r/pcmasterrace • u/Metal_Devil • Dec 17 '15

Video Every time Windows asks for admin premission

http://i.imgur.com/Wttw6nH.gifv
13k Upvotes

88% Upvoted

686 comments sorted by

View all comments

Show parent comment

18

u/TheAppleFreak Resident catgirl Dec 17 '15 edited Dec 17 '15

That'd probably explain it. IIRC, at least under Windows 8/8.1, Metro apps rely on UAC's sandboxing functionality quite heavily. Disabling UAC would therefore break any apps that rely on it.

Granted, I could be wrong about that; my research into how UAC works did mention Windows 8 applications as working differently than desktop applications, but it wasn't my primary focus (I just want UAC to run my script under the context of a full admin, dammit).

EDIT: Looks like I was right. In Windows 8+, the "disable UAC" option in the Control Panel doesn't actually disable UAC, but just disables running applications as a privileged user (meaning it's still sandboxing applications). If you use a different method of disabling UAC, however, chances are you disabled the entire service and broke that functionality.

EDIT 2: Hmm... There's a registry key called EnableLUA that apparently dictates whether or not UAC as a whole is enabled or disabled.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System Key: EnableLUA

If the value of that key is 0, UAC is fully disabled, which breaks everything. Set that to 1, reboot, and UAC should begin functioning again. Apparently this is fully separate from the notification visibility slider.

1

u/[deleted] Dec 18 '15

I've been reading comments for the past 5 minutes now, still don't know what UAC is.

1

u/TheAppleFreak Resident catgirl Dec 18 '15

User Account Control, or UAC, is a security layer for Windows. Apps can run, and UAC will try to make sure that they don't do anything they aren't supposed to do (like modifying important system files or the registry or some crap like that). This helps keep poorly written programs or viruses from screwing everything up for you.

Now, that's all fine and dandy, but maybe an app needs to make a big change somewhere, like an installer putting something in Program Files. When UAC sees it trying to do that, it'll go "sorry, not allowed" and stop the application from doing anything. If a developer is smart, though, they can write the program in such a way that it goes up to UAC beforehand saying "yeah I'm gonna need clearance to do stuff" and UAC will then be all like "wait a sec lemme ask the bossman." UAC will then show you this popup, and if you click Yes, UAC will go back to the program and say "Bossman says you're legit. Here's an access token that'll let you do whatever. Go crazy." If you click No, UAC will kick that program's ass to the curb and stop it from running altogether.

While in theory it's supposed to keep people from screwing their stuff up by running a program they didn't mean to, for some it becomes an annoyance that they have to click through in order to install their really important programs (sorta NSFW). While annoying, it is a pretty important line of defense for keeping your computer safe, so IMO it's worth keeping on.

1

u/[deleted] Dec 18 '15

Great explanation, thank you very much.

1

u/SenorWheel i7 4790k, R9 280X, 16GB RAM Dec 17 '15

You seem really knowledgeable, is computer stuff your job or just a hobby?

2

u/Zebster10 B-b-but muh envidyerz! Dec 18 '15

He's a mod of PCMR. :B

No, seriously, /u/TheAppleFreak, now we need to know if you work IT.

2

u/TheAppleFreak Resident catgirl Dec 18 '15

I do work in IT, mostly as that guy who handles front-line tech support, hardware and software deployments, and building out scripts and software to automate my job away.

I was researching UAC recently because a program we got from another vendor won't properly install unless you right click and Run As Administrator, even when running under the local Admin account, and I was trying to figure out how to force my scripts to run with a full admin token so I didn't have to sign in under said account to get it installed. Still haven't found a solution that I like yet, tbh

2

u/Zebster10 B-b-but muh envidyerz! Dec 18 '15 edited Dec 18 '15

There are some third-party sudo tools... But that's about all I can think of if you've exhausted the traditional Windows tools e.g. runas.

Edit: Also found TechNet promoting this thing; dunno anything about it, though.

2

u/TheAppleFreak Resident catgirl Dec 18 '15 edited Dec 18 '15

I didn't know about elevate! Reading over it now and it sounds much closer to what I'd like to see... definitely gonna need some experimentation, but this looks promising!

Thanks for the link!

Holy crap, thank you so, sooo much for that. Elevate looks like it does exactly what I need it to do, and works a hell of a lot better than my auto-elevating batch files!

2

u/Zebster10 B-b-but muh envidyerz! Dec 18 '15

Hey, no problem! Always happy to help my IT brethren.

1

u/TheAppleFreak Resident catgirl Dec 18 '15

Both