Administrator permissions: How do I get full access of my computer?

Ok, ok, thanks. I agree ... partly I will be careful.

I'd still appreciate some answers to the questions in my previous post. I'm just trying to understand how permissions and owership work in Windows 10.

1) Why wasn't I able to change permissions to the "Program Files" folder from the elevated admin account?

2) What is meant by "Administrators" in the security tab in the context menu of a folder? Are they the super admins (but why plural if there is only one)? Or the "normal" administrator accounts?

3) What are the consequences of changing the ownership of the "Program Files" folder to "Administrators" and giving full permission to all users?

And - here's a new question: How can I change the ownership back to "Trusted Installer"? I was thinking to just give myself full access to one specific program folder instead of the whole "Program Files" and leave the rest in the default state.

mrmustard said:

Ok, ok, thanks. I agree ... partly I will be careful.

I'd still appreciate some answers to the questions in my previous post. I'm just trying to understand how permissions and owership work in Windows 10.

1) Why wasn't I able to change permissions to the "Program Files" folder from the elevated admin account?

2) What is meant by "Administrators" in the security tab in the context menu of a folder? Are they the super admins (but why plural if there is only one)? Or the "normal" administrator accounts?

3) What are the consequences of changing the ownership of the "Program Files" folder to "Administrators" and giving full permission to all users?

And - here's a new question: How can I change the ownership back to "Trusted Installer"? I was thinking to just give myself full access to one specific program folder instead of the whole "Program Files" and leave the rest in the default state.

1. Because the elevated admin account didn't have the rights to do that.
2. In this context "Administrators" refers to any elevated admin account. A non elevated admin account has only the rights of a standard user.
3. You would compromise security. Malware running with standard user rights could do whatever it pleases with the folder and it's contents. Write access to the Program Files folder has been limited to elevated admin level accounts since Vista.

Be aware that file and folder permissions are complex. You won't learn everything by reading a few forum posts.

You really should be leaving these permissions alone.

mrmustard said:

Ok, ok, thanks. I agree ... partly I will be careful.

I'd still appreciate some answers to the questions in my previous post. I'm just trying to understand how permissions and owership work in Windows 10.

1) Why wasn't I able to change permissions to the "Program Files" folder from the elevated admin account?

Because Administrators doesn't have the necessary permissions.

2) What is meant by "Administrators" in the security tab in the context menu of a folder? Are they the super admins (but why plural if there is only one)? Or the "normal" administrator accounts?

Administrators is the name of a Group. Accounts can be members of one or more groups. You cannot log on as a group, only as an individual account. All accounts with admin rights are members of the Administrators group. Administrator (the one you call the 'super admin') is a special built-in account (another is Guest). Ownership and permissions can be granted to a single account or to a Group. Permissions granted to a group apply to all accounts that are members of that group.

3) What are the consequences of changing the ownership of the "Program Files" folder to "Administrators" and giving full permission to all users?

Users is another Group. All users would be able to modify the contents of Program Files, including any malware processes they may be running.

And - here's a new question: How can I change the ownership back to "Trusted Installer"?

You have to type TrustedInstaller's name in full before you will find it when you click 'check names'. It is:
NT SERVICE\TrustedInstaller

I was a bit confused about the "Administrators" group because I thought there was only one elevated administrator account that could be activated.

Could somebody please help me restoring default permissions in the "Program Files" folder by just telling me what permissions the group "Administrators" has in this folder?

I changed the owership back to "Trusted Installer" and restricted users' permissions to "Read & execute", "List folder contents" and "Read". I believe that was the default. But I don't remember which permissions the Administrators group had. BTW, was exactly is "special permissions" and who can give them?

Is there possibly a command that would let me revert permissions in a given folder to their default value? I came across this free software called Windows Repair that can repair permissions on the entire C drive. But I wouldn't want to do that because I really only changed anything in "Program Files" and I am not having any issues either.

mrmustard said:

I changed the owership back to "Trusted Installer" and restricted users' permissions to "Read & execute", "List folder contents" and "Read". I believe that was the default. But I don't remember which permissions the Administrators group had. BTW, was exactly is "special permissions" and who can give them?

Special permissions are just a combination of permissions that can't be achieved by ticking the boxes on the Properties Security tab. It says that 'For special permissions or advanced settings, click Advanced'. This gets you to here, where you see the permissions for Administrators on my PC. You can change the permissions here too.

RolandJS said:

I've run Windows Repair (All in One) different times on all three of my computers -- as far as I can tell, it does not fix what is not broken, i.e., if a setting is Windows default - that setting remains as is.

So you think I could run it without hesitation if I wanted to be sure that the "Program Files" folder is back in its default state regarding permissions?

Anyway, thanks for your help to everyone! Just one last question: Before I took ownership of "Program Files" with my user account I was not able to give permissions to anyone in this folder. Now I am still able to do that, even though I gave ownership back to "Trusted Installer". That surprises me. Any explanations?