using "runas" with "Administrator" account versus other admin accounts

Question

On my computer, I have two admin accounts. The default admin account named "Administrator", and a new admin account named "testadmin."

If I run the following commands:

runas /user:testadmin cmd.exe
runas /user:Administrator cmd.exe

The first one opens up a new cmd.exe as "testadmin", but it's not truly running in Administrator mode, i.e. I get "Access denied" if I try to write to C:\Windows.

The second window opens up a new cmd.exe as "Administrator", but it's running in true Administrator mode. I can successfully write to any folder on my computer.

The name of the first window is "cmd.exe (running as [ComputerName]\testadmin)"

The name of the second window is "Administrator: cmd.exe (running as [ComputerName]\Administrator)"

If both accounts have admin privileges, why is there a difference in behavior here? I hate that I can't open a window from the command line as testadmin in true Administrator mode... it's really annoying.

Solution

I am assuming you are referring to a Windows 7 OS or similar. The reason you are seeing the difference between the two user accounts is because a while back when vista came out Microsoft changed their permission policies a little. Unlike in XP when you created an Admin account it had all the rights the usual Administrator account would posses. Now in Vista and Windows 7 you are a pseudo admin unless you are logged in as the actual Administrator. In most cases you can run the command prompt by right clicking the cmd.exe program and choosing to run as Administrator to get the results you want, however there are times you will need to log in to the actual Administrator account to perform your tasks. The main reason this was done was to prevent viruses from doing their nasty work and a machine.

I have seen certain software's require an install or uninstall directly from the "Administrator" account and no other, otherwise they would not work. I hope this sheds a little light on the situation.

Cheers

Comments

[Mark Allen]

At the risk of drawing the ire of geo and certain other people, the problem isn't whether or not the accounts are administrators, it's whether or not the thing they're running is elevated or not. The account named "Administrator" automatically elevates. Accounts that are local admins but not named Administrator do not automatically elevate. Does luaexec.exe exist in your path? If so, try runas /user:testadmin luaexec.exe -w -f cmd.exe /k That should cause a UAC prompt and if you click Yes or OK or whatever, it'll run properly.

[Phillip R.]

You might be able to use the /trustlevel switch. I have not used this personally but it might help in elevating.

[JoeCool]

The reason this issue is important is because I want to run programs elevated from a batch file while logged into an admin account other than "Administrator." And it seems obvious to me that that should be easy to do, considering that my testadmin account is indeed an admin account.

[Mark Allen]

You could also try psexec from sysinternals, instead of runas. technet.microsoft.com/en-us/sysinternals/bb897553.aspx - it can elevate and everything.