Elevated Command non-functioning

[rhstubby]

Try3: Yes after creating the new accounts they performed the same as the existing ones. Appreciate all you support and help but it is time for a fresh install.

 

[zbook]

Is Windows on G:?

This administrator is enabled: C:\Users\rhstu




Bitdefender: enabled

Acronis True Image: enabled

McAfee

 

[rhstubby]

No: Windows is on C: the G: should have been a thumbdrive (The app you suggested was lauched from the thumbdrive)

 

[zbook]

Please rerun from Windows.

And see if the computer will run V2 from normal boot or safe mode:

BSOD - Posting Instructions

BSOD - Posting Instructions This will show you how to help provide needed information about your system and dump files. It will not contain any personal or sensitive information about you or your data. To get better help with your Windows BSOD issue, please read these instructions and follow...

www.elevenforum.com

 

[rhstubby]

Zbook: I think I ran this as instructed from my offending PC's Download directory. Attached is the output.

 

[zbook]

Windows 11 Pro
Version: 10.0.26200


1) Was an in place upgrade repair performed yesterday?


You must be signed in as an administrator to perform a repair install of Windows 11.

Repair Install Windows 11 with an In-place Upgrade

This tutorial will show you how to do a repair install of Windows 11 by performing an in-place upgrade without losing anything. If you need to repair or create a new recovery partition or having problems with the Windows 11 operating system on your PC, and the usual solutions will not fix it...

www.elevenforum.com

2) See if uninstalling these software makes a difference:

[KB146] Uninstallers (removal tools) for common Windows antivirus software

support.eset.com

Uninstall Software, Remove programs easily - Revo Uninstaller Pro

Clean removal of any program from your PC. Uninstall and remove programs and software in Windows with Revo Uninstaller Pro easily!

www.revouninstaller.com

Bitdefender Agent 27.1.1.28 Bitdefender
Bitdefender Total Security 26.0.30.102 Bitdefender

AVG Update Helper 1.8.1188.1 AVG Technologies 20220101

Driver Booster 13 13.2.0 IObit 20260114

IObit Malware Fighter 13 13.1.0.1617 IObit 20260109
IObit Software Updater 8.3.0.12 IObit 20260117
IObit Uninstaller 15 15.2.0.2 IObit 20251223

McAfee Safe Connect 2.13 McAfee, LLC.
McAfee Safe Connect 2.13 McAfee, LLC. 20211023




3) Add WMIC:

Add or Remove WMIC command Feature in Windows 11

This tutorial will show you how to add or remove the WMIC command as an optional feature for all users in Windows 11. The WMI command-line (WMIC) utility provides a command-line interface for Windows Management Instrumentation (WMI). WMIC is compatible with existing shells and utility commands...

www.elevenforum.com

4) If possible run these commands:

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"

wmic useraccount get name, sid

whoami /user



Administrator (S-1-5-21-3500871638-1745993587-2605281543-500 - Administrator - Disabled) => C:\Users\Administrator
DefaultAccount (S-1-5-21-3500871638-1745993587-2605281543-503 - Limited - Disabled)
Guest (S-1-5-21-3500871638-1745993587-2605281543-501 - Limited - Disabled)
Guest_one (S-1-5-21-3500871638-1745993587-2605281543-1005 - Limited - Enabled) => C:\Users\Guest_one
rhstu (S-1-5-21-3500871638-1745993587-2605281543-1001 - Administrator - Enabled) => C:\Users\rhstu
Rich1 (S-1-5-21-3500871638-1745993587-2605281543-1011 - Limited - Enabled) => C:\Users\Rich1
rich2 (S-1-5-21-3500871638-1745993587-2605281543-1012 - Limited - Enabled) => C:\Users\rich2
tex-m (S-1-5-21-3500871638-1745993587-2605281543-1002 - Limited - Enabled) => C:\Users\tex-m
WDAGUtilityAccount (S-1-5-21-3500871638-1745993587-2605281543-504 - Limited - Disabled)
WsiAccount (S-1-5-21-3500871638-1745993587-2605281543-1010 - Limited - Disabled) => C:\Users\WsiAccount

 

[zbook]

These were AI suggestions for a blocked administrative command prompt if uninstalling the above third party software did not fix the block:


Group Policy Editor (Recommended for Pro/Enterprise):
Press Win + R, type gpedit.msc, and hit Enter.
Navigate to: User Configuration > Administrative Templates > System.
Double-click Prevent access to the command prompt.
Set to Disabled or Not Configured.
Click Apply and OK.



Registry Editor (For Home Edition):
Press Win + R, type regedit, and hit Enter.
Navigate to: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System.
Find DisableCMD and set its value to 0. If it doesn't exist, this policy is likely not set via registry.



Command Prompt Fix Command:
Open Run (Win + R), type cmd, and try to run: REG add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 0 /f.



Check for Malware:



Sometimes this restriction is caused by viruses; run a full system scan.



If the issue persists, ensure you are logged in with an account that has administrator privileges.

Google Search

 

[rhstubby]

Zbook: RE: #46 Yes a in place upgrade was attempted yesterday with Admin priviledges via the Task Manager Built in command with elevated priviledges (If I executed it correctly). I did this via an ISO file d/l from M/S site and mounted it on the offending PC.
Removed Bitdefender, Drive Booster, Iobit Malware + Software Updater + Uninstaller and McAfee Safe Connect.
Activated WMIC
Ran these commands from Built in (Task Manager) command prompt - elevated:



I still cannot get a elevated command prompt using the taskbar.

 

[rhstubby]

Could this be a clue?? Notice the next to last entry: Empty Registry Keys: This is for my account 1-5-21 (data) VID_046D&PID_C548

 

[zbook]

1) Please post a larger image for post#49.



2) Run Tuneup_plus_log.bat > post a share link

https://www.tenforums.com/attachments/bsod-crashes-debugging/360139d1645183596-batch-files-use-bsod-debugging-tuneup_plus_log.zip

Batch files for use in BSOD debugging - Windows 10 Help Forums

Information This thread is for use by the BSOD team to store batch files that can be used to collect additional data, fix settings or anything else that is useful in debugging BSOD problems in Windows 10. The way I see it working is the first

www.tenforums.com

Index of Batch Scripts for BSOD debugging, and other Windows troubleshooting

Toc1 Table of Contents Contents Part Zero Download Tips for Edge, Firefox and Chrome Part One Verify vertical scroll buffer (Height) is large enough Part Two Capture output of batch file to Clipboard Part Two-OneA From Command Prompt or Powershell Window Part Two-OneB From Notepad Window Part...

www.elevenforum.com

3) Indicate whether administrative command prompt opens in clean boot and safe mode:

Perform a Clean Boot in Windows 11 to Troubleshoot Software Conflicts

This tutorial will show you how to perform a clean boot to start Windows 10 or Windows 11 using a minimal set of drivers and startup programs for troubleshooting application conflicts. Troubleshooting Windows can be a complex process due to the many different drivers, settings, and programs...

www.elevenforum.com

Boot to Safe Mode in Windows 11

This tutorial will show you how to boot Windows 11 into normal mode, Safe Mode, Safe Mode with Networking, or Safe Mode with Command Prompt. Safe mode starts Windows in a basic state, using a limited set of files and drivers. If a problem doesn't happen in safe mode, this means that default...

www.elevenforum.com

4) Try steps from AI in post #47

 

[XxXxX]

@rhstubby
Q. do you have malwarebytes installed on your system ?

best of luck Steve ..

 

[Try3]

Could this be a clue??

No, your problem also exists in other user accounts as you have determined during your tests.
So the contents of your rhstu user profile cannot explain what is wrong with those others.
And there's nothing suspicious in the entries you posted anyway.
I don't know what software you used to make that diagram. If you need to post anything from it again then adjust its column widths before making the screenshot to eliminate the wasted space that is making the diagram bigger and so making the whole thing harder to read [it was getting very blurry by the time I'd zoomed in on it enough to be able to read the data].



I see in your exchanges with zbook that you have now disabled the Built-in Admin [the account with the username Administrator]. That's good. As long as the tests I suggested for that Built-in Admin really were done whilst logged into it.


All the best,
Denis

 

[Try3]

This is for my account 1-5-21 (data)

I don't understand that "1-5-21 (data)" comment. Why "data"?
Those "empty" lines you posted were for your rhstu user account.


Denis

 

[rhstubby]

Zbook: Split the image to enlarge it (entry next to bottom entitled Empty Registry Key (VID_046D$PID_C548. Also Tuneup.log

 

[rhstubby]

Effective 1/29/26 I removed all known suspicious software (Bitdefender, Malware Fighter, Drive Booster, Software Updater, Uninstaller, McAfee Safe Connect but never found AVG Update Helper to delete it. (It wasn't in any list with REVO to delete).
With these removed the issue remain.

 

[zbook]

If possible, attempt to launch each administrative command prompt and administrative PS while in normal boot and in safe mode > post images or share links displaying error messages or codes.

Then please post new frst and addition share links (post #38) into the newest post.

 

[rhstubby]

Zbook: I went to ‘SAFE MODE’ and was able to capture an Android photo of the screen. Each window I was able to open shows the source of that window typed into the command line. I opened some via the task bar and some via the Task Manager start a new command which automatically placed me in Admin mode. I then went while in safe mode to try to show you the video of me trying to get a command prompt elevated to Admin. (I believe if I’m in admin already it should NOT offer me an option to go to an elevated command? Correct?) Well, if that is the case then the exact thing is what I’m seeing from my ‘admin / user account’. So has my user account which was manually set to Admin now inherited the attributes of a higher authority (i.e., Microsoft’s authority?). So, in one case I get powershells both starting at System32 but my Cmd prompt starts at rhstu or from the built in task manager from System32.

My other (good) computer does not exhibit these characteristics.

I placed the images (JPG) files and movie MP4 of the screens in SAFE Mode at: Public Folder - Google Drive

I place the video of me seeking a command with elevated privileges as I would do it from a lower-level user (this was ADMIN) so if my assumption is correct whether I’m in Safe Mode or running normal my command prompt will not be elevated (perhaps because it has Microsoft authority already? How can that be??). But then it never goes to the System32 folder where it would normally be executed from when it is an rhstu prompt.

Also I ran the FRST.exe file and renamed the logs with the term SAFE in the title to distinguish them from those run in normal mode.

 

[rhstubby]

I just went to my NON-offending (Good PC) and took screen grabs of normal command prompts and Powershell request and requested elevated Cmd and PS windows upon successfully elevating them to Admin. This single composite picture is in my Public folder on Google Drive if you need more evidence I'm not SEEING or imagining THINGS! I typed in how I got each window to appear on the 'good pc'.

 

[zbook]

The mp4 reported that the computer does not have the codec for viewing with error code 0xc00d5212.

When available post the links from frst.

Open Elevated Command Prompt as Administrator in Windows 11

This tutorial will show you different ways on how to open an elevated command prompt that will run as administrator in Windows 11. The Command shell is an entry point for typing commands in the Command Prompt console window. By typing commands at the command prompt, you can perform tasks on...

www.elevenforum.com

Open Elevated Windows Terminal as Administrator in Windows 11

This tutorial will show you different ways to open an elevated Windows Terminal to Run as Administrator in Windows 11. Windows Terminal is a modern host application for the command-line shells you already love, like Command Prompt, PowerShell, and bash (via Windows Subsystem for Linux (WSL))...

www.elevenforum.com

Open Windows Terminal in Windows 11

This tutorial will show you different ways to open Windows Terminal in Windows 11. Windows Terminal is a modern host application for the command-line shells you already love, like Command Prompt, PowerShell, and bash (via Windows Subsystem for Linux (WSL)). Its main features include multiple...

www.elevenforum.com

 

[Spunk]

Revo doesn't always get all the remnants of AV products when uninstalling. Each AV app; has their own Uninstaller. Download MCPR tool for McAfee

https://www.mcafee.com/support/s/article/000001616?language=en_US

Download AvastClear Tool

Avast Removal Tool | Download Avast Clear | Avast

www.avast.com

When you start a Command Prompt or PS as Admin, you may still need to run apps as Admin.

Press the Windows key +X and choose Terminal (Admin) and press Enter.
Copy and Paste or type

DISM /Online /CLEANUP-IMAGE /RestoreHealth and press Enter. Once completed, type
SFC /scannow and press enter.
This will replace any missing or corrupted Windows files.