Lame QotM: Easy way to see if user has admin rights?

In XP I used to be able to right click the Start button as a way to check if the logged on user had admin rights. If I saw "Explore All Users" I knew the user had admin rights.

i'm using the Domain Admin account on a new machine and i'm trying to run my WSUS client fix batch file and its erroring out as if i didn't have admin rights

mind you, this is the first time i'm using W7 in a domain environment (finally was able to upgrade some boxes) so i feel back in n00b status as i never really had to worry about it at home (not knowing admin rights that is).

sorry if this has been explained elsewhere, but i suck at searching and didn't find anything.

i just want the cheap and cheesy way of checking for admin rights ala XP please!

thx
lv

with the new windows 7 machines come new group policy settings to manage "domain admin" rights on local machines... You'll need to either install server 2008 and DCpromo it OR... You can add the patch to a 2003 DC in order to complete the NEW GPO for the windows 7 machines.

or just manaully add "Domain Admins" through: (control userpasswords2)

thanks for the reply Brady...

you mention a patch for the 2003DC...from everything i've read, i have to have a W7 machine running RSAT in order to do GPO settings for these new machines...what patch are you talking about? Still wondering about this tho...

thanks

Have you tried running the batch file using "Run as Admin..." from the account that doesn't seem to work?

logicearth said:

Have you tried running the batch file using "Run as Admin..." from the account that doesn't seem to work?

Click to expand...

not as of yet...i'm trying to figure out why i would need to "run as admin" when i am logged in under an account that has Domain Admin rights, not to mention nearly all other Admin rights assigned to it...is this part of the issues i'm going to have with 7 boxes and GPO since we are still using Server 2003?

just tried it with "run as admin" and it doesn't work...doesn't even do anything actually...i see the DOS window pop up and then disappear just as fast even tho i have "pause" at the end of the batch...

anyone have any ideas?

The general "Admin" account in Win7 has two keys that are used. One is used to say you are an admin, but the other doesn't. When a program tries to run, it will prompt you for admin access. You don't need to enter a pass as you already are logged in, but you need to accept it.

There is another function of Run as Admin. This allows the program to be ran as a full admin priveledged program and uses both keys (I think). This allows it to have access to more functionality than the regular run and is in place to prevent programs that are malicious and accidentally installed from being able to run administrative tasks without your knowledge. The setup is a little wierd and there is not "whitelist" for programs to allow admin access, but it is a good setup created to better secure the system from malware.

Some resources and some fun stuff:

http://www.sevenforums.com/tutorials/11841-run-administrator.html

http://www.sevenforums.com/tutorials/11949-elevated-program-shortcut-without-uac-prompt-create.html

http://www.sevenforums.com/tutorials/507-built-administrator-account-enable-disable.html

User Account Control (UAC) Documentation for Windows 7, Windows Vista, Windows Server 2008 R2, and Windows Server 2008

lavee383 said:

not as of yet...i'm trying to figure out why i would need to "run as admin" when i am logged in under an account that has Domain Admin rights, not to mention nearly all other Admin rights assigned to it...is this part of the issues i'm going to have with 7 boxes and GPO since we are still using Server 2003?

just tried it with "run as admin" and it doesn't work...doesn't even do anything actually...i see the DOS window pop up and then disappear just as fast even tho i have "pause" at the end of the batch...

Click to expand...

I don't have much experience with the Domain side. when you run the batch though If you open cmd first and then navigate to .bat your window wont close when it is ran.... Maybe there is an error message being shown....

Edit: Run CMD first as admin: http://www.sevenforums.com/tutorials/783-elevated-command-prompt.html

Thorsen...thanks for the reply

well, here's what i'm still scratching my head on...when i run the batch file under the domain admin profile, the batch works great no probs...i don't have to run it with "run as admin" i just double click the file and it performs the net stop command/etc...but when i log in with my domain account (which has every single priv that the domain admin account has) it won't run period...

i just put a pause instruction in the fist line of the batch file and ran it...i'm getting the "System error 5 has occurred. Access is denied"
so then i right click and select Run as Admin, click yes to the security popup, and the DOS window opens and closes just as fast...and this is still with "pause" as the very first command line.
then i copy the batch file to the local drive (its always been out on a network drive that contains all my batch files) and right click and select Run as Admin...click yes to security, and it runs fine...
yet i want to reiterate that the Domain Admin account doesn't need the batch file to be local in order to run it successfully.

thoughts?

Go here
and click to download whoami, run it. A notepad .txt will be on your desktop. It will let you know if you're running as Aministrator, or not.

Edit ... Linky no worky

Let's see if I can upload a .zip for 'whoami

Jacee said:

Go here wng's blog: WhoAmI
and click to download whoami, run it. A notepad .txt will be on your desktop. It will let you know if you're running as Aministrator, or not.

Click to expand...

all i get is " Not Found

Sorry, but you are looking for something that isn't here."

i actually found that whoami file in the system32 folder but same thing...i double click it...DOS window pops up and goes away just as fast...right click, run as...same thing - pops up goes away...

i shift-right click, run as different user, enter creds for the domain admin that works so well and same thing...and i'm not really seeing any txt file showing up...

Did you see my edit and zipped file?

Jacee said:

Did you see my edit and zipped file?

Click to expand...

sorry for the late reply...

got the dl and ran it:

current user: xxx
user is not an admin

so the WhoAmI app you uploaded shows that the user that has Domain Admin rights is not an admin...the user has every Admin right under the sun assigned to it and still is not considered an Admin w/in W7? I don't get it...how am i supposed to assign rights w/out having to assign them locally just to be able to administer the machine?

could it be because i have nothing but 2003 servers? i haven't gotten around to setting up GPO for the 7 machines...that's next on the agenda (via a 7 machine with RSAT).

or do i just have XP blinders on...I'm just trying to figure out how to go about administering these machines w/accounts that have elevated domain rights...but can't do anything on these 7 machines...