Elevated prompt and title in a non-elevated command window means what?


  1. Posts : 22
    Win 10 Pro
       #1

    Elevated prompt and title in a non-elevated command window means what?


    I am a standard user:
    there is no "Administrator" next to my name when I look at "Your Info" for my account in user settings.
    the output of "net localgroup administrators" does not contain my user name.
    I am on a domain-managed machine and I am not a domain admin either.

    I click the Start key, write "cmd", then right-click on "Command Prompt" and choose "Run as Adminstrator". When UAC asks for admin credentials, the default choice is my own user name; I give my own password and hit 'enter'.

    The command window that comes up has as its title: "Adminstrator: Command Prompt"; and the working directory prompt reads "C:\WINDOWS\system32>"

    I still don't have admin privileges, I think. At least, for example, both the commands "net session" and "net user administrator /active:yes" both return the same result: "System error 5 as occurred. // Access is denied."

    Is this normal? If it is, then all the countless posts which say that the title and prompt of the command prompt are sure ways to tell if it is elevated are simply wrong?

    Thank you,

    scott
      My Computer


  2. Posts : 8,059
    windows 10
       #2

    If your on a domain you can have domain admin and admin on the local pc it all depends how they have setup the domain what you get if any
      My Computer


  3. Posts : 22
    Win 10 Pro
    Thread Starter
       #3

    Samuria said:
    If your on a domain you can have domain admin and admin on the local pc it all depends how they have setup the domain what you get if any
    My specific question is if the "elevated prompt" (i.e. "C:\WINDOWS\system32\>") and the "elevated title" (i.e. "Administrator: Command Prompt") imply ANYTHING at all about the permissions and/or credentials that are applied to commands entered into that window -- which is something asserted by MANY descriptions of the Windows command prompt.

    In particular, if these "indicators" are indeed displayed when a standard user requests an elevated command prompt, is that a sign of some kind of system corruption or intrusion.

    It certainly is misleading if it's not.
      My Computer


  4. Posts : 31,479
    10 Home x64 (22H2) (10 Pro on 2nd pc)
       #4

    sbpetrack said:
    I still don't have admin privileges, I think. At least, for example, both the commands "net session" and "net user administrator /active:yes" both return the same result: "System error 5 as occurred. // Access is denied."
    As you appear to log on with your domain account, then the local rights you have on this PC are inherited from you domain rights. These were set by your network administrator, along with group policies to control what you can (and cannot) do.

    Yes, you are running an elevated command prompt - but what you are allowed to do in it only your IT department can tell you.
      My Computers


  5. Posts : 22
    Win 10 Pro
    Thread Starter
       #5

    Bree said:
    As you appear to log on with your domain account, then the local rights you have on this PC are inherited from you domain rights. These were set by your network administrator, along with group policies to control what you can (and cannot) do.

    Yes, you are running an elevated command prompt - but what you are allowed to do in it only your IT department can tell you.
    Finally, some clarity!! Thank you very much. A few follow-on questions please:
    1. Yes, I do log on with my domain account. Is it necessarily the case that the only way to find out my domain rights and group policy is to ask someone in IT? Is it at least possible that these rights and permissions are visible to me? (I am hoping that whether I have visibility into these is itself a domain right or set in group policy (including of course the right to see what rights I have)).

    2. If a machine is part of a domain, do the domain admins have the ability to reduce the permissions of local admin users to something short of "everything"? Or do local admins retain all the privileges they have, even when the machine joins a domain?

    Thanks!

    scott
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 10:41.
Find Us




Windows 10 Forums