Does "Run as administator" really do anything if UAC is off?

Question

I know that User Account Control should not be turned off, but let's just say it's off for the sake of argument. With UAC off, I still have the option to "Run as administrator" on executable files, even though I have an Administrator account type. Additionally, there is a checkbox under the Compatability tab (via Properties) labeled Run this program as an administrator. Do either of these options actually do anything if UAC is off?

Solution 1

Yes. When you use the slider to set UAC to "Never notify", it's not really turning UAC off - it's just turning the UAC notification level down to zero. UAC is still on and UAC events still appear in the Windows event log. If you have the slider all the way down so that you get no UAC notifications and then do a "Run this program as an administrator", UAC will still elevate the user's privileges in order to perform the action. It will just be done silently.

Solution 2

By default, UAC removes certain abilities from a administrator. These include the ability to write to restricted paths amongst other things. Run as administrator gives the process the additional security privileges needed to accomplish theses tasks.

Turning of UAC basically does the same job as running as administrator (when using an account with administrator privileges) and the reason for it being on the menu is probably the same reason as having Paste always visible but sometimes disabled - it is more trouble to remove it...

The reason for it being there in properties is so the setting gets saved - if you ever turn UAC back on, it will remember that setting.

Comments

[Admin]

"Turning of UAC basically does the same job as running as administrator" c'mon, that is totally wrong. turning off UAC does not give you admin rights on a restricted account!

[Admin]

but of course ... that's the whole idea of a restricted account, isn't it? so you can run a program as admin if necessary. however, UAC, if disabled, will not warn you about the dangers of doing so. :)

[Majid]

imho it is better to create an additional admin account and use it instead of the built-in one, if need be.

[William Hilsum]

@Molly - I have edited my answer slightly, but your understanding of UAC in your answer is wrong. (someone just posted an answer, and this question got bumped, so taking this time to correct it!)

[Admin]

@Molly - this is incorrect (and edited my answer slightly). It does not run as the administrator account. UAC by default removes certain rights from an user (such as ability to write to restricted directories). When you "run as administrator" it basically gives these rights back to an user. At no point do you actually use another account through UAC.

[surfasb]

According to Microsoft, that really turns off UAC. technet.microsoft.com/en-us/library/ee679793(v=ws.10).aspx