Administrator Elevation- one of Win11's most disruptive changes?

It seems anywhere I look in Win11 forums I see "you need to log in from an Administrator account" to do anything useful as an Admin. It seems a fundamental difference from Win10, where at least it was possible to do most Admin tasks in a reasonable manner (other than Win-R, then Ctrl+Shift+Enter, which requires you to remember how to spell things like 'devmgmt.msc' etc).

But I've heard nobody talk about this, and discuss the philosophy behind it. I assume there has been some significant thought gone into it, presumably tightening up security, because it changes the the way local admin tasks happen, and frankly, makes Win11 horrible to work with from an Administrative perspective.

It affects us now directly because security policies mandate that all local user accounts are 'standard'. In Win10 you could at least use Admin access and do useful stuff (like open Device Manager as admin). Now it's a monumental pain.

Can anyone please shed some light on this? Is there a reg hack to make it 'normal' again?

TIA


Related: Win11 Can't start Device Manager as Administrator in Win+x menu, can in Win10

radsdau​

My local user account is Administrator?

The hidden “Administrator” account is virtually the same as other accounts with administrator permissions. The only difference is that the built-in account doesn’t receive User Account Control (UAC) notifications, which means everything runs elevated. The best explanation I've ever read comes from howtogeek.com


"If you own your own PC and it isn’t managed by your workplace, you’re probably using an administrator account.


But even if you are using an administrator account on Windows, not every application needs full administrator permissions. In fact, that’s bad for security—your web browser shouldn’t have full access to your entire operating system. UAC limits the permissions that applications have, even when you launch them from an administrator account. When you select "run as administrator," it's that hidden administrator account's priviledges that you are using. UAC gets out of the way, and the application is run with full administrator access to everything on your system.


So when you run an app as an administrator, it means you are giving the app special permissions to access restricted parts of your Windows 10 system that would otherwise be off-limits. This brings potential dangers, but it is also sometimes necessary for certain programs to work correctly."

Yes.

Thanks all. But the point is, standard security measures mandate that local users CANNOT be Administrators. We ran like this for years, but now a recent security membership mandates a bunch of changes, this being a non-negotiable.

The in-built Admin account is enabled and UAC set to High, to permit power-user activities, such as installing / updating drivers, changing network adapter settings, etc.

In win10 you could still do Admin stuff, it just popped up a UAC window and you had to know the Admin password to proceed. Now it seems Win11 doesn't even give you that choice. It's so blatant that it must have been a conscious design choice - a crippling one.

See this post for a clear example of what you can no longer do in Win11 that used to be possible in Win10.

Very late for me but your example for Device Manager runs under MMC.exe on Windows 10 and is called with local user account whether or not you press a key combination or not.

This is on Windows 10. I'll try to look at what you're saying more tomorrow if I get time.





I assume you're speaking of Windows 11 Pro or Enterprise on an Active Directory domain and not Windows 11 Home?

Holding down Ctrl+Shift keys while clicking on Device Manager in the power user menu on my Windows 11 Home does run it as an admin for me with the UAC prompt asking for my consent.

hdmi said:

Holding down Ctrl+Shift keys while clicking on Device Manager in the power user menu on my Windows 11 Home does run it as an admin for me with the UAC prompt asking for my consent.

Click to expand...

Interesting. Exactly that scenario is what does NOT work for me, and is what I regularly use. I'll have to dig in a bit deeper.
Yes, Pro for all Windows versions.

radsdau said:

Yes, Pro for all Windows versions.

Click to expand...

But is it in a home environment or are these work computers joined to an Active Directory domain?

radsdau said:

It seems anywhere I look in Win11 forums I see "you need to log in from an Administrator account" to do anything useful as an Admin. It seems a fundamental difference from Win10, where at least it was possible to do most Admin tasks in a reasonable manner (other than Win-R, then Ctrl+Shift+Enter, which requires you to remember how to spell things like 'devmgmt.msc' etc).

But I've heard nobody talk about this, and discuss the philosophy behind it. I assume there has been some significant thought gone into it, presumably tightening up security, because it changes the the way local admin tasks happen, and frankly, makes Win11 horrible to work with from an Administrative perspective.

It affects us now directly because security policies mandate that all local user accounts are 'standard'. In Win10 you could at least use Admin access and do useful stuff (like open Device Manager as admin). Now it's a monumental pain.

Can anyone please shed some light on this? Is there a reg hack to make it 'normal' again?

TIA


Related: Win11 Can't start Device Manager as Administrator in Win+x menu, can in Win10

Click to expand...

I really can't figure out what you're talking about. I'm running Win 11 Home with my Microsoft account and it runs as an administrator by default. I have none of the issues you mention.

@radsdau As @hdmi said, holding Ctrl+Shift when clicking Device Manger in the Win+X Menu works... however, not sure how it worked in Windows 10, but what you might be missing... I tested this and if you open the menu, hold the keys and click it does NOT work. You have to hold the keys BEFORE opening the menu and it'll work.

Dch48 said:

really can't figure out what you're talking about

Click to expand...

I think he's referring to why when in this forum and others we sometimes say to run as administrator and he wants to know why when his account has administrative priviledges.
example: we might say open a command prompt and run as administrator.

The answer is explained in post #3.

radsdau said:

Win11 doesn't even give you that choice.

Click to expand...

Yes it does, both from the right click context menu when you select an .exe file as well as from the search results when you search from the start menu.

Archigos said:

@radsdau As @hdmi said, holding Ctrl+Shift when clicking Device Manger in the Win+X Menu works... however, not sure how it worked in Windows 10, but what you might be missing... I tested this and if you open the menu, hold the keys and click it does NOT work. You have to hold the keys BEFORE opening the menu and it'll work.

Click to expand...

If I hold down those keys, the Win-X menu will not open at all.

Yes, holding Ctrl+Shift, you can not hold Win+X at the same time, it doesn't open, but if you hold Ctrl+Shift you can right-click the start button for the menu to pop up.

glasskuter said:

I think he's referring to why when in this forum and others we sometimes say to run as administrator and he wants to know why when his account has administrative priviledges.
example: we might say open a command prompt and run as administrator.

Click to expand...

No I think he's saying he can't gain admin privileges from a standard account. I've never run a standard account so I have no idea what's needed.

How can you tell if Device Manager is running as admin or not? Mine just always says Device Manager at the top.

Honestly didn't see a difference when I did it either but figured maybe I missed something so I ignored that.

radsdau said:

local users CANNOT be Administrators

Click to expand...

Not true.The user that is established when you install windows automatically is put into the administrative group whether it is a microsoft account or a local account. Any new users this account adds can be given administrative privileges as well..

Dch48 said:

No I think he's saying he can't gain admin privileges from a standard account.

Click to expand...

A standard user has NEVER had a way to gain administrative privileges. It is and always has been by design. So if that is indeed what he's asking, he's out of luck until the administrator of the computer changes his privileges..

glasskuter said:

A standard user has NEVER had a way to gain administrative privileges. It is and always has been by design. So if that is indeed what he's asking, he's out of luck until the administrator of the computer changes his privileges..

Click to expand...

He said this;

It affects us now directly because security policies mandate that all local user accounts are 'standard'. In Win10 you could at least use Admin access and do useful stuff (like open Device Manager as admin). Now it's a monumental pain.

Click to expand...

I didn't think it was ever possible either.