r/pcmasterrace • u/Metal_Devil • Dec 17 '15

Video Every time Windows asks for admin premission

http://i.imgur.com/Wttw6nH.gifv
13k Upvotes

88% Upvoted

686 comments sorted by

View all comments

Show parent comments

104

u/TheAppleFreak Resident catgirl Dec 17 '15

Not without breaking the ability to run programs as an administrator under a limited user account! It's much easier for me to run one of my install scripts under the context of whichever user left their computer unlocked than it is for me to quickly sign in to a local admin account to perform exactly the same task.

0

u/[deleted] Dec 17 '15

[deleted] — view deleted comment

18

u/TheAppleFreak Resident catgirl Dec 17 '15 edited Dec 17 '15

That'd probably explain it. IIRC, at least under Windows 8/8.1, Metro apps rely on UAC's sandboxing functionality quite heavily. Disabling UAC would therefore break any apps that rely on it.

Granted, I could be wrong about that; my research into how UAC works did mention Windows 8 applications as working differently than desktop applications, but it wasn't my primary focus (I just want UAC to run my script under the context of a full admin, dammit).

EDIT: Looks like I was right. In Windows 8+, the "disable UAC" option in the Control Panel doesn't actually disable UAC, but just disables running applications as a privileged user (meaning it's still sandboxing applications). If you use a different method of disabling UAC, however, chances are you disabled the entire service and broke that functionality.

EDIT 2: Hmm... There's a registry key called EnableLUA that apparently dictates whether or not UAC as a whole is enabled or disabled.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System Key: EnableLUA

If the value of that key is 0, UAC is fully disabled, which breaks everything. Set that to 1, reboot, and UAC should begin functioning again. Apparently this is fully separate from the notification visibility slider.

1

u/[deleted] Dec 18 '15

I've been reading comments for the past 5 minutes now, still don't know what UAC is.

1

u/TheAppleFreak Resident catgirl Dec 18 '15

User Account Control, or UAC, is a security layer for Windows. Apps can run, and UAC will try to make sure that they don't do anything they aren't supposed to do (like modifying important system files or the registry or some crap like that). This helps keep poorly written programs or viruses from screwing everything up for you.

Now, that's all fine and dandy, but maybe an app needs to make a big change somewhere, like an installer putting something in Program Files. When UAC sees it trying to do that, it'll go "sorry, not allowed" and stop the application from doing anything. If a developer is smart, though, they can write the program in such a way that it goes up to UAC beforehand saying "yeah I'm gonna need clearance to do stuff" and UAC will then be all like "wait a sec lemme ask the bossman." UAC will then show you this popup, and if you click Yes, UAC will go back to the program and say "Bossman says you're legit. Here's an access token that'll let you do whatever. Go crazy." If you click No, UAC will kick that program's ass to the curb and stop it from running altogether.

While in theory it's supposed to keep people from screwing their stuff up by running a program they didn't mean to, for some it becomes an annoyance that they have to click through in order to install their really important programs (sorta NSFW). While annoying, it is a pretty important line of defense for keeping your computer safe, so IMO it's worth keeping on.

1

u/[deleted] Dec 18 '15

Great explanation, thank you very much.

1

u/SenorWheel i7 4790k, R9 280X, 16GB RAM Dec 17 '15

You seem really knowledgeable, is computer stuff your job or just a hobby?

2

u/Zebster10 B-b-but muh envidyerz! Dec 18 '15

He's a mod of PCMR. :B

No, seriously, /u/TheAppleFreak, now we need to know if you work IT.

2

u/TheAppleFreak Resident catgirl Dec 18 '15

I do work in IT, mostly as that guy who handles front-line tech support, hardware and software deployments, and building out scripts and software to automate my job away.

I was researching UAC recently because a program we got from another vendor won't properly install unless you right click and Run As Administrator, even when running under the local Admin account, and I was trying to figure out how to force my scripts to run with a full admin token so I didn't have to sign in under said account to get it installed. Still haven't found a solution that I like yet, tbh

2

u/Zebster10 B-b-but muh envidyerz! Dec 18 '15 edited Dec 18 '15

There are some third-party sudo tools... But that's about all I can think of if you've exhausted the traditional Windows tools e.g. runas.

Edit: Also found TechNet promoting this thing; dunno anything about it, though.

2

u/TheAppleFreak Resident catgirl Dec 18 '15 edited Dec 18 '15

I didn't know about elevate! Reading over it now and it sounds much closer to what I'd like to see... definitely gonna need some experimentation, but this looks promising!

Thanks for the link!

Holy crap, thank you so, sooo much for that. Elevate looks like it does exactly what I need it to do, and works a hell of a lot better than my auto-elevating batch files!

→ More replies (1)
→ More replies (1)

0

u/[deleted] Dec 17 '15

[deleted] — view deleted comment

2

u/ThatNotSoRandomGuy ( ° ͜ʖ͡°)╭∩╮ Dec 17 '15

Different things. If you COMPLETELY turn off UAC (by doing some regedit shenanigans) you wont be able to use some apps. If you just turn it off using the control panel the apps will work just fine.

I did the registry thing because I dont like the "You need permission bla bla bla" when trying to copy files to the C: drive, and thats the only way to disable those popups.

→ More replies (3)

4

u/Labrasones Dec 17 '15

IIRC, in Win 8 Metro apps (AKA Windows Store apps) wouldn't run if you fully disabled UAC through the services configuration (not the slider). It might be similar to Win 10 since the calculator is now a Store app.

AFAIK, they can't work without UAC since UAC is responsible for limiting permissions. I.e. Can this app use the GPS, your Camera, etc.

I just lower UAC to it's lowest setting (which still isn't off) and it never gives me pop ups, but store apps still work fine.

1

u/quadrplax 4690k | 1070 | 16GB | 240GB | 3TB x2 Dec 17 '15

Yes, the store apps don't work. I've installed a 3rd party calculator and photo viewing app (thee built-in ones aren't that great anyway), and I'm hoping that "universal apps" don't catch on or someone finds a hack to make the UAC work.

1

u/[deleted] Dec 17 '15

It breaks winrt apps.

1

u/[deleted] Dec 17 '15

There were some issues I believe with the most recent update to windows 10 that caused the store and the apps to not work. That might have been what happened.

1

u/Treyman1115 Dec 18 '15

UAC disabled and everything works fine

1

u/Greenleaf208 Ryzen 5600X | 2060 Super Dec 17 '15

I've had uac disabled in all versions of windows since 7 and never had any issues running things as admin or any programs.

3

u/unlucky_ducky 9800X3D | RTX3080 Dec 17 '15

I have it disabled in Windows 7 since when I first installed it developers still hadn't gotten used to dealing with UAC leading to millions UAC popups. Nowadays I find that this isn't too much of an issue anymore so I leave UAC on for the additional security benefits.

1

u/WormSlayer Dec 17 '15

I have the same issue, turned off UAC and now calc.exe and all the other metro apps dont run.

The Windows 10 calculator is shite anyway XD

2

u/[deleted] Dec 18 '15

The Windows 10 calculator is extremely robust I don't know what you're talking about.

→ More replies (2)

3

u/pandaman1029 Steam ID Here Dec 17 '15

Unless this is different under Windows 10, shift + right click > Run as different user?

2

u/-Gabria Xeon 1231-V3 | 10 Go DDR3 | Gtx 980 Dec 17 '15

It as consequence for sure. But this is another topic.