About Admin privileges, UAC, and finding the right balance

Jose Hidalgo · Dec 11, 2023

OK, so let me get this right.

Intro:

I'm supposedly an experienced user, who supposedly knows what he's doing.
I have an admin account.
I have purposedly disabled UAC.
And I was perfectly happy, until today.

The issue:

Among other things, I use WinGet and WinGetUI to manage and update apps. Works nicely.
But WinGet likes to NOT run with admin privileges.
Some apps will simply refuse to install/update if WinGet or WinGetUI is running with admin privileges.

The attempts:

So I checked WinGetUI properties. The "always run as admin" checkbox was unchecked.
So I tried opening a CMD or PowerShell prompt without admin privileges (right-click on the Start menu, there are two options available).
But despite asking to open it without admin privileges, it still kept having those.

The explanation:

And why was that happening? Because since I had disabled UAC, all prompts had admin privileges.

The (quick but unsatisfactory) fix:

So I had to re-enable UAC (and reboot of course) just to be able to run WinGet without admin privileges, so it could perform the wanted update (for the record it was Spotify - most other apps had been installing/updating without issues until that point).

Bottom line: me, a supposedly experienced user who was perfectly happy without UAC, am being forced to enable UAC just to be able to keep using WinGet.

Question: Is there really no way around this? I mean, is it not possible, with UAC disabled, to force a specific app to run WITHOUT admin privileges?
Ideally I'd like to be able to disable UAC once again, and still be able to run WinGet / WinGetUI without admin privileges.

I hope you get my point. Thanks in advance!

pseymour · Dec 12, 2023

Can't run winget as a admin · Issue #637 · microsoft/winget-cli

Brief description of your issue I'm trying to avoid the UAC prompt whilst downloading a package, so I open a elevated terminal and run winget However I get the following message The system cannot e...

github.com

make winget run as admin instead of asking for admin on each installer · microsoft/winget-cli · Discussion #3185

Description of the new feature / enhancement could it be possible to make winget run as admin and then run the installers as admin or user depending on if they need to install to appdata or program...

github.com

Jose Hidalgo · Dec 12, 2023

Thanks. Not sure I understood everything, but that looks like an explanation to me, not like a solution...
Plus my issue would be the opposite (running WinGet with limited privileges).

Maybe this, which was suggested: psexec -i -s cmd
Could the same thing be applied to WinGet directly? psexec -i -s WinGetUI.exe for example.

PsExec - Sysinternals

Execute processes on remote systems.

learn.microsoft.com

pseymour · Dec 12, 2023

The gist of it is that there are issues running winget without admin rights, for apps that specify they need them to update, and vice-versa.

There are links to other issues in those two issues. It sure seems like a mess at the moment.

Spunk · Dec 13, 2023

Jose Hidalgo said:
So I checked WinGetUI properties. The "always run as admin" checkbox was unchecked.

Browse to C:\Program Files and C:\Program Files(x86) find the Winget and WingetUI. Right click each one, go to Properties/Compatibility at the bottom put a check in the box Run As Administrator. Apply and OK.
Now when you click the shortcut it will always Run As Administrator with UAC disabled.

Or you can just right click the shortcut for the app and choose Run As Administrator.

Jose Hidalgo · Dec 13, 2023

What? No, I think you didn't get it @Spunk .

With UAC disabled, I'm always in admin mode, so everything runs in admin mode, including WinGet and WinGetUI. Which is a problem because some apps refuse to install/update when you're running in admin mode.
With UAC enabled, I'm no longer in admin mode, so I have all the warning prompts which are quite annoying for a supposedly experienced user who supposedly knows what he's doing.

So currently there is no ideal solution.

Wynona · Dec 13, 2023

Jose Hidalgo said:
OK, so let me get this right.

Intro:

I'm supposedly an experienced user, who supposedly knows what he's doing.

I have an admin account.

I have purposedly disabled UAC.

And I was perfectly happy, until today.

The issue:

Among other things, I use WinGet and WinGetUI to manage and update apps. Works nicely.

But WinGet likes to NOT run with admin privileges.
Some apps will simply refuse to install/update if WinGet or WinGetUI is running with admin privileges.

The attempts:

So I checked WinGetUI properties. The "always run as admin" checkbox was unchecked.

So I tried opening a CMD or PowerShell prompt without admin privileges (right-click on the Start menu, there are two options available).

But despite asking to open it without admin privileges, it still kept having those.

The explanation:

And why was that happening? Because since I had disabled UAC, all prompts had admin privileges.

The (quick but unsatisfactory) fix:

So I had to re-enable UAC (and reboot of course) just to be able to run WinGet without admin privileges, so it could perform the wanted update (for the record it was Spotify - most other apps had been installing/updating without issues until that point).

Bottom line: me, a supposedly experienced user who was perfectly happy without UAC, am being forced to enable UAC just to be able to keep using WinGet.

Question: Is there really no way around this? I mean, is it not possible, with UAC disabled, to force a specific app to run WITHOUT admin privileges?
Ideally I'd like to be able to disable UAC once again, and still be able to run WinGet / WinGetUI without admin privileges.

I hope you get my point. Thanks in advance!

WAG here, but I think what's happening is that when you disable UAC, you no longer have choices, so to be sure things will run properly, winget now "runs as admin". I wouldn't be surprised if other apps do the same.

Spunk · Dec 13, 2023

I do understand. Windows has different levels of Administrators.

If you login to Windows as a Admin, you still have to start apps like Command Prompt, Powershell, and certain apps as an Admin. Meaning you have to right click the Shortcut and choose Run as Administrator.
If you run a Command Prompt normally, the prompt will say
C:\Users\UserName> Running some system commands will fail and tell you you do not have permission
but if you Search for CM, Command Prompt or it's shortcut and Right click it and choose Run As Administrator, the prompt will show
C:\Windows\System32> This is an Elevated Command Prompt or a prompt that is Run As Administrator.

If it is an app that requires Admin rights to run, Like WinGetUI and you use it a lot, Check the Box, Run As Administrator and Applying this will save that app to Always Run as Administrator. Eliminating your problem.

Jose Hidalgo · Dec 13, 2023

Always running WinGetUI as admin will not eliminate the problem.
Always running WinGetUI as admin is what causes the problem.

If I disable UAC, I will get the problem.
If I enable UAC an I click the admin checkbox, I will get the problem.

The only way around this that I can think of is enabling UAC and having two separate WinGetUI executables. One with admin rights and one without admin rights. Same as checking/unchecking the checkbox on demand, so, not really a solution.
Plus that won't be satisfactory to me, because I want to keep UAC disabled.

I don't know how else I can say this. I give up.
My problem won't be solved anyway.

trumpy81 · Dec 13, 2023

Try the following:

1. Disable UAC.
2. Open Terminal by right clicking on the Start menu and select Terminal NOT Terminal (Admin).
3. CD to the location of the file I attached to this post after you have downloaded it etc...
4. Run the file by typing CheckAdmin.bat and press enter.
5. If it states Welcome, Admin, then you are in an elevated cmd window.
6. If it tells you Get lost, User, then you are NOT in an elevated cmd window and you should be able to run winget without admin elevation by cd'ing to it's location and running the exe.

HTH