When you’re the administrator… but not really.
Sure.
You’re not the administrator. Not really.
Oh, you may think you’re the administrator. Windows may even lead you to believe you’re the administrator.
However, a security feature in Windows (that’s on by default) means you’re not the administrator.
But you can be.
Become a Patron of Ask Leo! and go ad-free!
All accounts, including the administrator account created when setting up your machine, run with limited — not administrative — permissions by default. The primary difference between your administrator account and a traditional “limited user account” is whether or not you need to supply a password to the User Access Control (UAC) prompt. Many programs can be run “as administrator” by right-clicking on their shortcut and looking for an option to do so. For those that can’t, you can use Task Manager to run it with administrative privileges. Think twice before doing so, as it bypasses much of Windows’ built-in security.
Administrator … but not
By default, your login account — even if it’s the “administrator” account you created when setting up the machine — doesn’t give the programs you run administrative privileges.
The reason is simple: if it did, any program you run could do anything to your machine. That means if you accidentally run malicious software, it could do anything, perhaps even without your knowledge.
Instead, when you run a program that needs administrative privileges to work, you’ll either be denied with an error message, or you’ll be presented with the User Account Control (UAC) prompt, allowing you to decide whether or not to proceed.
By requiring you to take extra steps, UAC prevents malware from making administrative-level changes to your system without your knowledge.
An administrator account is “administrator-capable”
Let’s say you want to do something requiring administrative access: install a program, for instance.
If you are working within an administrator account, you’ll get the familiar UAC prompt, to which you need only respond Yes or No. Your account is what I’ll call “administrator capable”.
The account you set up when you installed Windows 10 is administrator-capable. For most people at home or in small businesses, that’s the only account they use.
It’s also possible to set up so-called Limited User Accounts, or LUA, that can be used to sign in instead. When presented with a UAC prompt, users signed in with limited accounts must enter the password (or PIN, if so configured) of an account that is administrator capable.
This proves the user is authorized to do something requiring administrative privileges. If they don’t know the password, they can’t run something as administrator.
That’s really the only difference: whether or not you’re asked for a password when the UAC prompt appears. In most other respects, all accounts (other than the hidden account called Administrator,1) are, in a sense, running as limited accounts.
Programs that need administrative access
Normally, when a program needs administrative access to perform some function, there are two things Windows can do: deny the request or ask for permission via UAC. Unfortunately, it’s not always possible to ask, which means the request is denied and the program fails to perform the task it was attempting. Running the System File Checker might be one example: if you run it in a regular Command Prompt window, you’ll get an error message that you must be administrator to run the program.
The solution is to run the program “as administrator”. Because your account is administrator-capable, you can run programs with full administrative privileges. Many programs have this option; I’ll use Windows Command Prompt as an example.
Locate the Windows Command Prompt icon in the Windows Start Menu and right-click on it. If present in the resulting sub-menu, click on More. You should now see a “Run as administrator” option.
Click on that and you’ll get the UAC prompt, confirming you want to run the program as administrator. If you are running an administrator account, it should only require clicking on “Yes”. If you’re running a limited account, you’ll need to provide the password of an administrator-capable account.
If there’s no “Run as administrator”
Not all programs have a “Run as administrator” option on their Start Menu or other shortcuts. If you’re logged in with an administrator-capable account, you can still attempt to run a program as administrator using Task Manager.
Run Task Manager (right-click on the clock and click on Task Manager). Under the File menu, click on Run new task. You’ll be prompted to enter a task to run, along with a checkbox that lets you run it as administrator.
You need to know the name of the program’s file (calc, in the example above), or use the Browse… button to locate the program.
Note: Windows File Explorer is a special beast. It’s always running, as it provides the Windows Taskbar and Start menu. As a result, attempting to run it again, with or without administrative privileges, will open a new Explorer window, but may not actually start a new copy, and may not cause that new copy to run as administrator.
Cautions
You should think twice before running programs as administrator. There should always be a clear reason to do so.
If you run your mail, browser, word processing program, or instant messaging client as administrator, those programs will be able to do anything. That means if you open an attachment in email, for example, whatever that attachment is will also be run with full administrative privileges. If that attachment happens to be malware, you’ll have completely worked around the security measures UAC puts into place.
In addition, Windows treats file ownership and security differently depending on each user’s permissions and whether you have full administrative privileges. In other words, files you create while running a program with full administrative privileges may not be accessible later, when you run normally without those privileges.
In short, UAC security is there for an important reason, and helps keep your machine safe from many forms of malware and exploits. Use “Run as administrator” with caution, and only when you’re sure you need it. Close the program as soon as you no longer need those extra capabilities.
Do this
Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.
I'll see you there!
why do i get this error?? Windows security…these files can’t be opened…your internet security settings prevented one or more files from being opened. Does it have to do with the administrator account?? I get this everytime i type something into the start menu serarch area…i had vista but upgraded to windows 7?? can you help??
Great help thanks a million! I was PO that I could not do things on my own computer.
Thank you. With “Administrator”, can I turn off driver certificate requirements? I have BlazeDTV which works perfectly with XP, but 7 will not allow the drivers!!!
All of a sudden when I open e mail with attachments that I know, the email comes thru without the attachment available. Is it the sender?? or is it my email?? I use Windows mail. This started about one month ago.
I tried spybot and it would not delete 31 items saying I wasn’t the administrator. Well I am. I find this very irritating .
I’m running Windows 7 64 bit Home Premium and I have completely disabled UAC, those popups are annoying, even at the lower security levels, plus I had some issues with installing software (probably because of this same admin-not admin issue). I wouldn’t recommend it for computer novices but I’ve had no problems and not one single bit of malware since I got this PC 12 months ago (I do run full security software plus a few other precautions), then again I do combine this with being careful using the internet ;o)
Leo, bless you, thank you! I learned the HARD way never to disable the UAC, but not having Administrator privileges when needing to install certain programs has been a real pain. Somehow, stumbling around, I’ve gotten it to do what I want, but NOW I can do it intelligently.
Thanx for the info! My son built me a kick ass computer but went back to college and I kept having this problem and its so frustrating. But now I’m back to ruling my computer :)
Leo, my computer is completely down and it too involves the Administrator password. Mine won’t accept it. We can’t reboot or anything. Your article taught me a lot about the term Administrator, can you expand it a little to cover computers that won’t accept Administrator passwords? I am the Administrator (well you know what I mean) and I have always used the same password for years so it’s not like I forgot it. It just won’t accept it. Thanks so much and keep up the good work.
07-Feb-2012
i did all circus to access my control panel of windows 7 ultimate……….( if i open control panel dis operation has been canceled due to restrictions in effects on this computer. please contact administrator… and i am d administrator. plzzzzzzzz someone help me…
22-Jun-2012
Hello Leo,
I’m trying to use a System Restore to get rid of a ICE trojan popup. At the moment the System Restore button is grayed out showing I need to be administrator…. and yet my account already says I am? What else can I do? I’m aware there is a Safe Mode with networking option but I keep going to the screen where its loadng windows Files and gets stuck there. Any advice you can provide will be greatly apprieciated. I just want my computer to work again without having to restart it every half an hour.
Blocking System Restore and blocking access to Safe Mode are things malware is capable of doing. In fact, there’s not much malware can’t do. In an case, System Restore often doesn’t do what we expect it to.
https://askleo.com/why_i_dont_like_system_restore/
Here are a couple of articles on recovering control of your machine after a malware attack.
http://ask-leo.com/how_do_i_clear_up_these_lingering_problems_after_a_malware_infection.html
http://ask-leo.com/how_do_i_remove_this_error_on_startup_after_a_virus_removal.html
A couple of extremely important questions your very helpful article does not address. 1) If your browser is already running while you make this change does it then inherit the permissions you warned about? 2) Is there some way to check what permissions a given program has? 3) Is there any way to revert these permissions if someone accidentally clicked on a program while running as an admin?
1) No. 2) I think process explorer can tell you by looking at the details of a process. 3) Other than exiting the program, no.
I haven’t seen an answer yet to my question: Why do I NOW need permission to run Internet Explorer when I didn’t before? (Windows 7 Ultimate 64 bit).
This issue is recent (like just a couple of days ago it started doing this).. When I would run IE from the task bar or the start menu, IE would come right up to my google home page — NO DELAY WITH ANY KIND OF PERMISSION!….. NOW it DOES!.
Thank You
Mac
I don’t believe this is true for Internet Explorer, but many other programs will automatically attempt to update themselves when run, and some of those will require administrative access. Thus UAC pops up for the updater.
i had this problem myself in win 7 ult. in user account settings i click on create a new account.
then check administrator and create a password. then just type in the password when its required.
if you have to keep typing in the password (which can get tedious) simply switch users and do what you`re trying to do in your administrator account. when you`re done sign out of your administrator account and switch back to your standard account for every day use. its not a good idea to use your administrator account for everything.
Thank you for showing me what i needed to do.
also instead of opening the whole file explorer as admin (which i can see is needed in some circumstances), I needed to uninstall a game and its launcher, you can just run the game as an admin and delete it from within (if it has an uninstaller) or after running as admin you could be able to delete the files in windows explorer (untested, hypothetical)
I am having the same problem as Mehmed August 28, 2016. I did a search for “Windows Explorer” and “no match found.” windows 10) When i right click my folder icon, the options are different then that of what i see in this article. The same applies to internet explorer, i don’t get the option to access “windows explorer”. any help?
I previously had an ACER Computer system using Vista as the operating system. I never had any problem with software installation.
I now have a HP Pavilion Desktop 510-P026 Model V8P11AA#ABA S/N *****0KC8
The computer installed the print driver for the printer and it works OK.
After installing some of my previous software, I have had no problems until now!
While installing the software for my HP 2410 Photo Smart All in One Printer I encountered a window that called out SYSTEM REQUIREMENT RESULTS Everything indicated (7) Green check marks, and (1) red for the Administrator Rights. I clicked on the details and this is what it said: Required Action: Click Cancel to exit this software installation. Log off and then log on as a user with administrator privileges. (Contact your system administrator for more information.) If there is no system administrator, have the primary user of this computer install the software. Restart the installation by removing and re-inserting this installation CD.
I went to the control panel and verified that I was the Administrator. I did not want to modify or change who the administrator is. I removed and re-inserted the disk with the same results.
I do a lot of scanning and the printer worked flawless with my previous computer.
Any help will be greatly appreciated.
Bob Foster
{email address removed}
In Windows 10 it’s called File Explorer. Just search for Explorer.
That’s funny, but I just clicked the Start Icon and typed Windows Explorer, and it brought up File Explorer. In fact, the first option after typing the word Windows was File Explorer. Windows seems to allow for the legacy name to bring up the new version for many system apps.
Installed Windows 10 on my PC. Now have a dual boot PC with Windows XP PRO as my primary. Both on separate HD. Had to install 10 because of the Heart Bleed Virus of 2015 and how it affected the Revenue Canada site. Because of various problems including the necessity to reformat and reinstall W10 I have come to HATE Win10 and I have worked with Win 3.x, 95 Pro, 98 Pro and XP Pro along with DOS before them. Now just installed the application to prepare our 2016 income taxes in Win10. Created a unique folder for the related data files. When I went to save my files I didn’t even get the message about I required administrator’s permission. I was simply denied the privilege of saving a file to a folder that I (as administrator) had created. I had to save it elsewhere and copy it into my special folder. A work around but a pain in the butt. Ironically however, opening it from in my special folder and resaving it thereto is no problem. No questions asked at all. Now the crux of my comment here. I applied the procedure that AskLeo explained when he used Windows Explorer to select the application to be run, For me I went to the START menu, looked at all the installed applications there and located my “INCOME TAX” program. But instead of merely clicking on it I right-clicked and used the option to run as administrator. Sure that annoying UAC popped up and my program opened. To test I created a completely NEW file and saved it. Went without a hitch just like it would have in Windows XP. So MR Leo, looks like you don’t have to use Explorer but merely apply the same procedure to any application your START menu. Thanks for that lead. Helped immensely.
Just a comment on the annoying UAC: It can be turned off, but that would make your computer more vulnerable to malware. Without UAC, malware could install itself on your computer more easily as the UAC is engaged when system level changes are being made to the computer. There are many necessary annoyances, such as UAC, CAPTCHAs etc., but you have to blame the hackers, not Microsoft, for those annoyances.
Nice arcticle – I have come across some hardware driver installers that won’t accept a local administrator account when installing as long as the PC is a member of an Active Directory domain, e.g. Synaptics Touchpad drivers or AMD Radeon installers. They simply tell you “you need to have administrator right to install drivers”… drove me almost nuts the first time it occured…
Haven’t found any other way around this apart from leaving the domain, installing drivers and then re-join the domain.
This is absolutely brilliant. I have never read it explained that clearly — and I have been reading a lot about administrative privileges. To the point I have now converted to the religion of Not Living within an Administrator Account, and denying rights to yourself — a psychologically difficult step.
You’re never an administrator : yes, that’s the right perspective, and completely counter-intuitive, too.
This whole issue of user rights is devilishly difficult, though (at least to me), so let me ask a few questions :
1)- Does it make a difference if you right-click, and run as administrator, a program while already under your administrator account ?
2)- Does it make a difference if you’re under your non-admin account, and you right-click to run as admin a program that would ask for your password anyway, because it needs elevated rights ?
3)- Is the Run this Program as Admin checkbox, on the Properties / Compatibility tab of some executables, the equivalent of the Run as Admin right-click command ? And why would you check it ?
4)- Sometimes, Windows would warn you that you’re not allowed to open a folder to browse, or read some files, however if you really, really want it very hard, you can ask politely and click HERE, in which case the system will give you access.
It is my understanding that once you’ve done that, you’ve permanently changed something to NTFS permissions, and there’s no going back unless you get under the hood (which seems horribly complex to me). Is that correct, and is it risky to open that door, permanently so to speak ?
[edit: numbers added]
I’ve added numbers to your questions.
1) nope. (It may not be an option since it would be redundant.)
2) If the program would normally trigger UAC to ask that password, then running as admin should skip that. If it’s asking for some other kind of password there’s probably no effect, but it depends on the program.
3) Yes. You’d use it if you always want that shortcut to run as admin without having to go through the right-click gyrations.
4) Risky – not terribly. It depends on which files, which folders, case by case. Remember that Windows has permissions for a reason and that by bypassing those restrictions you’re effectively saying “I know better than you” what’s safe. If you’re not sure, don’t do it.
You are never too old to learn! I’ve been using PC’s (Windows) for over 20 years and never knew about ‘right clicking on the clock’ to bring up Task Manager.
Thanks for that/
Sometimes when I need admin privileges and UAC prompts for a password, it sometimes uses my limited account, which has no password and I have to select the admin account with a separate click. It doesn’t happen in all cases, but just sometimes. Does anyone else have this problem and/or a solution to it?
Thank you! I tried everything else, but nobody else suggested using task manager. I was trying to update the bios on an old computer and could not get it to run no matter what I tried it kept denying me. This was so simple!
Thaks still helpfull for me ,after some chkdsk issues ;-). And a good advice to exit the administrator rights,after being finished.
Ray Charles
Thank you for this post. This is the only explanation I’ve been able to find that actually explains what is going on in Windows when I get that administrator permission required prompt. I feel like I understand the process better now. Thanks.
my pc don’t have administrator account.how could it be posible????
It all depends on how it was set up. There probably is a traditional administrator account. Try this: https://www.howtogeek.com/howto/windows-vista/enable-the-hidden-administrator-account-on-windows-vista/
Thanks for this article as I encountered problems installing TurboTax 2019 into my C:\Program Files directory. Luckily, running as administrator did the trick.
This is my first comment but I was glad to get this information about Administrator, it really helped me understand it better. Thanks for so many helpful articles!
Lro, you wrote: “your login account — even if it’s the “administrator” account you created when setting up the machine — doesn’t give the programs you run administrative privileges.”
That is the complete opposite of what I’ve been taught: that the “Administrator” account is the true administrator account, permitting you to do just about anything freely.
And this also fully accords with my own personal experience: while logged into the “Administrator” account, I find that activities that would, on any of our other accounts, normally toss a UAC prompt my way, are performed meekly without any objection at all.
Could you have misstated the matter?
UAC allows limited Administrator rights but processes requiring low level access are limited to programs run with Admin permissions.
The account you set up when you set up the machine is what most people consider “the administrator” account. That is separate from the account actually CALLED “administrator”, which is normally hidden. The later account is always administrator, you are correct. Yes, the terminology is confusing.
Leo –
Hi. I read an article where a PC user, I think after a reinstall of Windows, initially had only the default, non-hidden administrator user account to work with. The user then created a second administrative user account. Then he took the default, non-hidden administrative user account and downgraded it to a standard/limited user account.
1. If you’re the sole user of a PC, is there any benefit to having multiple administrative user accounts (and I’m not talking about the normally hidden administrative account here)?
2. Is there any difference between (a) the default, non-hidden administrative user account (the one that’s there to begin with and you just give it a user name) and (b) an administrative user account that is subsequently created by the user?
I’m trying to understand why the user in the article did what he did with the user accounts.
Thanks.
So to be clear, the only “special” account when it comes to administrator is the hidden one actually called “administrator”. Anything else is just a user account that has administrative ability, as outlined in the article. (OK, gross oversimplification, since nothing in Windows is simple, but you get the idea.
)
To your questions:
1) Only thing I can think of is a backup account in case you lose access to your primary. Kinda makes sense with Microsoft accounts being machine login accounts now. If your Microsoft account gets hacked somewhere, and the password change, that puts your ability to login to your machine at risk. A backup account with administrative privileges would let you back in and take appropriate action for the machine.
2) Not that I’m aware of.
I wanted to answer a question linking to this article to show someone how to run program as administrator and I didn’t get the option to “Run as administrator” in the Run command box. I checked to see if I was logged in as an Administrator by running a program which requires UAC permission and it asked for permission so it isn’t that. I’m using Windows 2004 if that offers any evidence as it might just be a bug introduced by the update.