32

I have recently gotten a new computer and have upgraded to Windows 10 (though I suspect this is a problem in other versions as well.)

My user is an administrator. I have set UAC to the lowest level. I have changed owner to my user on the whole c:\ disk (including the hosts file.)

Still, when I run notepad c:\windows\system32\drivers\etc\hosts, edit the file, and try to save, it won't let me. If I run notepad as administrator first, then open the file, I can save without problems.

But, why, after the measurements I have taken, isn't my user regarded as an administrator user? What am I missing here, in order to make my user an actual administrator (and not just a regular user with some fancy label in user accounts)?

Updated question: When you have a user that is an Administrator, why is this user's permissions not affected by the security group Administrators, but rather the security group Users?

  • 1
    These limitations are put in place to keep people from "accidentally" infesting a system with malicious code. Plus, any IT professional that runs his/her PC as administrator probably has administrative access to other systems and can easily generate an RGE (Resume Generating Event). If I had a consultant or a JR admin ask me this, I would personally make sure that every device he/she has access to has extremely prohibitive rights and only let him/her run Citrix apps that I have personally vetted. – user485501 Aug 19 '15 at 0:25
  • 3
    I don't see the point of having the same security mechanisms for my 63 year old father who believes everything he sees on the internet, and me who have grown up with computers to such an extent that I'm suprised one is not attached to me. I don't want to spend time bypassing security measures that in practice offers me no security. Then it's pretty annoying that I have to spend even more time disabling these measures, and even if I appearantly have, they are still there. – Tobb Aug 19 '15 at 6:21

10 Answers 10

26

The many people above me laid it out pretty clearly:

  • Copy to Desktop, Edit with Notepad and Save, Copy Back Which Would Overwrite the Previous Host File
  • Disable UAC
  • Launch cmd as an Administrator and than Type In "notepad..."
  • Use the Local Users and Group Manager (Ill Advised)

Option one on my list is how people have been doing it for years. There's only one UAC prompt for the return copy. It has been done like this since the Vista-era.

As what was explained to you earlier, you are an Administrator user. You can go through the effort to change this but it comes with a lot of risks. To make a comparison: you do not applications on Linux with "root" regularly but instead elevate with the "su" command or by logging in as "root."

| improve this answer | |
  • Appearantly, administrator users does not gain the privileges of the administrators user group. When I gave the Users group full control of the file I was able to easily save it. Makes sense to me, but hey, at least it's working. – Tobb Aug 19 '15 at 6:16
  • None of these work for me. "Destination Folder Access Denied" "You need permission to perform this action" [Try Again] [Cancel] – AzulShiva Jan 26 '17 at 17:47
  • I cannot change Secutiry Settings and permissions either. "Windows Security" "Unable to save permission changes on hosts. Access is denied." [Retry] [Cancel] – AzulShiva Jan 26 '17 at 17:50
  • Yep. The only one who actually answered the question with a feasible solution, instead of theorizing or presenting morality "shoulds / should nots". Thumbs up! – alejandrob Jan 15 '18 at 17:27
10

The problem is actually very simple: in Windows 10 the hosts file is read-only by default. This means that even if you can access it with administrative privileges, you still cannot write to it. Furthermore (at least on my machine) this means that editing a copy as others suggested won't work, because it will be read-only too!

To be able to edit it you must first disable the read-only bit:

  1. Open the c:\windows\system32\drivers\etc\ folder in your file-manager;
  2. right-click the hosts file;
  3. select Properties;
  4. un-tick Read-Only;
  5. click Apply;
  6. click Continue (to perform the action with administrator privileges).

Then you can freely edit the hosts file with your favourite text editor (running it as an administrator). Remember to re-set the read-only bit after you're done to prevent other applications from modifying it without your knowledge.

| improve this answer | |
  • This file isn't showing read-only – PlanetUnknown Aug 4 '16 at 0:44
  • 1
    @PlanetUnknown It was when I wrote this answer, on a machine with a fresh install of Windows 10. It might not be anymore after some of the recent updates. – A.P. Sep 2 '16 at 19:21
  • a thousand times thanks. I've quite literally tried all the solutions on the net and it was this! – Dheeraj Bhaskar Dec 19 '16 at 4:51
3

Open notepad.exe or any other text editor(sublime,notepad++) with administrator privilege (Right-click on the exe and select "Run as administrator"), edit the file and save.

Or,

Open Run prompt - Press Windows Key+R and type/paste folllowing command

powershell -c start -verb runas notepad.exe C:\Windows\System32\drivers\etc\hosts
| improve this answer | |
2

Also if you have install tinyfirewall, there is a default option there that prevent the editing of the host file.

| improve this answer | |
  • This happend to me, and i was properly notified when i tried to erase the file :-), otherwise you only see "file in use". Seems then that protecting the file is made by just openinig for editing in lock mode, so no one could write or erase it untill you (tinywall) release it. – m3nda Dec 8 '19 at 11:46
1

Just because you are an Administrative user, does not mean that everything you do, you do as an administrator; it simply means that you have the ability to do so.

By default, your user runs just the same as any other user would, as themself.

When you try and preform administrative tasks - certain applications will be run with administrative privileges (such as when you click run as administrator).

| improve this answer | |
  • Well, my user account says "Administrator", not "Administrative user". Regardless, I would like my user to be an "Administrator" rather than an "Administrative user", that shouldn't be impossible? – Tobb Aug 18 '15 at 10:46
1

I would not recommend doing this but if you give your user Full Control on that file it should work as you want it to. This is a security risk though, please think carefully if you really need this.

| improve this answer | |
  • I have full control of the file, I have even set myself as owner of the file. Doesn't keep windows from "protecting" me, even though I don't want it. – Tobb Aug 18 '15 at 14:10
  • I didn't notice the Windows 10 tag so perhaps my answer is incorrect. Do you see 'Full Control' for your user when you right-click the file and go to the Security tab? I just tried it on Windows 7 and that works, perhaps Windows 10 behaves differently. – HoD Aug 18 '15 at 14:40
  • I have also had this working in Windows 7, managed to set that up so that it didn't give me any hazzle. As far as I remember I have done the same on my Windows 10 computer, but I dont get the same result. The administrators group has full control of the file. But, when I give the Users group full control of the file, then I can save it. So I have an administrator account, but the access rights for the User group is what affects my privileges. – Tobb Aug 19 '15 at 6:12
0

When you logon, you get handed a "Kerberos" token which defines your user as both administrator and user - regardless of what control panel tells you.

You can use local user manager (C:\windows\system32\lusrmgr.msc) to remove yourself from the users group and only be present in the administrators group - but this may cause more hassle than its worth.

Another hacky-style approach is to launch cmd as an admin and then "notepad C:......"

You could always take this one step further and launch cmd as an admin, from cmd - you can launch "taskmgr" and then kill and re-open "explorer.exe". Since taskmgr is running as an admin - processed launched under this context (explorer.exe - WINDOWS!) will also be in a pure administrator context - HOWEVER, this comes with a whole myriad of warnings:

  • Profile path will change to that of the administrator
  • everything you do will be as administrator (open door to virus, malware etc)
  • If you screw something up - you can cause a complete meltdown of your PC

UAC is meant to be there to allow you to stop and think berfore you do something which could have big ramifications.

Alternatively, disable UAC (Control Panel > User Account & Family Safety > User Accounts > Pick A User > Change User Account Control Settings) OR (Start > searc > UAC)

| improve this answer | |
  • UAC is already disabled. As an IT professional I don't knowingly infect myself with malware.. The thing is, which is really annoying, that after setting myself as administrator, after disabling UAC, after making myself owner of the file, I am not allowed to edit a file on my computer without having to take an uneccessary detour. When I doubleclick a file, or save a file, I have already made my decision, I don't need any second-guessing from Windows, but even though I have taken measures not to, it still seems to happen. – Tobb Aug 18 '15 at 14:11
0

Copy the hosts file to your desktop edit it, save it in the same place and then copy it back to system32\drivers\etc. the UAC popup answer with yes. that's it.

| improve this answer | |
  • I could perhaps be clearer, I would like to avoid annoyances like this in general. Of course, I am able to work around it, but I don't want to work around stuff every time I want to change a file on my computer. I know what I am doing, I don't need 20 "are you sure" questions just to be blocked from doing what I am trying.. – Tobb Aug 18 '15 at 14:10
0

Changing the access rights for the User group to full control for the hosts file allowed me to save it without having to run stuff as administrator. The fact that my account is an administrator, and the administrators had full control of the file didn't allow me to edit it. Makes no sense. Go Windows!

| improve this answer | |
0

Check your firewall settings. I just recently came across this issue. Only user of my PC and could not get that hosts file to cooperate. Tried to delete and antivirus pops up telling me it has protected me. I use Avira, so I into my real-time protection configuration, check the security tab and "Protect windows hosts file from changes." is on by default. I uncheck, apply, do my change, then check it back and apply. No issue at all once that option was unchecked.

| improve this answer | |
  • 2
    (1) What do firewall settings have to do with antivirus protection?  (2) You got a pop-up message saying that your antivirus prevented you from modifying the hosts file.  The OP didn't.  So why do you believe that his problem has anything to do with antivirus? – Scott Jan 17 '16 at 7:34
  • I had the problem with Avira too. I just couldn't change hosts file like the file is already open by other program (no Avira windows poped up). Disabling Avira real-time protection solved the problem for me. – cakan Feb 21 '17 at 19:34

Not the answer you're looking for? Browse other questions tagged or ask your own question.