Comments on: Temporarily disable Vista UAC without reboot

By: Rohn

Rohn — Fri, 05 Jun 2009 21:00:09 +0000

Tried it, but it doesn’t work. Used tip 12 (documented in another post) to set the reg key. Shut down my session (logged off). Restarted. Confirmed that the flat is still turned on. Displayed taskmanager, found Explorer running as user. Started another explorer session using “run as administrator”. Saw the separate explorer process start as admin, then almost instantly the separate admin rights process disappeared, but the explorer window kept running. Starting app from this supposedly “elevated” explorer session did not work as expected.

Any suggestions would be appreciated.

Vista Business, 32bit, SP1, patched up to date.

By: Michael

Michael — Sat, 13 Sep 2008 16:54:59 +0000

Mark, you can enable/disable this feature via the folder option of Windows Explorer: “Launch folder Windows in a separate process.”

By: Mark Wilson

Mark Wilson — Wed, 10 Sep 2008 22:32:12 +0000

I (stupidly) ran the reg key in comment 10 without checking to see what the original value was… what do I need to do to return my system to the original state please? Is it safe to delete this value?

By: Michael

Michael — Sat, 03 May 2008 15:43:44 +0000

Leonardo,nice idea, but the problem is that you can’t run explorer.exe with runas under Vista. I suppose, there is a registry setting for this, too.

Marty, thanks a lot for the hint. For the copy-and-pasters: The command works without the quotation marks:

reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v SeparateProcess /t REG_DWORD /d 1 /f

Then you run start C:\Windows\explorer.exe without taskkill. Windows Explorer will pop-up then. If you want to switch back to the shell with standard rights, you just have to close this Windows Explorer window.

As to the su command. I think one can compare runas to sudo, but not to su. I compared this tip with su because it is very similar from the user’s point of view. After you launched explorer.exe this way, you get a new Windows shell (not just a command prompt) with no restrictions. I know of no other solution that is able to do this. Do you?

By: Leonardo

Leonardo — Sat, 03 May 2008 14:13:35 +0000

@Marty – Where’s the fun in using 3rd party apps when I can screw around for hours, find a partial solution and then abandon the whole project as if I was just killing time?

You are correct in the implication that this is not the medium for such screwing around, though.

By: ITsVISTA Web Links: May 2nd | ITsVISTA

ITsVISTA Web Links: May 2nd | ITsVISTA — Sat, 03 May 2008 09:13:30 +0000

[...] 4sysops – Temporarily disable Vista UAC without reboot A creative way to get around Vista?s UAC temporarily without having to reboot. Elevate Explorer! [...]

By: Marty

Marty — Sat, 03 May 2008 03:50:26 +0000

You should do a small amount of research before posting hacks like this. You don’t need to crash the desktop shell, just tell explorer to create a separate process when new instances are launched:

reg.exe add “HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced” /v SeparateProcess /t REG_DWORD /d 1 /f

If that value is set, anytime an elevated administrator session launches explorer.exe, it will create a new process without UAC enabled.

And how do this tip even compare to su on Linux? Does su replace your desktop shell when you run it? Two different tasks going on here. And if you want su on Windows, Micrsoft has made several versions that are free, or there’s the built-in runas.exe (but it won’t allow you to pipe in a password from stdin) or there’s many 3rd party tools like PsExec.exe or su alternatives, etc. etc.

For best security, your normal day-to-day user account should not be a member of the local Administrators group, even if you have UAC enabled. You should logon interactively with a standard user account, and then open your favorite command ptompt with a different ser account, one that is a member of the local Administrators group.

There is lots of good info already been written on this topic, for example:
http://blogs.msdn.com/aaron_margosis/

By: Leonardo

Leonardo — Fri, 02 May 2008 21:19:50 +0000

Michael: I meant, using Runas to start up the User-Mode Shell…
Killing the elevated explorer.exe is no problem…
Thing is, starting explorer as in the example below yields some mutated partial UAC and the classic “Where’s my systray crap?”:
(Usage, run once for elevate, run again for failure)
=========================
@echo off
if exist “%temp%\exbat.tmp” goto undo
Taskkill /F /IM explorer.exe
start C:\Windows\explorer.exe
echo 1 > “%temp%\exbat.tmp”
goto end
:undo
del “%temp%\exbat.tmp”
Taskkill /F /IM explorer.exe
runas /trustlevel:0×20000 C:\Windows\explorer.exe
:end
=======================
My ADD and the voices in my head have notified of my loss of interest (been a couple hours, messing with services & registry keys)… I’m secpoling things back to normal .

By: ITsVISTA Web Link: 4sysops - Temporarily disable Vista UAC without reboot | ITsVISTA

Fri, 02 May 2008 18:54:51 +0000

[...] A creative way to get around Vista’s UAC temporarily without having to reboot. Elevate Explorer! See the original post at: 4sysops – Temporarily disable Vista UAC without reboot [...]

By: Michael

Michael — Fri, 02 May 2008 18:51:39 +0000

Lukas, Slam, this was also my first idea, but it didn’t work. I must admit I don’t know why.

Leonardo, I think Runas won’t help here because one has to get rid of the elevated explorer.exe.

By: Leonardo

Leonardo — Fri, 02 May 2008 01:04:56 +0000

Perhaps make use of Runas?
I’ve UAC partially disabled, so I’m not annoyed by prompts yet still run IE in protected mode (that’s all I really care about)

By: SLam

SLam — Thu, 01 May 2008 22:55:24 +0000

That should also work.

By: Lukas Beeler

Lukas Beeler — Thu, 01 May 2008 21:19:37 +0000

I didn’t try it, but wouldn’t killing explorer.exe again and relaunching it from the task manager work?