Problem with Administrator account

It's a bit long story that I got over it initially, but it seems I still have something hiding away.

A. It started after I disabled the Defender's real time scanning, to install a sizeable program.
I restarted Windows at the end of the installation and went to check the Defender's status.
It was still disabled (should have reverted after the reboot). Even worse, I couldn't enable it again!! And I was still showing as an admin.
I created another user (same name I was using with a number 2 added to it). Also an administrator.
Restarted logged in a the new user, forgot the password 2-3 times and locked into a loop. Rebooting, I only had the new user as a choice.
I made a bootable USB, got to the main disk through DOS and copied the text file where I keep my password, over to the USB.
After I read the password, I started the main computer and the silly thing came alive as usual. It seems that the bad password lock has a timeout...

Other than a question on how could the administrator rights misbehave, the first part is done with.

Now I have my normal admin (kanen), the new admin (kanen2) I never used, and the PC's admin group with those 2 accounts in it.

B. I tried to install another big application but it would crash soon as I run its main program.
So I started uninstalling and reinstalling it in various ways:
Making the installer's compatibility to run as admin. crashed the same way. Same with running the installer in an admin command prompt.
Last I tried the administrator prompt from PowerRun v1.8.
And the program started!!

Except, the profile folder it created, wasn't under C:\Users\kanen\AppData\Roaming\ (like it was supposed to be), but instead under C:\Windows\System32\config\systemprofile\AppData\Roaming

And that makes it useless since the program can't update its preferences, and even MsEdge can't write its own control folder into that path.
Copying/pasting whatever was in there to where it was supposed to go and trying to change the program's preferences, doesn't work. (Folder must be empty or contain valid data is the response when I reassign that folder).

So why the normal admin installation doesn't work, and PowerRun works but doesn't use the current user's environment?
And is there a way to make sure my normal admin is real and not a look-alike? Switch to the built-in admin, and flip-flop the normal account's admin maybe?

Sorry if I didn't phrase the above properly and I hope it's understandable.

Cheers.

Ask the developer in regards to Power run, but also this seems unnecessary to run programs. Also would be nice to know what program.

• Does the program actually need admin rights to run?
• Admin rights don't misbehave, they operate the same every time, so I would suspect something else is the issue.
• Since you're using one 3rd party tool, are there others in play?
• Any system modifications, debloating etc, if so which?
• What version/edition of Windows?

A rewrite. Just when I was to specify the Win version I use, without saving a draft or going first to another tab to check the system specs, I clicked on my name to get to them. When I went back, what I had written was gone

The installer needs Admin privileges. The program executable needs them also just to be on the safe side. Now it needs them for sure.

That has been my experience too about Admin rights. But if it didn't let me change the Defender's status. Something went wrong then. That part at least has been corrected on its own.

I use some 3rd-party utilities since earlier versions of this program. Glary Utilities, SirCleaner, TweakNow WinSecret Plus and such.
But if they caused a problem, that would have affected the earlier versions of this program (I think).

No debloating. I use the 3rd-part utilities to disable gaming stuff and things I don't use.

I use Windows 11 Pro for Workstations 26H2 26300.9711

And a thought occurred to me!
I checked PowerRun. Its Options specified "System + TrustedInstaller". Maybe that caused it to create the program's Preferences in that \Windows untouchable folder.
I'll uninstall and reinstall the program using in PowerRun "Only System" and see if Prefs install in the right place. I'll update the thread with the results...

Installing with PowerRun set to Only System will still put the preferences under `C:\Windows\System32\config\systemprofile`, since that option also runs the program as the SYSTEM account.

Start the program once from your own account so it crashes, then open Event Viewer > Windows Logs > Application. The Error event with ID 1000 at the time of the crash has a "Faulting module name" line with the file the program crashed in.

To check that kanen is a real administrator, run this in a Command Prompt opened with Run as administrator:

whoami /groups | findstr /i "S-1-5-32-544 S-1-16-12288"

The output should show `BUILTIN\Administrators` with "Enabled group" and `Mandatory Label\High Mandatory Level`.

Drafted with AI.

ET Ducky said:

Drafted with AI.

Click to expand...

Ok now I see the problem.

I can't say this is fun, but it's interesting.

I copied with Robocopy the preferences that were created in the locked folder into where they were supposed to go to by default.
But starting the program as usual, it still crashed.

The event log had only one entry of the main program crashing and minimal details.
I run the dump though an old favorite of mine (debugwiz 1.0.0.3) and saw where it had crashed in some routine. A normal display support dll belonging to the program. Some glitch in system rights (or the graphics driver), so I didn't bother to resolve it since PowerRun could handle it.

Concerning PowerRun. I updated it to v1.9 and run a short test:
1. The program on its own, still couldn't start.
2. PowerRun with only 'System' selected in its options, couldn't run either.
3. PowerRun with "System + TrustedInstaller" started properly and the program used the Preferences folder I had copied to the default folder. But it would most probably create it in that locked folder if it was a new installation.
4. A glitch left is that when I try to point some program preference setting to a folder, its browser (or Windows Explorer) first try to go through that locked area looking for the "desktop" folder that is not there. I close that error popup and then I can browse elsewhere. Well, not much is perfect in life.

I had already checked with the whoami and it looked fine. I did it again to get a screen capture:

A plain 'whoami' tells me that I am ComputerName\kanen.
And the same plain "whoami" in the administrator command opened by PowerRun (in System + TrustedInstaller mode), tells me that I am "nt authority\system"
Maybe I could put myself in the "nt authority" group and get it over with these hassles

I still don't know why this started up with this program but it should resolve itself with some future system update. For now, PowerRun...

Much appreciated for all comments and suggestions.

KevTech said:

Ok now I see the problem.

Click to expand...

I'm still trying to isolate it so that I can provide a solution. Sounds like you already know what is wrong. What problem do you see?

The problem is that I have to use extra system rights for a program that used to work under my account for years.
The program is used by thousands of people and very few mention a similar problem.
In my case, I've switched to the latest Win 11 26H2 and a new NVidia driver came out at about the same time. I can't think of anything else that's major, except of my admin account misbehaving for a short time for some unknown reason.
The program software could have installed some graphics or system replacement library that conflicts with what I have installed. That I suppose is the most possible scenario but how could PowerRun's extra rights get around around a software conflict that causes a crash?

Anyway. I'll keep investigating too...

Thanks for looking into this.

Running it as SYSTEM also loads a different user profile and registry hive, so per-user settings for the program stop applying, such as a compatibility mode flag or a per-app graphics preference for the new NVIDIA driver. That would likely explain why the display DLL crashes only under your own account.

Does the program's exe have an entry under `HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers`, or a custom option in Settings > System > Display > Graphics?

Drafted with AI.

There are a few programs in the registry under "Layers". Almost all are flagged to RUNASADMIN.
The problematic program is not in the list but its *.exe is checked to run as admin.
In the graphics settings, this program and others of its kind, are set to run under the NVidia RTX.
I tried all the varieties in choosing GPU but it made no difference.

I'll make one more run of sfc and disasm now.
Next I'll try to reset the drives/folders/Files security just in case. Fixing the folders of this program though, didn't change anything.
Then a clean-up of Defender and its signatures. I'm getting some event errors 16 from it that I see around the time I run this program.

Now I think that the update to the latest 26H2 wasn't as smooth as it looked

kanenas said:

I had already checked with the whoami and it looked fine. I did it again to get a screen capture

Click to expand...

Wrong command as that just shows the built in administrator account which is why using AI for this is just stupid.

This will show you what group your account is in.

net user %username%

Will be listed toward the bottom.



You can also use this command which will open user accounts and you can see what group you are in.

Netplwiz

What program you installing that you had to disable defender?

`whoami /groups` lists the groups of the account that runs it, so from kanen's own Command Prompt it checks kanen and not the built-in Administrator (Microsoft's page for the command: whoami).

`S-1-5-32-544` is the SID of the local Administrators group, the same group `net user %username%` lists as `*Administrators`.

`whoami /groups` also shows `Mandatory Label\High Mandatory Level` when the prompt is elevated, which `net user` doesn't.

Drafted with AI.

Personal note:

Wrong command as that just shows the built in administrator account which is why using AI for this is just stupid.

Click to expand...

If the pace of October 2026 is too much for you to handle I implore you to retire. Participating in forums is an excellent way to gain knowledge in a breadth of scenarios and using AI to find interesting threads and learn new troubleshooting methods is a great way to form new synaptic connections. I read the drafts, study them, understand them, and validate them. They're a tool to learn and help. This sort of critique is sad.

kanenas said:

There are a few programs in the registry under "Layers". Almost all are flagged to RUNASADMIN.
The problematic program is not in the list but its *.exe is checked to run as admin.
In the graphics settings, this program and others of its kind, are set to run under the NVidia RTX.
I tried all the varieties in choosing GPU but it made no difference.

I'll make one more run of sfc and disasm now.
Next I'll try to reset the drives/folders/Files security just in case. Fixing the folders of this program though, didn't change anything.
Then a clean-up of Defender and its signatures. I'm getting some event errors 16 from it that I see around the time I run this program.

Now I think that the update to the latest 26H2 wasn't as smooth as it looked

Click to expand...

Which log is event 16 in, and what are its Source and the first line of the text on its General tab?

Drafted with AI.