How do I make myself always administrator?

[juanantoniod]

Hello,

I am so tired of being prompted to either allow administrator rights or being told that I cannot do something because I do not have administrator rights. I own this darn computer, why can't I do what I want with it?

For example, I was trying to run SFC /scannow from a command prompt window. The system said it would not let me because I did not have administrator rights.

How can I make myself permanently the administrator of my own computers?

At the very least, how can I elevate myself to run sfc /scannow?

Thanks!

 

[WindowsStar]

Here you go:

http://www.sevenforums.com/tutorials/507-built-administrator-account-enable-disable.html

 

[zigzag3143]

Hello,

I am so tired of being prompted to either allow administrator rights or being told that I cannot do something because I do not have administrator rights. I own this darn computer, why can't I do what I want with it?

For example, I was trying to run SFC /scannow from a command prompt window. The system said it would not let me because I did not have administrator rights.

How can I make myself permanently the administrator of my own computers?

At the very least, how can I elevate myself to run sfc /scannow?

Thanks!

How many users on your machine? If only one that one was set up as administrator

 

[brummyfan]

Right click cmd prompt and select "Run as Admin".HTH.

 

[juanantoniod]

How it went...

Thanks to everyone, since you all contributed, I am going to write a combined reply.

First, I am the one and only user and, as far as I know, the only account on the computer, so I don't think that I need to enable the system admin account, as much as I need to make my account permanently logged in with administrator privileges.

Thanks for showing me where to go to elevate to admin. I did not know there was a command prompt "accessory" that could be right clicked on and run as admin. I always just did run > cmd <ENTER>

So, I went to that, and elevated myself, then "enabled" the system admin account, and rebooted my computer and nothing came up any differently, as it showed when the new account was enabled in the tutorial. Just to check, and because I wanted to run sfc /scannow, I went to cmd, and it put me right back in the users directory. I tried to run the sfc /scannow and was told again that I do not have rights.. (What is up with that? :huh: ) So, I right clicked on command prompt accessory and ran as admin, then was able to run sfc /scannow. It is now at 79% and counting.

But, for the future, is there not a way to make me, the one and only user of this computer, the "elevated admin" with full privileges so that I don't get this error any more?

Thanks guys! :shock:

 

[zigzag3143]

Thanks to everyone, since you all contributed, I am going to write a combined reply.

First, I am the one and only user and, as far as I know, the only account on the computer, so I don't think that I need to enable the system admin account, as much as I need to make my account permanently logged in with administrator privileges.

Thanks for showing me where to go to elevate to admin. I did not know there was a command prompt "accessory" that could be right clicked on and run as admin. I always just did run > cmd <ENTER>

So, I went to that, and elevated myself, then "enabled" the system admin account, and rebooted my computer and nothing came up any differently, as it showed when the new account was enabled in the tutorial. Just to check, and because I wanted to run sfc /scannow, I went to cmd, and it put me right back in the users directory. I tried to run the sfc /scannow and was told again that I do not have rights.. (What is up with that? :huh: ) So, I right clicked on command prompt accessory and ran as admin, then was able to run sfc /scannow. It is now at 79% and counting.

But, for the future, is there not a way to make me, the one and only user of this computer, the "elevated admin" with full privileges so that I don't get this error any more?

Thanks guys! :shock:

Yes there is. enabled the built in Administrator account log in on it and promote your self to admin. then close the built in admin account

to enable the account.start>search>cmd>net user /administrator:enable (i think. is either enable or true)

Let us know if you need help

ken

 

[juanantoniod]

I am the administrator...

I appreciate your help. When I set up Windows, I only created one account -- my own. I purposely did not create a separate admin and user account. Yeah, when I go to my Windows Explorer, c:\users, there is me, Antonio, Default, and Public. No separate admin. I still want to know how to fix this, but now I also need to know how to access the file log that scannow created. It finished, said there were some errors, and some were not able to fix, and gave me the log file name and location. I browsed to the log file location in WinExplorer, and double clicked on it, and it blaringly says, "Access Denied!", as if to taunt me... j/k

It's just a txt file and identified as a Notepad document, so I do not understand what the big deal is... Any ideas?

Thanks very much!

P.S. I did do that net user /administrator:enable command, and it finished without error, then I rebooted as instructed, and was taken right back to my own account.

P.P.S. Maybe there is a matter of semantics here. I do not need nor want an administrator account. *I* am the administrator account, but it just does not give me administrator privileges. Does that help at all?

 

[Barman58]

Hi Antonio,

Firstly I must state that running as a full admin is a very bad Idea, from a security standpoint.

That being said you have two possibilities

you can enable the Hidden administrator - rename this account, if you wish, and run as this user all the time, You will need to set up the user preferences as you prefer and then delete your original user account.
The major issue of this method is that it duplicates all the bad security practices that became common in XP.

Another option that is similar, (but will not give quite the same access as the first), is to run as the account you now have but to disable the UAC which should give you administrator access to the system.
There are area of a win7 setup which do not as installed have the Administrator group assigned as owner and for these rare items you will need to run as the Hidden administrator.

the best option for todays environment is to get used to the way that Windows 7, and other modern systems such as Linux work, with administrator rights

 

[juanantoniod]

Thank you, Barman58!

Hello Barman58,

Thanks for your helpful comments! I guess I will back into this by saying that I understand where you are coming from about user rights, etc., having worked in a UNIX environment at the Santa Cruz Operation, and then later having dealt with setting individual's network permissions as a Netware(?) administrator. However, from what I learned at SCO, the sysadms were the GODS of the system, the "masters of the [virtual] kingdom". I think of myself as the master of my own computer. It's mine, and I try to take care not to do things that would get me into trouble.

With that said, I do not even mind the "Do you want to run this..." prompts, although pretty much everyone else does. What really bugs me is being told that I do not have rights on my own system! :shock: I guess it's just the language that I need to get over, but it just bugs me. So, what you're proposing, turning off UAC, I think, would not solve this issue. I think the issue would need to be done the other way you mentioned, and I do not care to do that at this point, because I don't want to create a new account, re-do the settins, etc.

But, for my next Windows install, perhaps you can tell me how to start fresh as this sysadm user? And...I would appreciate any input you have about why it is that users need to be "protected" from computers. They are not danerous. Well, maybe if a battery explodes or something, but I was always taught that users can't do anything to harm a computer. It's just hardware. My instructors and me, when I was teaching, always said, to people, don't be afraid, you can't break it.

As an aside, I am familiar with this thinking, although I do not understand it, because I had been printing Web pages to XPS files for reference. Then, Microsoft in its insane logic, decided that these files, when printed from IE, must be locked. So, unless you go in and unlock them each time, they cannot be seen across the network. They claimed it was for "user protection". I do not understand how I, printing a file to XPS, could be harmed any more than printing to paper and having it spontaneously burst into flames. It just is not going to happen... Oh well, I guess that's why Adobe, the "benevolent evil" created PDFs.

P.S. Maybe you can tell me also why I cannot get into a txt log file that was just created when I ran sfc /scannow. When I double click on the filename, it says, "Access Denied!" How can I open this?

Thanks again for all your helpful comments!

 

[logicearth]

As an aside, I am familiar with this thinking, although I do not understand it, because I had been printing Web pages to XPS files for reference. Then, Microsoft in its insane logic, decided that these files, when printed from IE, must be locked. So, unless you go in and unlock them each time, they cannot be seen across the network. They claimed it was for "user protection". I do not understand how I, printing a file to XPS, could be harmed any more than printing to paper and having it spontaneously burst into flames. It just is not going to happen... Oh well, I guess that's why Adobe, the "benevolent evil" created PDFs.

That problem is actually a side effect to how IE is ran in Windows Vista and Windows 7. IE itself is running in a sandbox with very little to no permissions. Running IE and other internet connected applications this way prevent remote exploits from compromising the system. Which is very easy to do these days.

You will want to read: http://en.wikipedia.org/wiki/Mandatory_Integrity_Control It explains how accounts can be Administrator without Administrator power all the time. Medium = Standard User Power, High = Administrator Power.

 

[Dinesh]

Hello,

I am so tired of being prompted to either allow administrator rights or being told that I cannot do something because I do not have administrator rights. I own this darn computer, why can't I do what I want with it?

For example, I was trying to run SFC /scannow from a command prompt window. The system said it would not let me because I did not have administrator rights.

How can I make myself permanently the administrator of my own computers?

At the very least, how can I elevate myself to run sfc /scannow?

Thanks!

For some commands, you have to run as administrator even if you are an administrator. Simply right click on the command prompt and click Run as Administrator. Also, turn off UAC if you dont want the annoying UAC popups.

 

[Barman58]

Ok the quick and dirty answer (maybe not that quick )

this operating procedure is to not protect the user from the computer but to protect them from themselves. I am talking about the average user here who just wants a system to work and be safe.

The hidden Administrator in Windows is equivalent to Unix/Linux's root user and as such is the old Sysadmin from networked systems.

OK, established best practice for years has been to run as a standard user and either use runas or a separate log-in for system tasks. When installing a system the sysadmin would create multiple accounts to facilitate this.

Unfortunately not all users have the knowledge to work like this, and many in the XP era just created a single user, (which logically has to have admin rights), Microsoft in an attempt to control the possibility of malware gaining admin access to the system, developed the UAC system.

This uses a token system to run the user as a standard user until admin access is required and then prompt the user to elevate to admin. It uses a barrier system that prevents a program from elevating.

As for user rights - again to prevent users accidentally damaging system files - these are given admin only permissions - the file you are having a problem with is in system32 and thus can only be accessed by an admin account - win7 should prompt you to elevate to access this file but does not always - A bug of sorts

If you switch off the UAC then you will always run in the elevated state and should then have sufficient access to do what you want.
I say "Should" as a deeper level of protection applies to certain areas where permissions are given to a "TrustedUser" account and not the administrator account. This is why the Hidden administrator exists.

If you wish you can, as the hidden Admin, (which is never hindered by UAC), add any permissions you wish to your user account, which will add permissions to the standard user token and thus stop the requests for access permissions.

I actually find the UAC causes me less work as I am old school and in XP used to run as a standard user, the auto elevate prompt means I can have just the one account, The same applies with Ubuntu although the system does require a password for elevation.

If you need specific answers to issues please post and we will try to answer them specifically (if the information you need to provide is security related then we have the Private message system,)

 

[juanantoniod]

Thanks for the insight to this...

I guess I have a better understanding of this, but I will still read the recommended information.

However, I was able to run the sfc /scannow, and it create a txt log file. But, I cannot open it, because when I double click on it, it says, "Access Denied!" How can I get this to open?

Thanks a lot! :shock:

 

[Dinesh]

http://www.sevenforums.com/tutorials/1911-take-ownership-shortcut.html

 

[solarmystic]

I appreciate your help. When I set up Windows, I only created one account -- my own. I purposely did not create a separate admin and user account. Yeah, when I go to my Windows Explorer, c:\users, there is me, Antonio, Default, and Public. No separate admin. I still want to know how to fix this, but now I also need to know how to access the file log that scannow created. It finished, said there were some errors, and some were not able to fix, and gave me the log file name and location. I browsed to the log file location in WinExplorer, and double clicked on it, and it blaringly says, "Access Denied!", as if to taunt me... j/k

It's just a txt file and identified as a Notepad document, so I do not understand what the big deal is... Any ideas?

Thanks very much!

P.S. I did do that net user /administrator:enable command, and it finished without error, then I rebooted as instructed, and was taken right back to my own account.

P.P.S. Maybe there is a matter of semantics here. I do not need nor want an administrator account. *I* am the administrator account, but it just does not give me administrator privileges. Does that help at all?

Switch off that pervasive P.I.T.A UAC in the Users bit in Control Panel.

Show MS that your PC is yours do to as you please, permissions be damned.

(You might as well, if you're the only user on the computer, and you know what you're doing)

Click Start-->Control Panel-->User Accounts-->Change User Account Control Settings-->Pull slider down to Never notify-->Restart Computer

I did that right after i installed Windows 7 so that there won't be complications with UAC Virtualization and all that mumbo jumbo, and my computer is mine again. Power to the people !

P.S. It's highly recommended you do that right after the installation, before you install any programs to prevent any untoward behavior.

P.P.S Oops, apparently i'm a smidgen late =P

 

[juanantoniod]

Closing comments and desires...

Well, thanks to you all, I did actually find that I created an Administrator account. Although I am going to use my Macrium images to a cleaner, sleeker install, I will still add the Administrator account again after doing so. I can use it for having a stable platform for troubleshooting. The only issue I need to figure out is how to protect this accont with my fingerprint scanner, but that should be easy enough to figure out. I also finally opened the sfc /scannow log, and it was basically not a user friendly read, so that was a bust anyway. But, if you have any input on the following needs I still have, I would appreciate your help with the following.

I finally figured out how to get my system to recognize the Macrium Images I previously made, so I am going to restore to a clean system restore I made before I started having problems, then re-do making the Data partition, and moving the files appropriately. So, I am good to go. There are a couple of things that would still help though:

1. A Windows 7 OS save settings/export settings tool which would save the customizations I have made since the clean, stable install;

2. An Outlook settings transfer tool, which would transfer or export the email setups, as well as all of the Outlook Options I have personally configured; and

3. A way to determine what changes I have made to my system since the Macrium Image was created. That way, I can pick and choose which apps I want to reinstall and which ones I do not. I tried going in to the System Restore settings, and it turns out that, when I created the Data partition and moved the files, it turned off the System Restore. Nevertheless, there were many changes made before that, which may have created restore points that I could use to identify the changes that need to be re-made. If there is a 'back door' into the System Restore log, or another system change log, it would be very advantageous to have.

So, if anyone can help me with any of these, I would have the utmost gratitude. Bill2 was kind and diligent enough to locate a superb tool for exporting my Internet Explorer settings, so that will prove most helpful. If I had such a tool for Outlook [2010], and Windows 7 OS settings, I would be ecstatic!

Thanks to all who contributed to my dilemma. I cannot express in words how grateful I am for you sharing your knowledge and insights with me. I will be "awarding rep" later today, after things settle out and I find out which posts I can give the rep to. This forum kind of limits the rep I can spread around, but I will try to give as much credit where it is due.

With utmost appreciation,

 

[WindowsStar]

Ok the quick and dirty answer (maybe not that quick )

this operating procedure is to not protect the user from the computer but to protect them from themselves. I am talking about the average user here who just wants a system to work and be safe.

The hidden Administrator in Windows is equivalent to Unix/Linux's root user and as such is the old Sysadmin from networked systems.

OK, established best practice for years has been to run as a standard user and either use runas or a separate log-in for system tasks. When installing a system the sysadmin would create multiple accounts to facilitate this.

Unfortunately not all users have the knowledge to work like this, and many in the XP era just created a single user, (which logically has to have admin rights), Microsoft in an attempt to control the possibility of malware gaining admin access to the system, developed the UAC system.

This uses a token system to run the user as a standard user until admin access is required and then prompt the user to elevate to admin. It uses a barrier system that prevents a program from elevating.

As for user rights - again to prevent users accidentally damaging system files - these are given admin only permissions - the file you are having a problem with is in system32 and thus can only be accessed by an admin account - win7 should prompt you to elevate to access this file but does not always - A bug of sorts

If you switch off the UAC then you will always run in the elevated state and should then have sufficient access to do what you want.
I say "Should" as a deeper level of protection applies to certain areas where permissions are given to a "TrustedUser" account and not the administrator account. This is why the Hidden administrator exists.

If you wish you can, as the hidden Admin, (which is never hindered by UAC), add any permissions you wish to your user account, which will add permissions to the standard user token and thus stop the requests for access permissions.

I actually find the UAC causes me less work as I am old school and in XP used to run as a standard user, the auto elevate prompt means I can have just the one account, The same applies with Ubuntu although the system does require a password for elevation.

If you need specific answers to issues please post and we will try to answer them specifically (if the information you need to provide is security related then we have the Private message system,)

We need a Pinned combined (my posts and others) version of this so we don't have to keep typing this over and over and over again. I Add REP!!!

 

[juanantoniod]

Okay, guys, please excuse me for my ignorance, but I'm a little confused...

I thought that my one and only account on this computer, "Antonio", was the Administrator. Until, I got error messages telling me that I did not have administrator rights or privileges, and was denied access to view even simple TXT files. Then, following instructions on this forum, I "enabled?" the Administrator account, and after a couple of reboots, another login Account appeared on my Windows login screen, besides just mine. So, does this mean that I actually was not the Administrator, and did not have Administrator rights, but by creating the Administrator account, this account had them? Besides Windows limiting a "users" access to their own files, and wanting that, from a day-to-day standpoint, can you give me some examples of how I would use a separate Windows Administrator account?

And, just for clarification, can you please confirm that there are actually 3 different types of Windows Accounts, 2 of them being called "Administrator"? There is the User Account Administrator, the System Administrator Account, and the User Accounts, right? The User Account Administrator can create and modify User Accounts, but does not have System Administrator Privileges. Am I on the right track here in understanding this?

Thanks for your patience.

 

[pparks1]

Switch off that pervasive P.I.T.A UAC in the Users bit in Control Panel.

Aside from it's original implementation with Vista, I don't find UAC all that annoying.

P.S. It's highly recommended you do that right after the installation, before you install any programs to prevent any untoward behavior.

I would recommend to NOT disable UAC with Windows 7, but rather adjust to the way it works. Why would we want to go back to the way that Windows XP was?

 

[WindowsStar]

Antonio Not quite:

I think what you need is to review 2 excellent books. There is a lot to the Administrator Account(s). If you worked a lot with Windows XP you will have a basic understanding of it, but MS changed a lot when it came to Vista and Windows 7. UAC maybe causing you issues too, so you need to catch up on several areas.

Here are those books, I own both and they are fantastic.

Amazon.com: Windows 7 Inside Out (9780735626652): Ed Bott, Carl Siechert, Craig Stinson: Books
Amazon.com: Windows 7 Resource Kit (9780735627000): Mitch Tulloch, Tony Northrup, Jerry Honeycutt: Books

Enjoy.