OS: Windows 10
Windows Server: 2016
Windows Version: 1607 (OS Build 14393.5291)
According to server manager I have built-in admin privileges, but there are times when I can't change or access certain settings and programs because my admin level needs to be elevated or it says I am restricted from doing so.
The person that was the previous IT admin left without training me, so I have to figure out a lot of stuff on my own.
I don't think there's really a "list" of any kind. Ofc, someone will prove me wrong.
Generally, the Administrators group has the highest privileges, except for the built-in Administrator.
Microsoft, at various times for various reasons... changes the user's access on new OSes or even on upgrades.
This is a fairly large subject though. Might want to Google a few things like...
Windows Server 2016 account types
or... Windows user account types
All windows is now proteceted to keep the windows safe so lots of folders cant be accessed like most of the windows folders
I know nothing about Server and can only provide a Windows 10 explanation.
Use the command
WhoAmI - SS64Code:WhoAmI /PRIV
WhoAmI - MSDocs
I suggest that you run it in the built-in account you referred, to as well as
in an Admin account created on the computer in question, &
in an Admin account created on the computer in question after opening & giving elevation permission to the Command prompt / PS window, &
in a Standard account on the computer in question.
When I last did this in 2013, I had to search for each line of the results online to get suggested interpretations of them. I never found an authoritative source.
That's how Windows 10 works.
It is all governed by UAC, User account control.
With the exception of the Windows 10 Built-in Admin, all other Admin accounts are initially logged in with Standard privileges. The "Admin prompt" ["ElevationUI", "ConsentUI", "CredentialUI"] provides the opportunity for elevating the specific task in hand.
Windows 10 has muddied the waters a bit. There are a few things that a Standard user cannot even see so has no opportunity to call it up for an Admin to give permission. The only example I can think of off the top of my head is changing a network connection between metered & non-metered through Settings, Network.
These responses might indicate that something other than privileges / permissions is in play.
All the best,
Denis
Last edited by Try3; 28 Sep 2022 at 12:50.
When I ran "whoami /priv" in CMD on my admin account computer, it basically shows that most things are disabled - such as, I can't change the system time, load and unload device drivers, etc.
I don't know. Perhaps the SS64 or MSDocs references provide some guidance.
I think your OS is not like Windows 10 in this respect so you'll probably need to seek advice on a Server forum, if there are any.
In Windows 10, the privileges of a Standard user or an Admin user before elevation & an elevated Admin user are different.
These results are for Windows 10:
Blue - Admin user logged in normally [i.e. with Standard privileges]
Red - Admin user after giving Admin permission to open an elevated command prompt
I do not have the corresponding results for a Standard user or the Built-in Admin to hand.
Best of luck,
Denis
Is there a specific job that you have in mind?
Windows 10 Admin users & elevated Standard users [i.e temporarily Admin users] can change the time, mess about with drivers, ...
Denis
SYSTEM>Admin, that is pretty much all you need to know. Ransomware (ab)uses SYSTEM privileges.
This what I use to access SYSTEM CMD before logon, if I need to elevated admin or to fix issues:
Code:takeown /s %computername% /u %username% /f "%WINDIR%\System32\utilman.exe" icacls "%WINDIR%\System32\utilman.exe" /grant:r %username%:F copy /y %WINDIR%\System32\cmd.exe %WINDIR%\System32\utilman.exe takeown /s %computername% /u %username% /f "%WINDIR%\System32\sethc.exe" icacls "%WINDIR%\System32\sethc.exe" /grant:r %username%:F copy /y %WINDIR%\System32\cmd.exe %WINDIR%\System32\sethc.exe
Quote
