Is "run as an adminstrator " the highest level? [closed] - windows

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 8 years ago.
Improve this question
I'm currently using a tool to modify hosts file ,and it said i should run it as administrator to replace hosts file, and i did so.
but ,it still failed.
And when i manually copy hosts file to etc folder, Windows will also ask me to provide administrator permission to copy to the folder.
This refresh my opinion about Windows administration.I also have wrote some programs that need to be run as administrator, and it works fine,i never though there is something you can't do even run as administrator.
So,if "run as administrator" isn't the highest level, how could a application request a higher level?(eg. replace hosts file on my computer)
Here is what i found after posting this question:
1.Thanks guys below, your opinions inspired me.
2.It's surely not related to safe mode.
3.I manually right click on the host tool and select "run as administrator", it works!It can replace the hosts file!You guys can try it,if you run notepad as administrator, it will also can write to hosts file.
so,here is what i guess:
The system do have two administrator level.
When double click on the my hosts tool, it only requires the lower level of administrator,so it failed to replace hosts file.
But manually right click and run as administrator, the system will give the tool highest level,and it can replace hosts file.
Explorer.exe only have a lower administrator level even you log in as administrator.That's why I need further permission when i paste hosts file manually.

What you did,I was trying to achieve the same manually,but I also faced the same situation. Actually,going into the permission related section,you will find that there are 3 users/groups at least assigned to each system :-
System
Administrator(includes all those accounts which are admin)
the logged in user-account.
So,basically,what Windows does I guess is that it takes special care about the systems file like C:/Windows/System32/driver/etc/hosts.file is a system-configuration related file which looks for mapping the hostnames to IP-Addresses!
The hosts file is one of several system facilities that assists in
addressing network nodes in a computer network. It is a common part of
an operating system's Internet Protocol (IP) implementation, and
serves the function of translating human-friendly hostnames into
numeric protocol addresses, called IP addresses, that identify and
locate a host in an IP network. // Taken from Wikipedia
Hence,you need to have a special permission for editing or configuring hosts file like editing it in safe mode. Though default settings are those which I mentioned, you can always manually configure the permissions.
But,the one line answer to your question is
Yes,System Configuration Files aren't editable manually by default,either they need editing to be done only if Windows is running in Safe Mode,or you need to change the settings manually for your administrator account...

Related

How can I turn off Windows startup sound with neither GUI nor admin rights? [closed]

Closed. This question is not about programming or software development. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 23 days ago.
Improve this question
On my Windows 11 computer I'd like adjust a few settings programtically (hidden). Basically it should be performed without elevated rights, so standard users can use it too. By the way, it's my own idea, no office work.
Currently I try to turn off the standard startup sound in mmsys.cpl -> Sounds. Though its a global settings for all users, from within the GUI its easy to do (simply unchecking the box) and doesn't need elevated rights. Strange, but seems like intended by Microsoft.
But I have to do it without any GUI. There are several posts online how to change it in registry (under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\BootAnimation "DisableStartupSound") but all of them require administrator rights.
Assuming unchecking in GUI pass a specific command that triggers the registry key to be changed, I would like to know that command. Workarounds are welcome - as long they doesn't need admin rights or cause a GUI to get open. Scripts like batch, vbs or powershell are as good as an executable.
Does anyone have an idea?
Writing to HKLM does require elevated rights for most keys.
The Settings app is either using UAC auto elevation (only for Microsoft apps) or asking a service to change the registry on its behalf. Process Monitor should be able to tell you which process is writing...
On my Windows 10 system the registry permissions for the BootAnimation key are set so that all authenticated users can set the value. Reg.exe does not seem to work because it asks for too many permissions but WSH works:
CreateObject("WScript.Shell").RegWrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\BootAnimation\DisableStartupSound",1,"REG_DWORD"
..and save as a .vbs

Windows 7 Batch File to Launch a VMWARE Instance with GUI [closed]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 7 years ago.
Improve this question
I have a Windows 7 host machine with a VMWARE Workstation 9 based guest operating instance. What I need is that the guest OS to not only run but runs inside the guest in the VMWARE Workstation gui upon a host reboot--say, from a power failure. I have tried all solutions online but so far I am unable to make the GUI to appear--though the guest OS does launch.
Here is my solution so far: I have created a .bat file and setup Windows Task Scheduler to start the .bat program. Here is what's inside the batch file:
cd "C:\Program Files (x86)\VMware\VMware Workstation"
vmrun start "C:\VirtualMachines\WindowsServer2012_std_ArcGISVM2\Windows Server 2012 Std.vmx" gui
Note, I am using 'vmrun' program but using other online solutions which use the VM Ware Workstation's executable doesn't help with the gui part either. And adding or removing the 'gui' flag doesn't seem to make any difference.
Also note, I'd rather not use the Workstation as a Server in a 'shared' virtual machine setup. There should be a simpler way.
Thanks!
[Edited/Detailed Answer Below]
Never mind. I did end up creating a Shared VM per the instructions from another site (whose link is not working anymore!)
Here is how I accomplished this:
Using VMWare Workstation gui, pressed F9 to bring up option to enable Sharing of VMs.
In the Sharing window, right click on your VM ->Manage -> Share the VM; I chose default options.
In the same gui, under 'Shared VMs' tab, click 'Manage Auto Start'
That's all it took! And now I am able to launch the VMWare Workstation GUI after the host system reboots.
PS. I posted the Question here because I was originally using a script to achieve this; I thought there could be more scripts/programming solutions. Also, Expert Exchange maybe a competition but it provided me full solution yesterday without requiring any login; so, being a once paying member there, I had assumed that they have now become a 'free' site. But today their link doesn't work.

Chroot equivalent utility for running program on offline windows installation [closed]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
Closed 9 years ago.
Questions concerning problems with code you've written must describe the specific problem — and include valid code to reproduce it — in the question itself. See SSCCE.org for guidance.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Improve this question
Chroot is often assimiled to be a kind sandbox. But in Unix, it also allow use of programs on certain non-bootable installation.
When I search chroot for windows: I see things like sandbox. I don't want security, I want a way to rescue the system. By example, if I disabled syskey with ntpasswd, running C:\windows\system32\syskey.exe with a such utility would modify the registry entries of the of the offline installation, not the current one.
It could be called runon similar as runas for alternative users.
What chroot would means here for windows? Well, there is winre which allow having the same drive letters of your windows installation. There is an example: compact.exe is not present on winre installs. if you cd to \%Windir%\system32 (the directory of the offline install) and run compact, it won't work(except if you use it with /?). If you run
X:\sources\>path C:\Windows\System32\
You now use the files present in your offline windows. Base dlls such as ntdll.dll or eventually gdi.dll are those from C:\Windows\System32 instead of X:\%windir%\system32 and running compact will work.
But Programs runned by this way will use the current registry. The main keys (HKLM; HKCC; HKCR; HKCU; HKU; HKEY_PERFORMANCE_DATA) with their contents, are those of the current winre/pe installation, not those you have when you booted in your windows. So, if a program want to modify some registry entries, it will modify the Hives of X:\windows\system32\config not those of located in the C:\ systemdrive.
It is possible to mount the Hives of your offline windows under HKLM and edit them, but the programs which have their informations in HKLM\Software would still look at HKLM\Software and not at the name you mounted it.
The utility I am looking for would (partially?) hide the registry of winpe/re in favour of the one present in the offline install. The expected effect is that if you launch the registry editor with the utility, you will see the keys as if you would have booted into windows. (Maybe with some exceptions?)
The application would still use the Microsoft services of the current windows. I'd like launching services installed on the offline windows that are not installed on the current one. It would be nice to do this even for kernel ones. By this way, you would have the same behaviour when you launch sysv daemons in unix. Except here some mechanism for avoiding dual instances could be necessary, because the problems would be more critical on windows
The user access rights are an important part in the Microsoft systems. Specifying a user name and password in the parameters of the command line could be necessary. Some problems occurs with a bad User database configuration and prevent windows to boot. If want to enable syskey again, It would need to have the authentication informations which couldn't be used. But in some case like syskey problems, it make windows in endless reboots. I think one possibility would be to find a way to mount the user Hives by providing their path instead of login informations. Or if it is impossible, try to keep the user keys/informations of the current booted windows.
I don't know if a utility like this exist. I'd like help for programming it with mingw from linux (I can't have Visual Studio) . It would be good if it don't need to be installed. I would like it don't use .NET or the full windows API, because I would like to see it working under winre. I write for C/C++ under linux, but I never done it for windows. The only experience I have is provided by the fact I managed to build 7-Zip with winebuilder. I just know that the main function is called "main" for console programs and "WinMain" for windows ones. I am not familiar with WINAPI nor nt API. I just know there are not real equivalent to the chroot() of the Unix API.
I hope this is possible, thanks in advance.
The answer, after some review, is No. You can't do that. There are too many embedded references to HKEY_LOCAL_MACHINE in the various system DLLs; at the very best, you would end up with a very buggy system (since different parts of the system would be seeing different views of the machine configuration.)

Windows Temp folder default NTFS security [closed]

Closed. This question is off-topic. It is not currently accepting answers.
Want to improve this question? Update the question so it's on-topic for Stack Overflow.
Closed 10 years ago.
Improve this question
What are the default NTFS security settings of the C:\Windows\Temp folder in Windows 7?
SetACL is capable of listing the permissions of C:\Windows\Temp without first changing them. I retrieved the default permissions with the command setacl -on c:\Windows\Temp -ot file -actn list on a freshly installed system and verified on my system:
DACL(protected+auto_inherited):
Users FILE_ADD_FILE+FILE_ADD_SUBDIRECTORY+FILE_TRAVERSE allow container_inherit
Administrators full allow no_inheritance
Administrators full allow container_inherit+object_inherit+inherit_only
SYSTEM full allow no_inheritance
SYSTEM full allow container_inherit+object_inherit+inherit_only
CREATOR-OWNER full allow container_inherit+object_inherit+inherit_only
If you prefer a GUI application, SetACL Studio can list permissions from every part of the system without first changing them like Explorer. This is what C:\Windows\Temp looks like in SetACL Studio:
The following URL shows the Default NTFS Permissions in Windows 2000. It looks like google has not found an update for Windows 7. It is nevertheless a good starting point to see the NTFS Security settings for many standard directories like %Systemroot%\Temp.
Does it really matter? You aren't supposed to be hardcoding paths in your code anyway. What if that's not where I keep my temp folder, or that's not the name of my Windows directory, or I didn't install Windows on drive C? Does your application still work? Uh-oh.
Instead, call the GetTempPath function, which will return the path of the directory designed for storage of temporary files in the current environment. You can assume that you'll have all of the necessary read/write privileges in the directory that is returned.
If, as one might judge from some of your previous questions, you're writing code for the .NET Framework, this is all nicely wrapped up in the System.IO.Path.GetTempPath function.

Copy Files from Remote RDP to Local Machine [closed]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 3 years ago.
Improve this question
Is there a way I can launch a RDP session to a remote Windows server, and perform a file transfer to the local computer? Versions of the remote Windows Server varies. Ranges anywhere from 2000 to 2008.
I've tried to look up solutions and it seems scattered everywhere. Some suggest using mstsc.exe, others suggest PowerShell / Java / ASP Net. I'm confused. Appreciate some guidance here.
Thanks!
Update Below: 17 Feb 2012
Thanks for all suggestions. Would like to add that the remote servers are securely locked down and I'm not allowed to install SSH servers, FTP servers, or shared drives. The only way for accessing the remote machine is through RDP, and these machines are also on separate VLANs to which only authorised users can use RDP to access these machines. I'm trying to create a script that can help authorised users to download the required files.
You can map a drive using remote desktop.
Options > Local Resources > More
Ctrl + C at the Remote Desktop, and Ctrl + V at local, if you not looking for any automated solution. (Please check RD Config to enable copy and paste)
Once you have mapped the drives you want using mstsc, you can use \\tsclient to access the file system of the local machine i.e the Terminal services client from which you have RDP'ed on to the remote box.
If all you are trying to do is copy file from a remote box, just do \\machine\c$\path etc or share the folder and do \\machine\share to get them. RDP is not necessary in this case.
Once you have mapped the needed drives as Andy says, you can execute remotely a LOCAL batch file every time you connect specifying it's local path (using \\tsclient\c to refer your local drive) in the Programs tab at RDP properties.
Remember to write cmd /c before that path.
The rdp connection will automatically close once the batch file ends, but you can add the pause command to the end to see what happened during execution.
Connecting this way, you can edit the batch file before connecting.
Make sure your remote Machine enabled PSRemoting by running the following command in PowerShell
Enable-PSRemoting –Force
From the client computer, run the following command to establish the connection.
net use "\\{RemoteIP}\c$" "{Password}" /USER:"{Username}" /persistent:no
Here after you can use Copy-Item, Delete-Item over the network.
Copy-Item [PACKAGEPATH]\* \\[COMPUTER]\c$\installers -recurse
In Client machine, Run->mstsc.exe-> Local Resources-> enable clipboard.
In remote machine-> windows run command (Windows Key + R).
Open cmd->(Taskkill.exe /im rdpclip.exe) type brackets command
You got "Success", then
Type same command prompt "rdpclip.exe"
Now copy and paste both, its working fine
You can copy and paste files over RDP, it works perfectly. See http://www.reddit.com/r/sysadmin/comments/1d6a1o/til_you_can_copy_and_paste_files_over_rdp/ for more info.
eug wrote what I thing is an extremely useful comment that seems to have overlooked by everyone:
You can very easily share a single folder by using subst to map it to a drive letter, and then selecting that drive in remote desktop.
Note that it's fairly easily to have problems with this method due to subst performing the mapping only for the user under which it is run.
So I recommend to run everything from a single command prompt:
Open a command prompt (Win+R -> cmd)
Type subst <lettertomap>: <pathtofolder>
Type mstsc (which launches Remote Desktop)
Keep in mind that the subst mappings are not persistent across reboots, of course, so this is mostly convenient for a one-time session of file transfer.
There are actually also other ways to do the mapping, see raymond.cc .
And yes, the mapping does seem to disallow access to the rest of the drive, although I wouldn't bet my life that it doesn't have chroot-like "vulnerabilities" (assuming it is supposed to be secure in the first place).
1) Install dropbox or equivalent cloud storage product and sync needed files that way between computers. Remember, you can allow only certain folders to be synced on specific devices (you don't have to sync the entire dropbox, just the folders you need)
2) If you are allowed to setup more than one user on the remote server, have a 2nd user and then have user2 session connect rdp session to user1. This will keep the user1's gui alive in the cloud without having to remain logged in to rdp locally.
This video should show you how to implement this 2 user setup on your server to hold an rdp session open. Note that this does 'permanently' use 1 rdp session until you decide to close it.
[markdown cannot embed video :( ]
Then use AmmyyAdmin AnyDesk on user1's desktop to connect and manipulate the desktop. This includes using AnyDesk's file manager's ability to browse any folder you need and copy. AnyDesk can be free if you connect via direct IP connection. Most vps servers have dedicated IP addresss or subdomain address so this should not be a problem. Good idea to password protect your AnyDesk login and which IDs have access to unattended remote connections. The AnyDesk file manager is a bit crude, but it works. Their big thing is simplicity and speed.
Note: Use portable mode only on the remote user's desktop; Do NOT fully install AnyDesk. Also, the CPU usage might increase to stream the desktop screen, somewhat related to the size of the RDP window. I am using 1280 x 2048 window with 4 cores and the CPU usage is 22-25% idle or moving things around. This might decrease if there is more video ram or graphics processor on the target server. But, if you only "browse files" (use only the file manager without streaming the desktop), CPU usage >0.3% idle and >1 avg% when transferring files (burst up to 5-6% when the file is finished uploading and the pieces are being finalized).
You'd have to write your own scripts (java, .net, c#/c++, AutoIT, etc) to launch AnyDesk locally and automate the connecting and downloading specific files.
This strategy is a bit more complex, but it should do the job. Not sure why microsoft rdp cannot have some simple, quick file manager like what ammyy admin AnyDesk has; oh well.
Add: Can also use AnyDesk or Teamviewer. Teamviewer became a lot more restrictive on what is considered to be "non commercial use", but Anydesk is secure, much smaller footprint, and if you can have a direct connection doesn't seem to care too much about usage. If you do need a license, it will be much lighter on the wallet.
AnyDesk works flawlessly without any installation required. In fact, if using in a server environment as I described above, no installation is recommended.
Edit: AmmyyAdmin is no longer recommended for several months now due to some security and technical concerns. Added AutoIT as a scripting capability to automate interaction with GUI/nearly any windows function.

Resources