Yesterday, I ran into a circumstance wherein I could not delete some files using File Explorer. The error code indicated that I did not have appropriate permissions to do so.
I am the only user on my system and I log on with administrator privileges. I learned that sometimes, even as a system's administrator, one must chose to run software as with RUN AS ADMINISTRATOR privilege and that to do so one can right click on the shortcut or icon for the software. I had some difficulty raising the option to do so in File Explorer, but with some trial and error finally found it and deleted the files I wanted to be rid of.
This raises the question for me referenced in the subject line.
What does RUN AS ADMINISTRATOR really mean? Why must it be invoked for certain program functions to work? Why is it necessary to invoke the option with software when one is already the system admin?
Run as Administrator - What Does It Really Mean?
-
- UraniumLounger
- Posts: 9293
- Joined: 13 Feb 2010, 01:27
- Location: Deep in the Heart of Texas
Run as Administrator - What Does It Really Mean?
Bob's yer Uncle
Dell Intel Core i5 Laptop, 3570K,1.60 GHz, 8 GB RAM, Windows 11 64-bit, LibreOffice,and other bits and bobs
(1/2)(1+√5) |
-
- gamma jay
- Posts: 25455
- Joined: 17 Mar 2010, 17:33
- Location: Cape Town
Re: Run as Administrator - What Does It Really Mean?
My contribution:
Simple Explanation (from a Windows Forum):
When you log on, Windows creates an access token. This identifies you, the groups you are a member of, and your privileges. And note that whether a user is an administrator or not is determined by whether the user is a member of the Administrators group.
Without UAC, when you run a program it gets a copy of the access token, and this controls what the program can access.
With UAC, when you run a program it gets a restricted access token. The is the original access token with "Administrators" removed from the list of groups (and some other changes). Even though your user is a member of the Administrators group, the program can't use Administrator privileges.
When you select "Run as Administrator" and your user is an administrator the program is launched with the original unrestricted access token. If your user is not an administrator you are prompted for an administrator account, and the program is run under that account.
"Run as Aministrator" is just a command, enabling the program to continue some operations that require the Administrator privileges, without displaying the UAC alerts.
Even if your user is a member of administrators group, some applications need the Administrator privileges to continue running, because the application is considered not safe, if it is doing some special operation, like editing a system file or something else. This is the reason why Windows needs the Administrator privilege to execute the application and it notifies you with a UAC alert. Not all applications need an Administrator account to run, while some applications do need the Administrator privileges.
If you execute the application with 'run as administrator' command, you are notifying the system that your application is safe and doing something that requires the administrator privileges.
Additional easy reading article
A mammoth document about the Windows Integrity Mechanism Design
Simple Explanation (from a Windows Forum):
When you log on, Windows creates an access token. This identifies you, the groups you are a member of, and your privileges. And note that whether a user is an administrator or not is determined by whether the user is a member of the Administrators group.
Without UAC, when you run a program it gets a copy of the access token, and this controls what the program can access.
With UAC, when you run a program it gets a restricted access token. The is the original access token with "Administrators" removed from the list of groups (and some other changes). Even though your user is a member of the Administrators group, the program can't use Administrator privileges.
When you select "Run as Administrator" and your user is an administrator the program is launched with the original unrestricted access token. If your user is not an administrator you are prompted for an administrator account, and the program is run under that account.
"Run as Aministrator" is just a command, enabling the program to continue some operations that require the Administrator privileges, without displaying the UAC alerts.
Even if your user is a member of administrators group, some applications need the Administrator privileges to continue running, because the application is considered not safe, if it is doing some special operation, like editing a system file or something else. This is the reason why Windows needs the Administrator privilege to execute the application and it notifies you with a UAC alert. Not all applications need an Administrator account to run, while some applications do need the Administrator privileges.
If you execute the application with 'run as administrator' command, you are notifying the system that your application is safe and doing something that requires the administrator privileges.
Additional easy reading article
A mammoth document about the Windows Integrity Mechanism Design
Last edited by Rudi on 29 Oct 2014, 04:31, edited 1 time in total.
Regards,
Rudi
If your absence does not affect them, your presence didn't matter.
Rudi
If your absence does not affect them, your presence didn't matter.
-
- UraniumLounger
- Posts: 9293
- Joined: 13 Feb 2010, 01:27
- Location: Deep in the Heart of Texas
Re: Run as Administrator - What Does It Really Mean?
Thanks, Rudi!
In nearly 3 years now running Win7, this is the first time I've encountered the need to 'run as administrator.' I truly didn't know enough to research the question. Your post enlightens me a great deal. I'll see if I have what it takes to read and understand the discussion you pointed to.
(only 2 because it is early in the work week)
In nearly 3 years now running Win7, this is the first time I've encountered the need to 'run as administrator.' I truly didn't know enough to research the question. Your post enlightens me a great deal. I'll see if I have what it takes to read and understand the discussion you pointed to.
(only 2 because it is early in the work week)
Bob's yer Uncle
Dell Intel Core i5 Laptop, 3570K,1.60 GHz, 8 GB RAM, Windows 11 64-bit, LibreOffice,and other bits and bobs
(1/2)(1+√5) |
-
- GoldLounger
- Posts: 2599
- Joined: 24 Jan 2010, 15:26
- Location: Olympia, WA
Re: Run as Administrator - What Does It Really Mean?
BobH,
Consider it as the "Super Administrator", as has 110% privileges, as your Admin account only has about 90% privileges.
This Run as Administrator has been around since the Windows ME days (I believe). It was one of the first steps to protect us from ourselves.
Consider it as the "Super Administrator", as has 110% privileges, as your Admin account only has about 90% privileges.
This Run as Administrator has been around since the Windows ME days (I believe). It was one of the first steps to protect us from ourselves.
I am so far behind, I think I am First
Genealogy....confusing the dead and annoying the living
Genealogy....confusing the dead and annoying the living
-
- gamma jay
- Posts: 25455
- Joined: 17 Mar 2010, 17:33
- Location: Cape Town
Re: Run as Administrator - What Does It Really Mean?
Hi Bob...again, TX for the beers
I added a second easier to read article in my first reply if you want to peruse. The mammoth one is way to technical and frankly, I'm doubt it really explains much about the Administrator mode...its just tech talk on the security hierarchy in Windows.
I added a second easier to read article in my first reply if you want to peruse. The mammoth one is way to technical and frankly, I'm doubt it really explains much about the Administrator mode...its just tech talk on the security hierarchy in Windows.
Regards,
Rudi
If your absence does not affect them, your presence didn't matter.
Rudi
If your absence does not affect them, your presence didn't matter.
-
- PlatinumLounger
- Posts: 5409
- Joined: 24 Jan 2010, 08:33
- Location: A cathedral city in England
Re: Run as Administrator - What Does It Really Mean?
There are some folders and files created by Microsoft Update, usually, and left behind undeleted where I have found it impossible to delete by any means other than by using Unlocker.
John Gray
"(or one of the team)" - how your hospital appointment letter indicates that you won't be seeing the Consultant...
"(or one of the team)" - how your hospital appointment letter indicates that you won't be seeing the Consultant...
-
- PlatinumLounger
- Posts: 5685
- Joined: 24 Jan 2010, 19:16
- Location: Cape Cod, Massachusetts,USA
Re: Run as Administrator - What Does It Really Mean?
I have had similar experiences on occasion and Unlocker comes to the rescue and saves the day.John Gray wrote:There are some folders and files created by Microsoft Update, usually, and left behind undeleted where I have found it impossible to delete by any means other than by using Unlocker.
BOB
______________________________________
If I agreed with you we'd both be wrong.
______________________________________
If I agreed with you we'd both be wrong.