Unable to open an elevated Windows Explorer window
-
Monday, February 01, 2010 7:19 PMHello,
In Windows Vista, it was possible to run an elevated Windows Explorer window. To do so, enable the "Launch folder windows in a separate process" check box, log off, and then log back on. After that, you can right-click the Windows Explorer shortcut and choose "Run as administrator."
This no longer works in Windows 7. It is a legitimate need to occasionally run Windows Explorer elevated; for example, to register or unregister WSC (Windows script component files) or to run Windows scripts elevated.
Can anyone comment on this limitation and whether it is a flaw or by design?
Thanks!
Bill Stewart
All Replies
-
Tuesday, February 02, 2010 5:19 AMIt appears to work for me (I can right-click Windows Explorer in the Start menu and choose 'Run as Admin'. It prompts for confirmation, but then when I test it to see if I can, for example, create a folder in the System32 directory, it still prompts for confirmation again.I'd be interested in an answer as well.
- Edited by Shawn B. KeeneMVP Tuesday, February 02, 2010 5:19 AM for editing.
-
Tuesday, February 02, 2010 7:01 AMWhat happens if you run Explorer from an elevated command prompt? FWIW right clicking on Explorer and using Run as administrator works for me. What can't you do?
Kerry Brown MS-MVP - Windows Desktop Experience -
Tuesday, February 02, 2010 3:27 PM
FWIW right clicking on Explorer and using Run as administrator works for me.
I doubt this. The process starts, but not with elevated rights (High IL). It only has medium IL.
Kerry Brown MS-MVP - Windows Desktop Experience
Windows 7 uses a DCOM mechnism to start Explorer (explorer.exe /factory,{GUID}) and this desn't allow you to start the explorer elevated.
André
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/- Proposed As Answer by Andre.Ziegler Saturday, February 27, 2010 6:46 PM
-
Tuesday, February 02, 2010 3:40 PM
What happens if you run Explorer from an elevated command prompt? FWIW right clicking on Explorer and using Run as administrator works for me. What can't you do?
Hi,
Please carefully re-read my original post :) It works in Vista with "Launch folder windows in a separate process", but it does not work in Windows 7. There are legitimate reasons why I occasionally need to work from an elevated Windows Explorer window. Two examples come to mind: Registering or unregistering a WSC (Windows script component file); executing a Windows script elevated by double-clicking on it (for example, a .vbs or .js file).
Regards,
Bill -
Tuesday, February 02, 2010 3:42 PM
It appears to work for me (I can right-click Windows Explorer in the Start menu and choose 'Run as Admin'. It prompts for confirmation, but then when I test it to see if I can, for example, create a folder in the System32 directory, it still prompts for confirmation again.
That's because 'Run as administrator' for Explorer doesn't actually run it as administrator. Install the PrivBar DLL and you'll see what I mean.This appears to be broken in Windows 7.
Bill -
Wednesday, February 24, 2010 11:13 PMI know exactly what you mean, I don't want to run explorer as "Administrator" but as my Domain Admin Account, and in XP I usually opened a command prompt with elevated privileges via a runas script to do just that (among other administrative tasks). However, when doing so in Windows 7, I get an access denied when trying to launch explorer.exe from the elevated command prompt. Not to mention when trying to run explorer.exe diretly using "run as different user". When turning off UAC, launching explorer.exe from a privileged command prompt or using "run as different user" just spawns a new explorer window from my non-priv account despite having the "Run as a separate process" flag set for both users.
Although I really enjoy Windows 7, this has been a bit frustrating and I'm forced to perform file managment on remote servers using RDP Connetions. The only thing I have found that comes close to the XP LUA functionality is turning off UAC and and launching a 3rd party file management such as A43. However, I believe that is a less than desired solution; Perhaps someone has a good alternative?
Paul -
Saturday, February 27, 2010 6:38 PMYou're right. I finally had some time to play with this. I've been volunteering for the 2010 Olympics. I can't find any way to get Windows 7 to run an elevated Windows Explorer.
Kerry Brown MS-MVP - Windows Desktop Experience -
Tuesday, March 09, 2010 10:12 PMI am currently using Explorer++ to work around this limitation. But I would still like to hear an official answer regarding this problem.
Bill -
Tuesday, March 09, 2010 11:24 PMAs I already told you Windows 7 Explorer uses a DCOM based start methode which prevents you from running windows explorer elevated.
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/ -
Thursday, April 08, 2010 3:42 PM
As I already told you Windows 7 Explorer uses a DCOM based start methode which prevents you from running windows explorer elevated.
Reference?
Bill
-
Friday, April 09, 2010 2:03 PM
My own research.
I found a way to disable this limitation. I'm testing it currently. I was able to bypass the mechanism to elevate the Explorer.
As you can see the explorer is started from the DCOM service. By default it denies every attempt to start exporer elevated.
But as you can see here it can be done:
As you can see, there a 2 explorer instances. 1 with normal user rights (medium IL on the right. PID 2748) and 1 explorer with admin rights (high IL on the left side of the picture).
Maybe I'll poist a Guide how to enable this.
best regards
André
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/- Proposed As Answer by Andre.Ziegler Friday, April 09, 2010 2:04 PM
-
Wednesday, April 14, 2010 8:10 AM
Hi André,
Could you now tell us more about about did you get this? TIA
-
Friday, May 28, 2010 10:38 PM
I would still like to get an explanation from Microsoft regarding this problem and whether there are any plans to fix it.
Bill
-
Saturday, May 29, 2010 2:35 PM
This is no problem and nothing needs to be fixed. This is by design. The explorer has a component which blocks every request to elevate the Explorer and I simply turned off that feature and now I'm able to elevate the Explorer again.from Microsoft regarding this problem and whether there are any plans to fix it.
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/ -
Sunday, June 06, 2010 4:14 AM
This is no problem and nothing needs to be fixed. This is by design. The explorer has a component which blocks every request to elevate the Explorer and I simply turned off that feature and now I'm able to elevate the Explorer again.
Great! How?
Bill
-
Sunday, June 20, 2010 9:42 PM
Since Andre.Ziegler hinted at this, I spent some time investigating it, and it seems like you can make elevated explorer windows work by renaming the following registry entry:
HK_CLASSES_ROOT\AppID\{CDCBCFCA-3CDC-436f-A4E2-0E02075250C2}\RunAs
to
HK_CLASSES_ROOT\AppID\{CDCBCFCA-3CDC-436f-A4E2-0E02075250C2}\_RunAs
BTW: You will likely have to go in as an administrator and take ownership of that registry key before you can modify it, as by default, only TrustedInstaller can modify it.
This will stop the mechanism that launches explorer.exe from always launching it as the current interactive user. I know I've been looking for this for a long time in Win7, glad that I finally found out how to do it.
- Proposed As Answer by Andre.Ziegler Sunday, June 20, 2010 10:07 PM
-
Sunday, June 20, 2010 10:08 PMYes, that's it ;)
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/ -
Wednesday, June 23, 2010 6:13 PM
Hi guys, thanks a lot for this tip!
I was looking for a solution to be able to start Windows Explorer as admin, by time. In my WinXP land usually use LUA approach and (when neccesary) run WExplorer or IExplorer as admin with the context menu option "Run As".
I'm very happy to have found a chance! But just a question: this tip may cause security issues or instability problems?
tia. m :)
-
Wednesday, June 23, 2010 8:21 PM
Since Andre.Ziegler hinted at this, I spent some time investigating it, and it seems like you can make elevated explorer windows work by renaming the following registry entry:
HK_CLASSES_ROOT\AppID\{CDCBCFCA-3CDC-436f-A4E2-0E02075250C2}\RunAs
to
HK_CLASSES_ROOT\AppID\{CDCBCFCA-3CDC-436f-A4E2-0E02075250C2}\_RunAs
BTW: You will likely have to go in as an administrator and take ownership of that registry key before you can modify it, as by default, only TrustedInstaller can modify it.
This will stop the mechanism that launches explorer.exe from always launching it as the current interactive user. I know I've This been looking for this for a long time in Win7, glad that I finally found out how to do it.
I tried to rename other 'String Values' with this method and seems to work for other purposes.
e.g. to make visible "Open command window here" on folders context menu, i renamed "Extended" S.Value as "_Extended " at
HKEY_CLASSES_ROOT\Directory\shell\cmd
Sorry for my OT...med
-
Thursday, July 15, 2010 9:09 AM
Since Andre.Ziegler hinted at this, I spent some time investigating it, and it seems like you can make elevated explorer windows work by renaming the following registry entry:
HK_CLASSES_ROOT\AppID\{CDCBCFCA-3CDC-436f-A4E2-0E02075250C2}\RunAs
to
HK_CLASSES_ROOT\AppID\{CDCBCFCA-3CDC-436f-A4E2-0E02075250C2}\_RunAs
BTW: You will likely have to go in as an administrator and take ownership of that registry key before you can modify it, as by default, only TrustedInstaller can modify it.
This will stop the mechanism that launches explorer.exe from always launching it as the current interactive user. I know I've been looking for this for a long time in Win7, glad that I finally found out how to do it.
I followed these instructions but I am still not able to run explorer as admin by right-clicking explorer.exe or cmd.exe and using 'Runas administrator'. They still open as the logged in user. I have also enabled 'Launch folder windows in a separate process' in the folder options for the administrator account (as worked in XP), but that seems to make no difference.
I have 2 small shortcut/link files that worked perfectly on XP, allowing me to do admin stuff at users' computers while they are logged in. They contain the following commands:
%windir%\system32\runas.exe /env /user:%computername%\administrator cmd.exe
and
%windir%\system32\runas.exe /env /user:%computername%\administrator explorer.exe
On Windows 7, launching the cmd.exe command works (it's process shows as the admin's username) and I can launch regedit from that command prompt and it shows as running as the admin account.
However, the explorer.exe command does not. Instead, I get the following error: Server execution failed.
I have tried it with UAC enabled and disabled, but the result is the same.
Any ideas?
tia
Mel
-
Thursday, July 15, 2010 12:54 PMFor me it works. I' using this way since April, when I found this way.
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/ -
Thursday, July 15, 2010 2:49 PMJust fyi, I am testing using the 'Professional N Upgrade' version of Windows 7 (only installable with pre-existing OS).
Don't know if that makes any difference or not. -
Thursday, July 15, 2010 10:03 PM
I don't think this makes a difference. All Editions use the same Explorer.exe.
What have you done? Deleted the RunAs key or renamed it?
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/ -
Friday, July 16, 2010 4:23 AM
I used Guy.Incognito's Reg hacks above and it is working great for me, thanks!.
melf67, I typically just use Shift + Right Click + "Run as Different User" to open an explorer window so I had not noticed the problem you described. However, I do run a similar LUA script called makemeadmin.cmd to open a command prompt as my domain admin account. (I believe credit is due to Aaron Margosis for it)...
C:\WINDOWS\system32\runas.exe /savecred /user:DOMAINNAME\%username%2 "cmd.exe /k cd c:\ && color 0e && title ***** Admin console ***** && CLS"
(The "2" at the end of the username equates to our domain admin accounts which is the same as our regular username plus the "2".
From there, I just type "explorer" and I do get an explorer window with my "username2" credentials while logged on to the computer as "username". I prefer the Command Prompt Window because I like to drag shortcuts, msc files, etc into it to run them with elevated privs.
So... looking at your runas script for explorer, I noticed you use the /env variable which is supposed to "use current environment instead of user's". Try dropping the /env script and see what happens, worked for me. I like to use the savecred switch though, I know its a bit of a security hole (and supposedly unsupported on Winodws 7 but it seems to work). However, I type my password a gazzilion times a day and the risk vs benefit seems worthwhile in time saving.
By the way, try the makemeadmin script from Aaron Margosis' blog, its a great way to momentarily elevate a user's privs when you need to install software on a customer's machine and within their profile.
-
Friday, July 16, 2010 12:59 PM
OK. Wierd.
It didn't work yesterday, so I gave up, shutdown the computer and went home. Today, it works using any method (shift+right-click on explorer.exe, running explorer.exe from an admin command line, launching an 'admin' runas script, etc).
I know what you're thinking...but I did reboot yesterday (several times) after changing the registry, and it still wasn't working.
@Andre: I renamed to _RunAs
@Paul: I have dropped the /env switch. And many thanks for the link to Aaron Margosis' blog. PrivBar fixes the problem of the 'BackBitmapShell' reg hack not working in Windows 7. Well happy now!!
Much appreciated.
Mel
-
Monday, August 23, 2010 5:50 AMIt seems as though this might also lead us to being able to open a 32 bit explorer.exe on x64 Win7?
-
Monday, February 21, 2011 10:04 AM
This in combination with http://technet.microsoft.com/en-us/sysinternals/cc300361 also makes it work in Windows Vista.
I have installed it on both Windows 7 and Windows Vista and it works great!
-
Friday, March 25, 2011 3:54 PM
Since Andre.Ziegler hinted at this, I spent some time investigating it, and it seems like you can make elevated explorer windows work by renaming the following registry entry:
HK_CLASSES_ROOT\AppID\{CDCBCFCA-3CDC-436f-A4E2-0E02075250C2}\RunAs
to
HK_CLASSES_ROOT\AppID\{CDCBCFCA-3CDC-436f-A4E2-0E02075250C2}\_RunAs
BTW: You will likely have to go in as an administrator and take ownership of that registry key before you can modify it, as by default, only TrustedInstaller can modify it.
This will stop the mechanism that launches explorer.exe from always launching it as the current interactive user. I know I've been looking for this for a long time in Win7, glad that I finally found out how to do it.
Be aware! This workaround could not be revoked.
After taking the ownership away from TrustedInstaller, there is no way (at least I know of) to bring the ownership back to it. Renaming the key from "_RunAs" to "RunAs" doesn't bring back the default behavior.
Even worse. EVERY restricted user will be able to run Explorer.exe as administrator without entering any password.
[Edit] the explorer.exe started this way doesn't have elevated privileges, though. [/Edit]
I strongly recommend not to use this procedure until there is a way to reliably revoke the default behavior!
If anybody is aware of how to restore the default, please post it here. Thank you very much in advance.
Solution:
http://www.vistax64.com/tutorials/159360-trustedinstaller-restore-owner.html
here it is, how to get back TrustedInstaller as owner of the mentioned key. THE OWNERSHIP itself is the only reason why explorer will or will not start as runas. It has absolutely nothing to do with renaming the "runas"-key to "_runas".
-
Friday, March 25, 2011 8:01 PMSure, simple rename the key back or run the DCOM config MMC Snapin and set the options of the Elevated-Unelevated Explorer Factory
"A programmer is just a tool which converts caffeine into code"
Want to install RSAT on Windows 7 Sp1? Check my HowTo: http://www.msfn.org/board/index.php?showtopic=150221 -
Wednesday, April 06, 2011 2:59 PM
I tried the way what you mentioned abouve.now it able to run but it dosent open the explorer but when i look at the task manager it showes its running . What i need to do exactly now.I am using Win 7 Entrprise
A curve that can set lot of things i.e SMILE -
Wednesday, April 06, 2011 3:48 PM
If i explictly call explorer separate then this works
A curve that can set lot of things i.e SMILE -
Friday, December 23, 2011 9:38 AMMany thanks to Guy.Incognito and Andre.Ziegler for this. Glad to see it's not impossible. I can finally add "Open as administrator" to the context menu of a folder to open it temporarily as admin.Taking registry key ownership and admin permissions is annoying. subinacl FTW.Can any one now find how to start the 32-bit Explorer on 64-bit Windows 7 as that has also been disabled by MS compared to Vista.
.png){kind=spacer}
