How to remove obligation to run as administrator in Windows?

Question

A while ago, I changed C:\WINDOWS\system32\Taskmgr.exe on my professional Windows 10 computer to always run as administrator. I unfortunately don't remember how I did.

Now, my company policy changed, and my user is not administrator anymore. I have a second user with administrative rights, but I need to write the password each time I want to run the task manager. I am still able to run it as myself, but I need to enter my password.

It is not dramatic but I would like to remove this. How can I do that. I saw a lot of answers telling I need to go to Compatibility tab on the .exe, but I don't have it, maybe it is restricted by my company.

Answer 1

That's an interesting question. Why? Because the task manager runs by default with highestAvailable privilege, meaning that if you're an Admin - it'll run elevated, otherwise it won't.

Also: there's no compatibility tab in System32 folder, by design. So how do you force something that's in there to always run as Admin? Well, there are several ways, and since I (and obviously - you ;]) have no idea what you did before, let me explore some of the possibilities:

1. The simplest and most well-known: create a shortcut to whatever in System32 you want to run as Admin, open its Properties -> Advanced (button in the "Shortcut" tab) -> check Run as administrator. Done.

   But wait, it gets more interesting. Using task manager as an example: if you click on the Start menu and start typing task manager it'll appear at the top of the list. Right click on the item, select Open file location, and you'll end up... no, not in the System32 folder. It'll be

   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools

   Now guess what happens if you overwrite the shortcut there with the one you just created (or just change the properties of an existing one)?
   Yes, launching task manager via Start menu now requires Admin elevation.

2. Unfortunately, the above solution won't work if you right click on the Start menu and choose task manager from the list. Why? Because it's a different shortcut of course!

   The more detailed explanation is as follows:

   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools

   is actually accessible by the so-called %ALLUSERSPROFILE% (which equals C:\ProgramData and also C:\Users\All Users) and, as the name suggests, changes the behavior of - in our example: task manager ran via searching in start menu - for each user (even the ones created after the change).

   The right click on the start menu shortcuts are located elsewhere - in

   C:\Users<USERNAME>\AppData\Local\Microsoft\Windows\WinX

   and (as far as I know, correct me if I'm wrong) are user-specific, meaning that the shortcuts have to be modified for every (existing) user separately. The shortcut to the task manager is in the Group2 folder - modify the shortcut there and the right click on the start menu option is done.

3. The only thing left is a Ctrl+Alt+Del and Ctrl+Shift+Tab combination. The one sure way to tackle it that I know of is to use Windows registry feature called Image File Execution Options. This is an advanced debugging option (often used by malware) that, when set, will run the application of your choice instead of whatever you clicked on. And yes, It MAY be the same application, but with a surprise ;]

   To manage the feature run regedit and navigate to the following key:

   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

   If taskmgr.exe is not present there you need to create a new key named taskmgr.exe, right click it and add a new string value (REG_SZ). The name of the value should be Debugger, and the value data is the path to the application you want to run instead of the task manager (in our example). To try it out just put calc.exe there - and try to run the task manager ;]

   A crude but working example of a command that will always elevate the task manager (copy as a single line and put in the value data of the Debugger key):

   cmd.exe /Q /C "@AT>NUL||echo set shell=CreateObject("Shell.Application"):shell.ShellExecute "taskmgr.exe",,"%CD%", "runas", 1:set shell=nothing>%temp%\n0.vbs&start %temp%\n0.vbs /realtime& timeout 1 /NOBREAK>nul& del /Q %temp%\n0.vbs&cls&exit"

Note: the steps described in #3 will override both #1 and #2!

Answer 2

Depending on how you start Task Manager, you didn't change that on the executable itself but on a shortcut, e.g. the shortcut in start menu.

Answer 3

Try this batch file with task manager not running:

set __COMPAT_LAYER=RUNASINVOKER
taskmgr

If it works; you can create a shortcut to launch it.

Answer 4

Because your user is not an administrator, you cannot see the Compatibilty tab.

Log out and back in as your administrator user, and open the properties again.

This time you will see the compatibility tab where the "Always run as Admin" is checked. Uncheck this to revert back to how it used to be.

Answer 5

I decided that the compatibility information had to be stored in the registry somewhere, so I launched regedit.exe went searching.

What I eventually found was Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers, a registry key which on my system contains two values:

• C:\GSmartControl\gsmartcontrol.exe
• C:\Program Files\DebugView++\DebugView++.exe

Both are set to ~ RUNASADMIN, and both are indeed programs I've chosen to have Run as Administrator by default.

So you could try checking there, and if there's an entry for C:\Windows\System32\Taskmgr.exe, just delete it.

Answer 6

Is your account in any local groups on the machine? Being in the “Network Configuration Operators” group (possibly others as well) brings up a UAC prompt asking for your current, non-admin credentials to open Task Manager.

Try running:

Get-LocalGroupMember “Network Configuration Operators”

in PowerShell, or check in lusrmgr.msc

It’s possible the account is being added to the group via Group Policy, in which case you won’t be able to remove yourself permanently. If you added yourself to the group, you can simply remove yourself to resolve the issue, though you will need to be an administrator to manage advanced network settings (static IP, etc.)