Administrator Elevation- one of Win11's most disruptive changes?

radsdau · Feb 16, 2022

It seems anywhere I look in Win11 forums I see "you need to log in from an Administrator account" to do anything useful as an Admin. It seems a fundamental difference from Win10, where at least it was possible to do most Admin tasks in a reasonable manner (other than Win-R, then Ctrl+Shift+Enter, which requires you to remember how to spell things like 'devmgmt.msc' etc).

But I've heard nobody talk about this, and discuss the philosophy behind it. I assume there has been some significant thought gone into it, presumably tightening up security, because it changes the the way local admin tasks happen, and frankly, makes Win11 horrible to work with from an Administrative perspective.

It affects us now directly because security policies mandate that all local user accounts are 'standard'. In Win10 you could at least use Admin access and do useful stuff (like open Device Manager as admin). Now it's a monumental pain.

Can anyone please shed some light on this? Is there a reg hack to make it 'normal' again?

TIA

Related: Win11 Can't start Device Manager as Administrator in Win+x menu, can in Win10

Ghot · Feb 16, 2022

radsdau

My local user account is Administrator?

glasskuter · Feb 16, 2022

The hidden “Administrator” account is virtually the same as other accounts with administrator permissions. The only difference is that the built-in account doesn’t receive User Account Control (UAC) notifications, which means everything runs elevated. The best explanation I've ever read comes from howtogeek.com

"If you own your own PC and it isn’t managed by your workplace, you’re probably using an administrator account.

But even if you are using an administrator account on Windows, not every application needs full administrator permissions. In fact, that’s bad for security—your web browser shouldn’t have full access to your entire operating system. UAC limits the permissions that applications have, even when you launch them from an administrator account. When you select "run as administrator," it's that hidden administrator account's priviledges that you are using. UAC gets out of the way, and the application is run with full administrator access to everything on your system.

So when you run an app as an administrator, it means you are giving the app special permissions to access restricted parts of your Windows 10 system that would otherwise be off-limits. This brings potential dangers, but it is also sometimes necessary for certain programs to work correctly."

hdmi · Feb 17, 2022

Yes.

radsdau · Feb 17, 2022

Thanks all. But the point is, standard security measures mandate that local users CANNOT be Administrators. We ran like this for years, but now a recent security membership mandates a bunch of changes, this being a non-negotiable.

The in-built Admin account is enabled and UAC set to High, to permit power-user activities, such as installing / updating drivers, changing network adapter settings, etc.

In win10 you could still do Admin stuff, it just popped up a UAC window and you had to know the Admin password to proceed. Now it seems Win11 doesn't even give you that choice. It's so blatant that it must have been a conscious design choice - a crippling one.

See this post for a clear example of what you can no longer do in Win11 that used to be possible in Win10.

AdvancedSetup · Feb 17, 2022

Very late for me but your example for Device Manager runs under MMC.exe on Windows 10 and is called with local user account whether or not you press a key combination or not.

This is on Windows 10. I'll try to look at what you're saying more tomorrow if I get time.

I assume you're speaking of Windows 11 Pro or Enterprise on an Active Directory domain and not Windows 11 Home?

hdmi · Feb 17, 2022

Holding down Ctrl+Shift keys while clicking on Device Manager in the power user menu on my Windows 11 Home does run it as an admin for me with the UAC prompt asking for my consent.

radsdau · Feb 17, 2022

hdmi said:
Holding down Ctrl+Shift keys while clicking on Device Manager in the power user menu on my Windows 11 Home does run it as an admin for me with the UAC prompt asking for my consent.

Interesting. Exactly that scenario is what does NOT work for me, and is what I regularly use. I'll have to dig in a bit deeper.
Yes, Pro for all Windows versions.

AdvancedSetup · Feb 17, 2022

radsdau said:
Yes, Pro for all Windows versions.

But is it in a home environment or are these work computers joined to an Active Directory domain?

Dch48 · Feb 17, 2022

radsdau said:
It seems anywhere I look in Win11 forums I see "you need to log in from an Administrator account" to do anything useful as an Admin. It seems a fundamental difference from Win10, where at least it was possible to do most Admin tasks in a reasonable manner (other than Win-R, then Ctrl+Shift+Enter, which requires you to remember how to spell things like 'devmgmt.msc' etc).

But I've heard nobody talk about this, and discuss the philosophy behind it. I assume there has been some significant thought gone into it, presumably tightening up security, because it changes the the way local admin tasks happen, and frankly, makes Win11 horrible to work with from an Administrative perspective.

It affects us now directly because security policies mandate that all local user accounts are 'standard'. In Win10 you could at least use Admin access and do useful stuff (like open Device Manager as admin). Now it's a monumental pain.

Can anyone please shed some light on this? Is there a reg hack to make it 'normal' again?

TIA

Related: Win11 Can't start Device Manager as Administrator in Win+x menu, can in Win10

I really can't figure out what you're talking about. I'm running Win 11 Home with my Microsoft account and it runs as an administrator by default. I have none of the issues you mention.

Archigos · Feb 17, 2022

@radsdau As @hdmi said, holding Ctrl+Shift when clicking Device Manger in the Win+X Menu works... however, not sure how it worked in Windows 10, but what you might be missing... I tested this and if you open the menu, hold the keys and click it does NOT work. You have to hold the keys BEFORE opening the menu and it'll work.

glasskuter · Feb 17, 2022

Dch48 said:
really can't figure out what you're talking about

I think he's referring to why when in this forum and others we sometimes say to run as administrator and he wants to know why when his account has administrative priviledges.
example: we might say open a command prompt and run as administrator.

The answer is explained in post #3.

radsdau said:
Win11 doesn't even give you that choice.

Yes it does, both from the right click context menu when you select an .exe file as well as from the search results when you search from the start menu.

Dch48 · Feb 17, 2022

Archigos said:
@radsdau As @hdmi said, holding Ctrl+Shift when clicking Device Manger in the Win+X Menu works... however, not sure how it worked in Windows 10, but what you might be missing... I tested this and if you open the menu, hold the keys and click it does NOT work. You have to hold the keys BEFORE opening the menu and it'll work.

If I hold down those keys, the Win-X menu will not open at all.

Archigos · Feb 17, 2022

Yes, holding Ctrl+Shift, you can not hold Win+X at the same time, it doesn't open, but if you hold Ctrl+Shift you can right-click the start button for the menu to pop up.

Dch48 · Feb 17, 2022

glasskuter said:
I think he's referring to why when in this forum and others we sometimes say to run as administrator and he wants to know why when his account has administrative priviledges.
example: we might say open a command prompt and run as administrator.

No I think he's saying he can't gain admin privileges from a standard account. I've never run a standard account so I have no idea what's needed.

Dch48 · Feb 17, 2022

How can you tell if Device Manager is running as admin or not? Mine just always says Device Manager at the top.

Archigos · Feb 17, 2022

Honestly didn't see a difference when I did it either but figured maybe I missed something so I ignored that.

glasskuter · Feb 17, 2022

radsdau said:
local users CANNOT be Administrators

Not true.The user that is established when you install windows automatically is put into the administrative group whether it is a microsoft account or a local account. Any new users this account adds can be given administrative privileges as well..

glasskuter · Feb 17, 2022

Dch48 said:
No I think he's saying he can't gain admin privileges from a standard account.

A standard user has NEVER had a way to gain administrative privileges. It is and always has been by design. So if that is indeed what he's asking, he's out of luck until the administrator of the computer changes his privileges..

Dch48 · Feb 17, 2022

glasskuter said:
A standard user has NEVER had a way to gain administrative privileges. It is and always has been by design. So if that is indeed what he's asking, he's out of luck until the administrator of the computer changes his privileges..

He said this;

It affects us now directly because security policies mandate that all local user accounts are 'standard'. In Win10 you could at least use Admin access and do useful stuff (like open Device Manager as admin). Now it's a monumental pain.

I didn't think it was ever possible either.

Administrator Elevation- one of Win11's most disruptive changes?

New member

My Computer My Computer

At a glance

Well-known member

radsdau​

My Computers My Computers

At a glance

At a glance

aka Mama Glass

My Computers My Computers

At a glance

At a glance

Jack of all trades – master of none

My Computers My Computers

At a glance

At a glance

New member

My Computer My Computer

At a glance

Malwarebytes Staff

My Computer My Computer

At a glance

Jack of all trades – master of none

My Computers My Computers

At a glance

At a glance

New member

My Computer My Computer

At a glance

Malwarebytes Staff

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

aka Mama Glass

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

aka Mama Glass

My Computers My Computers

At a glance

At a glance

aka Mama Glass

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

My Computer

radsdau

My Computers

My Computers

My Computers

My Computer

My Computer

My Computers

My Computer

My Computer

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers