HKEY_CLASSES_ROOT\Directory\shell\runas\command]
@="cmd.exe /c takeown /f \"%1\" /r /d y && icacls \"%1\" /grant *S-1-5-32-544:F /t"
"IsolatedCommand"="cmd.exe /c takeown /f \"%1\" /r /d y && icacls \"%1\" /grant *S-1-5-32-544:F /t" 

But for registry you'll have to learn how to take ownership from powershell. For instance this snip will allow me to delete a LOCKEDKEY.

$key = "registry::HKCU\Software\Microsoft\LOCKEDKEY"

$acl = Get-Acl -Path $key
$permission = 'Administrators','FullControl','ContainerInherit, ObjectInherit','None','Allow'
$accessRule = New-Object System.Security.Accesscontrol.RegistryAccessRule $permission;$acl.SetAccessRule($accessRule)
$acl | Set-Acl -Path $key
Remove-ItemProperty -Path $key

That is the way it works for the past 6 years with TrustedInstaller.

Alternatively you can spawn your regedit or batch scripts via TrustedInstaller token using a third party app like Devxexec.exe. This way you can avoid any permissions changes as TrustedInstaller has access to everything that you do not (and vice versa)

@ECHO OFF

devxexec.exe /user:TrustedInstaller regedit.exe

PAUSE
0

If you closed explorer.exe and using psexec did

psexec -i -s explorer

Then windows explorer would be running with SYSTEM level privileges. This is very dangerous and I REALLY do not recommend it, but it is a option. All actions you perform in Explorer and all programs launched from inside exporer will be executed as the SYSTEM user which has "god mode" level privileges on your system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.