UAC and Windows Explorer

Hi!

UAC is a nice feature, but I've noticed two things with Windows
Explorer and UAC that I don't like at all:

1. It's not possible to start Windows Explorer in "run as
Administrator" mode. Well, you can start it like that (and confirm
the UAC dialog), but it's still running in restricted mode (popping
up a UAC dialog for every single file system change outside your
home directory).

2. When you try to use Windows Explorer to create a shortcut to some
program outside your home directory (for example in
ProgramData\Microsoft\Windows\Start Menu\..., which seems to me to
be a quite common location to create shortcuts), you don't get a
UAC prompt but rather an error ("Windows cannot create a shortcut
here...").

My question: Is there some way to change this (some registry key,
group policy setting or updated explorer.exe) without deactivating
UAC?

Greetings,
Heinzi

Heinrich Moser wrote:

> Hi!
>
> UAC is a nice feature, but I've noticed two things with Windows
> Explorer and UAC that I don't like at all:
>
> 1. It's not possible to start Windows Explorer in "run as
> Administrator" mode. Well, you can start it like that (and confirm
> the UAC dialog), but it's still running in restricted mode (popping
> up a UAC dialog for every single file system change outside your
> home directory).
>
> 2. When you try to use Windows Explorer to create a shortcut to some
> program outside your home directory (for example in
> ProgramData\Microsoft\Windows\Start Menu\..., which seems to me to
> be a quite common location to create shortcuts), you don't get a
> UAC prompt but rather an error ("Windows cannot create a shortcut
> here...").

I tend to get a warning that I need admin approval to do that, followed
by a UAC prompt. Which is also slightly annoying - why ask twice?

>
> My question: Is there some way to change this (some registry key,
> group policy setting or updated explorer.exe) without deactivating
> UAC?
>
> Greetings,
> Heinzi

Heinzi

Even if you start Windows Explorer with admin privileges, there are still
restricted areas where certain functions are not allowed. Trying to force
this will affect virtualization and compatibility for some programs.

If you want to create shortcuts or make other changes to the users Start
Menu, go here:

C:\Users\username\AppData\Roaming\Microsoft\Window s\Start Menu.

--

Ronnie Vernon
Microsoft MVP
Windows Shell/User


"Heinrich Moser" <usenet@heinzi.at> wrote in message
news:87ircqilvz.fsf@garak.heinzi.at...

> Hi!
>
> UAC is a nice feature, but I've noticed two things with Windows
> Explorer and UAC that I don't like at all:
>
> 1. It's not possible to start Windows Explorer in "run as
> Administrator" mode. Well, you can start it like that (and confirm
> the UAC dialog), but it's still running in restricted mode (popping
> up a UAC dialog for every single file system change outside your
> home directory).
>
> 2. When you try to use Windows Explorer to create a shortcut to some
> program outside your home directory (for example in
> ProgramData\Microsoft\Windows\Start Menu\..., which seems to me to
> be a quite common location to create shortcuts), you don't get a
> UAC prompt but rather an error ("Windows cannot create a shortcut
> here...").
>
> My question: Is there some way to change this (some registry key,
> group policy setting or updated explorer.exe) without deactivating
> UAC?
>
> Greetings,
> Heinzi

Hello,

Explorer's handling of being elevated is a bit flaky.

It is possible, although it can get confusing.

First, enable launching folder windows in a seperate process from a Windows
Explorer window (organize -> folder and search options -> view tab)

Then, close all open explorer winodws (except for the desktop/taskbar).

You can only open an administrative explorer window if you don't have any
other explorer windows open.

Finally, right-click Windows Explorer and click Run As Administrator.

WARNING! From this point on, *any explorer window* that opens will be
running as administrator, even if you don't right-click it and click run as
administrator.

To get your explorer windows to open WITHOUT admin power, close all open
explorer windows again, and then open an explorer window normally. It is now
running without admin power.


--
- JB
Microsoft MVP - Windows Shell/User

Windows Vista Support Faq
http://www.jimmah.com/vista/

Never the less, if you open in Administrator mode, you will be able to add
the shortcuts that you require. You simply have to confirm the operation
(twice but works).

Mike Bernstein

"Heinrich Moser" <usenet@heinzi.at> wrote in message
news:87ircqilvz.fsf@garak.heinzi.at...

> Hi!
>
> UAC is a nice feature, but I've noticed two things with Windows
> Explorer and UAC that I don't like at all:
>
> 1. It's not possible to start Windows Explorer in "run as
> Administrator" mode. Well, you can start it like that (and confirm
> the UAC dialog), but it's still running in restricted mode (popping
> up a UAC dialog for every single file system change outside your
> home directory).
>
> 2. When you try to use Windows Explorer to create a shortcut to some
> program outside your home directory (for example in
> ProgramData\Microsoft\Windows\Start Menu\..., which seems to me to
> be a quite common location to create shortcuts), you don't get a
> UAC prompt but rather an error ("Windows cannot create a shortcut
> here...").
>
> My question: Is there some way to change this (some registry key,
> group policy setting or updated explorer.exe) without deactivating
> UAC?
>
> Greetings,
> Heinzi

Hi!

Ah, thank you, that's exactly what I was looking for!

Knowing this, I played around a bit and made two observations:

1. This unusual behavior is actually quite useful for editing the All
Users start menu: After you've started one eleveated Explorer
window, "Open All Users" in the context menu of the start button
also opens this explorer window elevated (i.e. no need to manually
navigate to C:\ProgramData\...).

2. As soon as one elevated explorer window is opened, UAC can be
circumvented by any non-elevated program.

Example:

1. Start one elevated explorer (as you described below).
2. Open a non-elevated command line (cmd.exe).
3. Type "explorer.exe C:\Windows\System32\cmd.exe"
4. Note that the new cmd window is elevated.

Fascinating. I think I understand now why MS made it so difficult
to start an elevated explorer window...

Greetings,
Heinzi

"Jimmy Brush" <jb@mvps.org> writes:

> Explorer's handling of being elevated is a bit flaky.
>
> It is possible, although it can get confusing.
>
> First, enable launching folder windows in a seperate process from a
> Windows Explorer window (organize -> folder and search options -> view
> tab)
>
> Then, close all open explorer winodws (except for the desktop/taskbar).
>
> You can only open an administrative explorer window if you don't have
> any other explorer windows open.
>
> Finally, right-click Windows Explorer and click Run As Administrator.
>
> WARNING! From this point on, *any explorer window* that opens will be
> running as administrator, even if you don't right-click it and click
> run as administrator.
>
> To get your explorer windows to open WITHOUT admin power, close all
> open explorer windows again, and then open an explorer window
> normally. It is now running without admin power.
>
>
> --
> - JB
> Microsoft MVP - Windows Shell/User
>
> Windows Vista Support Faq
> http://www.jimmah.com/vista/