Windows 7 / Getting Started

---

Opening a Command Prompt Window with Administrator Privileges

It's best to do your day-to-day work with a user account that doesn't have full Administrator privileges; this way, a runaway or malicious program can't get at Windows itself. It can be a pain, though, to have to use Switch Users every time you need to perform some management task. On Windows 7 and Vista, User Account Control (UAC) makes this somewhat easier, but in the Command Prompt world, things work a little differently.

On Windows 7 and Vista, command-line programs can't pop up a UAC dialog box. There is no command-line tool that can elevate a program you run from a command line-at least none that is provided with Windows. (More on this shortly.) So, to perform administrative functions with command-line programs, the Command Prompt window from which you run them must itself already be running with elevated privileges.

There are several ways to open an "elevated" Command Prompt window on Windows 7 and Vista:

• On Windows 7, pin the Command Prompt to the taskbar. Right-click its icon, right-click Command Prompt, and select Run As Administrator.
• On Windows Vista, create a shortcut to the Command Prompt in the Quick Launch bar. Right-click it and select Run As Administrator.
• Click Start, All Programs, Accessories. Right-click Command Prompt and select Run As Administrator.
• Create a desktop shortcut to cmd.exe. Right-click it and select Run As Administrator.
• Click Start and type cmd in the Search window.Then, right-click the cmd.exe result and select Run As Administrator.
• For most of the methods listed here, instead of right-clicking the icon or search result and selecting Run Aas Administrator, you can just hold down Ctrl+Shift and click the item.

Alternatively, you can create a desktop shortcut to cmd.exe (or a batch file, or script, and so on) and set its properties so that it always runs elevated. Just right-click the icon, select Properties, click Advanced, and check Run As Administrator. If you do this, that you rename the icon so its name indicates that it's a privileged version. For example, I named the icon Elevated Command Prompt.

When you start a Command Prompt any of these ways, you get a UAC prompt; the title of the Command Prompt window always starts with Administrator: to remind you that any program run from this window has full administrator privileges. (The word Administrator appears no matter what account name you're using, and it appears even if UAC is turned off.)

Note There is no standard tool that lets you run a program with elevated permissions from a standard Command Prompt window or batch file. There are, however, a few third-party tools. You might consider installing one of the following:

• From technet.microsoft.com, search for Script Elevation PowerToys for Windows Vista.
• Do a Google search for the following four words: john robbins elevate wintellect. The result you want is the one at www.wintellect.com.
• Try surun from www.sourceforge.net/projects/surun/.

On Windows XP, there is no UAC.You can still do most of your day-to-day work from a "Limited" or "Power User" account, and when you need to run a privileged command, you can quickly open a Command Prompt window that has Administrator privileges by typing

runas /user:Administrator cmd

on the command line or in the Start menu's Run dialog box. (If you're a Unix user, you can view this as the equivalent of the su command. I put this command into a batch file named su.bat on all my computers.) You can, of course, substitute any Computer Administrator account name.

The new window runs under the Administrator's logon name, and any programs you run from this command prompt also has administrator privileges. From it, you can, for example, type

start compmgmt.msc

to open the Computer Management window. However, you can't open an "Administrator" version of Windows Explorer or other windows that are based on Explorer, such as Network Connections, unless you first-just once-log on as Administrator. Open Explorer; click Tools, Folder Options,View; and check Launch Folder Windows in a Separate Process.