And also, how to answer “Do you want to allow this app to make changes to your device?”
It’s asking to keep you safe.
The message is important because the program you’re trying to run might have the ability to make serious and unwanted changes to your machine. It’s a reminder to think twice if you know the password or find the machine’s administrator if you don’t.
Become a Patron of Ask Leo! and go ad-free!
Asked for an administrator password
Windows asks for credentials (including the password) for an administrator-capable account if you try to run a program that requires administrative access while you yourself are signed in using a Limited User Account (LUA). If you don’t know the password, you can’t run the program, and will need to contact someone with administrative access to your machine.
Do you want to allow this app to make changes to your device?
This question implies that the application attempting to run requires administrative access to your machine. It’s part of the feature called User Account Control.
Administrative access generally means the program needs the ability to install software in protected areas or access files you normally don’t have access to. An example of the latter might be accessing the files belonging to a different user on your machine.1
There are times you want to be able to do this. Installing software is perhaps the most common scenario; another might be running tools to diagnose system problems.
There are times you don’t want to be able to this. The example? Malware. If you accidentally download and attempt to run malicious software on your machine and it attempts to install itself, UAC may be triggered. At that point you can respond No and prevent it from running. That’s User Account Control protecting you.
Password or no?
In the example above, I’ve attempted to run Windows PowerShell “as administrator”.2 It’s now asking the question and also requiring me to enter a password.
If you are signed in to Windows using an account that does not have administrative capability, this message will ask you to specify an account and password that does. This confirms you have the authority to make the decision to allow changes to your machine.
If you are signed in to Windows using an account that does have administrative capability, this message will simply include the Yes/No option. If you’re using an administrative-capable account, you’re assumed to have the authority. If that’s the case, this message simply serves as a warning you’re about to do something possibly dangerous.
But I am the administrator! It’s my computer!
Unless you’re using the (normally disabled) built-in account called “administrator”, you are not running the computer as the administrator. It’s only when you answer “Yes” to the “Do you want to allow…” question that you then run that specific software to run as administrator.
Your account may be administrator-capable, but as we’ve seen, that only streamlines the process by not requiring a password in response to the question.
I don’t know the password!
If you can successfully sign in to Windows, you know your own account and password.
If you try to do something requiring administrative access and you’re faced with this message but you don’t know the password to the administrative-capable account, then it’s likely you’re not authorized to run the software. The scenario here is that someone else probably set up the machine, created the administrator-capable account, and then created what’s called a “Limited User Account” for you to use.
“Limited” refers to exactly this: you are limited in what you can do by virtue of not having the password required for administrative tasks.
You’ll need to talk to whomever set up your machine or your account to be able to do more.
Why all the hassle?
Everyone blames Microsoft and Windows, but the reality is this same scenario holds true in similar form for Macs and Linux machines as well. If anything, Microsoft was late to the party.3 For safety, you don’t use your computer with all possible privileges all the time.
The reason is simple: malware.
Malware wants to install itself into protected areas of your system where it can hide and do whatever bad stuff it’s trying to do. If you don’t have the authority to let it, it can’t. If you do have the authority, you’ll at least be notified that you need to think twice before running whatever it is that needs administrative privilege.
Do this
If prompted by a UAC dialog, you have three possibilities:
- If no password is required, simply respond Yes or No after deciding whether you still want to run the program in question.
- If a password is required and you know it, enter the password and then respond Yes if you decide you want to run the program in question.
- If a password is required and you don’t know it, ask someone with administrative access to your machine what you should do.
The unstated fourth scenario, where you don’t know the administrative password and there is no one to ask, is a problem. You can try to recover or reset the administrative password, but in the worst case you may be faced with reinstalling Windows from scratch, this time being careful to set and remember the password to an administrative-capable account.
While you’re at it, subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.
Podcast audio
Related Video
Footnotes & References
1: Generally by trying to access “C:\Documents\<username>”, where “<username>” is a user name other than your own.
2: By right-clicking on the Start button and clicking on Windows PowerShell (Admin).
3: And, true to form, initially got it wrong when the feature was first introduced into Windows. They ended up asking too often, turning the feature into much more of an annoyance than it needed to be.
Linux and Mac default to limited user accounts. They require a password every time you want to install software or make changes to the system.
I remember when there was a vulnerability in XP, and if there wasn’t a password set for the Administrator account, anyone could walk up to the computer and activate the Administrator account and become the administrator of the machine. I used to like to go into bog box stores and gain Administrator access for the fun of it. Microsoft got this wrong for a long time.
I don’t know if this was on WinXP or not, but one time shortly after getting our computer, I remember having to access the Administrator account and not knowing the password. I tried all I could think of, and none of them worked. Finally — in some desparation — I simply pressed ENTER without typing any password at all. Boom! I was in! Silly me hadn’t set an Administrator password! (No wonder I couldn’t remember it!)
Boy, did I ever change that in a hurry! :o