Taking ownership

[PaulM]

I changed the HKCR\*\shell\takeownership\", "Take Ownership", to
HKCR\*\shell\runas\","Take Ownership". That was the problem. I already had
other code in the runas reg key at the time. It was my bad! Sorry. If its
all right with you I will add the exe code to my script. Again sorry.



Paul's XP and Vista Tweaks
---------------------------------------------
www.paulsxp.com
---------------------------------------------
Paul's Forum
---------------------------------------------
www.paulsxp.com/forum
---------------------------------------------
"Dave-UK" wrote in message

My script does not work in windows 7. I will update it.

I did get your reg file to work, it was something in the registery.

What was the ' something ' in your ' registery ' ?
You haven't provided any details, and until you do I can only assume you are
just lying about your 'problem'. It never existed, it was just you spreading
FUD.
I see you have corrected your sloppy code but you haven't included exe files
so
your Take Ownership script is as useless as the others.
You should include the reg file I posted in your script, then it would
handle all files.

 

[Dave-UK]

I changed the HKCR\*\shell\takeownership\", "Take Ownership", to
HKCR\*\shell\runas\","Take Ownership". That was the problem. I already had
other code in the runas reg key at the time. It was my bad! Sorry. If its
all right with you I will add the exe code to my script. Again sorry.

OK.
The reg file isn't mine, I found it about a year ago after trying several of the others.
It's only a small text file anyway so nobody really 'owns' it.

 

[PaulM]

Ok, thanks.


Paul's XP and Vista Tweaks
---------------------------------------------
www.paulsxp.com
---------------------------------------------
Paul's Forum
---------------------------------------------
www.paulsxp.com/forum
---------------------------------------------
"Dave-UK" wrote in message

I changed the HKCR\*\shell\takeownership\", "Take Ownership", to
HKCR\*\shell\runas\","Take Ownership". That was the problem. I already
had other code in the runas reg key at the time. It was my bad! Sorry.
If its all right with you I will add the exe code to my script. Again
sorry.

OK.
The reg file isn't mine, I found it about a year ago after trying several of
the others.
It's only a small text file anyway so nobody really 'owns' it.

 

[bad sector]

There have been numerous posts in this NG about the problem of Win7
preventing changes to, or doing something with a file, because the
person trying it does not have the correct permission, even if that
person has administrator status.

The way round this is normally said to be opening the file properties,
going to the security tab, and changing the permissions settings. It
isn't that easy and sometimes doesn't seem to work.

Has anyone installed the registry hack given here which supposedly makes
the whole process a lot easier?
http://www.howtogeek.com/howto/wind...ership-to-explorer-right-click-menu-in-vista/


Reading the comments on that page and in the forum it seems to work for
most people, but for others it doesn't and may even screw some things up.

Anyone here who has installed and used it - successfully or not?

I haven't installed it yet but i don't understand how 'admin' does not
have rights do do as admin pleases? Is that the same as 'root' in linux
or something less?

 

[Gene E. Bloch]

I haven't installed it yet but i don't understand how 'admin' does not have
rights do do as admin pleases? Is that the same as 'root' in linux or
something less?

There are two different things.

1. *THE* Administrator, which is analogous to root.

2. A user of account type "Administrator", who has *some* administrator
privileges.

 

[Dave-UK]

There are two different things.

1. *THE* Administrator, which is analogous to root.

2. A user of account type "Administrator", who has *some* administrator
privileges.

I used to think that there was a difference between THE Administrator and AN administrator but I am not sure now.
According to this article they are equivalent:
"The built-in administrator account and a user administrator account have the same level of privileges."
http://en.wikipedia.org/wiki/Superuser

 

[Gene E. Bloch]

I used to think that there was a difference between THE Administrator and AN
administrator but I am not sure now. According to this article they are
equivalent:
"The built-in administrator account and a user administrator account have the
same level of privileges."
http://en.wikipedia.org/wiki/Superuser

That's definitely not so in my experience, or in most comments by
others that I have seen.

I have had to log in as Administrator more than once under Windows 7 to
accomplish some task or other that was not permitted under my user
account, which is of type Administrator (and is set up to require a
password, of course).

It has been months, however, so I can't remember what those tasks were.
Sorry, I wish I could.

 

[Bob I]

I used to think that there was a difference between THE Administrator
and AN administrator but I am not sure now. According to this article
they are equivalent:
"The built-in administrator account and a user administrator account
have the same level of privileges."
http://en.wikipedia.org/wiki/Superuser

See this

http://www.windows7news.com/2009/02/03/enable-or-disable-the-windows-7-administrator-account/

 

[Gene E. Bloch]

That's definitely not so in my experience, or in most comments by others that
I have seen.

Here's an article that supports my statement:
http://www.tech-forums.net/pc/f127/admin-rights-vista-windows-7-a-197772/

At the same time, there are articles, including at Microsoft's site,
which contradict my position.

I still think I'm right, but my case is weaker

 

[Stan Brown]

See this

http://www.windows7news.com/2009/02/03/enable-or-disable-the-windows-7-administrator-account/

That article concludes with: "Again, it is not really necessary to
enable the administrator account, as it is possible to use a standard
account with elevated rights for the same configuration options that
an administrators account would offer. And it is better for security
to not run an administrator account by default."

But if that is true, then why does "the administrator" account even
exist? If it can't do anything that I can't do when elevating
privilege, then what is its purpose?

 

[Char Jackson]

That article concludes with: "Again, it is not really necessary to
enable the administrator account, as it is possible to use a standard
account with elevated rights for the same configuration options that
an administrators account would offer. And it is better for security
to not run an administrator account by default."

But if that is true, then why does "the administrator" account even
exist? If it can't do anything that I can't do when elevating
privilege, then what is its purpose?

Just thinking out loud because I've never been interested enough to
actually look into it, but maybe the Administrator account does
everything without constantly nagging the user for privilege
elevation. If so, that alone would make it valuable.

 

[Dave-UK]

That article concludes with: "Again, it is not really necessary to
enable the administrator account, as it is possible to use a standard
account with elevated rights for the same configuration options that
an administrators account would offer. And it is better for security
to not run an administrator account by default."

But if that is true, then why does "the administrator" account even
exist? If it can't do anything that I can't do when elevating
privilege, then what is its purpose?

I think there must be one administrator account available, that's independent of any user, to
access the system, otherwise you could remove all accounts and be permanently locked out.

This is from a Microsoft publication, Administrator's Pocket Consultant by William R. Stanek:

"All applications that run on Windows 7 derive their security context from the
current user's access token. By default, UAC turns all users into standard users even
if they are members of the Administrators group. If an administrator user consents
to the use of her administrator privileges, a new access token is created for the user.
It contains all the user's privileges, and this access token - rather than the user's
standard access token - is used to start an application or process."

That seems to be saying that if you run your account as admin and disable UAC then that's
the same as if you were running in the hidden Administrator account.

 

[Zaphod Beeblebrox]

Just thinking out loud because I've never been interested enough to
actually look into it, but maybe the Administrator account does
everything without constantly nagging the user for privilege
elevation. If so, that alone would make it valuable.

It does indeed allow you to do everything without the UAC prompts
(which you can also do by adjusting the UAC level), but it also serves
an additional purpose: If you manage to demote every user to Limited
so that you do not have an account left with administrator privileges,
you can boot to safe mode and the Administrator account will be
enabled so that you can log in and fix the user permissions. Kind of
a failsafe.

 

[Char Jackson]

It does indeed allow you to do everything without the UAC prompts
(which you can also do by adjusting the UAC level), but it also serves
an additional purpose: If you manage to demote every user to Limited
so that you do not have an account left with administrator privileges,
you can boot to safe mode and the Administrator account will be
enabled so that you can log in and fix the user permissions. Kind of
a failsafe.

I notice that the built-in Admin account can be disabled in Computer
Management. I suppose that would be a bad idea, generally.

 

[Gene E. Bloch]

On Fri, 9 Dec 2011 08:25:19 -0500, "Zaphod Beeblebrox"

I notice that the built-in Admin account can be disabled in Computer
Management. I suppose that would be a bad idea, generally.

But it's easily reenabled.

In an elevated command window[1], run this:
net user Administrator /active:yes

Later do the same with no instead of yes to disable it.

[1] From a Standard User account, you will need to know the
Administrator password to elevate the command window.

 

[Char Jackson]

On Fri, 9 Dec 2011 08:25:19 -0500, "Zaphod Beeblebrox"

I notice that the built-in Admin account can be disabled in Computer
Management. I suppose that would be a bad idea, generally.

But it's easily reenabled.

In an elevated command window[1], run this:
net user Administrator /active:yes

Later do the same with no instead of yes to disable it.

[1] From a Standard User account, you will need to know the
Administrator password to elevate the command window.

Yeah, I thought of that after I posted. Thanks.

 

[Stan Brown]

It does indeed allow you to do everything without the UAC prompts
(which you can also do by adjusting the UAC level), but it also serves
an additional purpose: If you manage to demote every user to Limited
so that you do not have an account left with administrator privileges,
you can boot to safe mode and the Administrator account will be
enabled so that you can log in and fix the user permissions. Kind of
a failsafe.

Are you saying the Administrator account is automatically enabled in
Safe Mode? Yikes -- that would be a huge security hole, since anyone
who gets hold of your computer could simply boot into Safe Mode and
have access to everything.

 

[Tom Lake]

"Stan Brown" wrote in message

It does indeed allow you to do everything without the UAC prompts
(which you can also do by adjusting the UAC level), but it also serves
an additional purpose: If you manage to demote every user to Limited
so that you do not have an account left with administrator privileges,
you can boot to safe mode and the Administrator account will be
enabled so that you can log in and fix the user permissions. Kind of
a failsafe.

Are you saying the Administrator account is automatically enabled in
Safe Mode? Yikes -- that would be a huge security hole, since anyone
who gets hold of your computer could simply boot into Safe Mode and
have access to everything.

The account is enabled but you still need the administrator's password
to log into it. Of course, if you haven't set an administrator password,
you're correct. It's a hole.

Tom L

 

[Stan Brown]

"Stan Brown" wrote in message



Are you saying the Administrator account is automatically enabled in
Safe Mode? Yikes -- that would be a huge security hole, since anyone
who gets hold of your computer could simply boot into Safe Mode and
have access to everything.

The account is enabled but you still need the administrator's password
to log into it. Of course, if you haven't set an administrator password,
you're correct. It's a hole.

Tom L

Tom,

You might not be aware of a big problem with your quoting style.
The way your newsreader is doing it, when someone else follows
up, it looks like you *said* what you actually only quoted. You can
see that my paragraph ("Are you saying") and yours (The account is
enabled") are quoted exactly the same, and that's wrong.

The problem is that Windows Live Mail 2011 (version 15) has a
quoting style that is completely broken. Unfortunately that poses
a painful choice to you: either fix every quote manually, or get
a real newsreader such as Gravity, Xananews, and Forte Agent (to
mention some that come to mind at the moment). OR, if you really
want WLM, some say that WLM 14 will serve; see "SC Tom" below.

update 2011-04-02: I've seen a newsgroup posting claiming you
can un-break WLM 15 by installing and using an Autohotkey script:
http://www.dusko-lolic.from.hr/wlmquote/

Thanks for your consideration!

Along with what the others have suggested, you can uninstall
WLM 2011 and install WLM 2009 instead, which handles quoting
a lot better:

http://www.microsoft.com/downloads/en/details.aspx?
FamilyID=56883de5-2024-4631-806e-757693072a1c

[or use http://tinyurl.com/25zfouw which redirects to the above]

 

[Zaphod Beeblebrox]

"Stan Brown" wrote in message


The account is enabled but you still need the administrator's
password
to log into it. Of course, if you haven't set an administrator
password,
you're correct. It's a hole.

<WLM broken quoting manually fixed... Please heed Stan's
recommendation to "fix" WLM or change to a newsreader that handles
quoting properly.>

The Administrator account is only automatically enabled if there are
no accounts with administrator privileges left on the system. As you
said, you still need to know the password for the Administrator
account, but since the account is hidden and disabled in Windows 7
(and Vista, same applies there), few would ever think to add a
password to the account.

--
Zaphod

Arthur: All my life I've had this strange feeling that there's
something big and sinister going on in the world.
Slartibartfast: No, that's perfectly normal paranoia. Everyone in the
universe gets that.