2

I can't elevate to administrator on my installation of Windows 10. When I try, I get the normal message:

Do you want to allow this app to make changes to your PC?

There is a "Yes" button and a "No" button, but Yes is grayed out. This happens no matter what program I try to elevate. I can't even run an elevated command prompt or get to the Control Panel because this message just blocks me.

This all started with the question of how to let Windows and it's default permissions let me install my backed-up fonts from the previous machine.

whoami /all produces:

User Name                 SID
========================= ============================================
desktop-tq1ddhd\matdoidge <redacted>


GROUP INFORMATION
-----------------

Group Name                             Type             SID          Attributes
====================================== ================ ============ ==================================================
Everyone                               Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                          Alias            S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE               Well-known group S-1-5-4      Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON                          Well-known group S-1-2-1      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users       Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization         Well-known group S-1-5-15     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Local account             Well-known group S-1-5-113    Mandatory group, Enabled by default, Enabled group
LOCAL                                  Well-known group S-1-2-0      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication       Well-known group S-1-5-64-10  Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label            S-1-16-8192


PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                          State
============================= ==================================== ========
SeShutdownPrivilege           Shut down the system                 Disabled
SeChangeNotifyPrivilege       Bypass traverse checking             Enabled
SeUndockPrivilege             Remove computer from docking station Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set       Disabled
SeTimeZonePrivilege           Change the time zone                 Disabled

There are no other admin accounts on the computer. How do I get administrative privileges back?

Ben N
  • 40,965
Gerico
  • 807
  • What is the output of whoami /all in a non-elevated command prompt? – Ben N Dec 31 '15 at 18:10
  • @BenN added the output to original post. – Gerico Dec 31 '15 at 18:14
  • 1
    According to your WhoAmI it looks like you're not using an Administrator account (not a member of BuiltIn\Administrators), that could be why. Join your user to the Administrators group and try again, and/or make a new Administrator user and try with that account. Also, you say "This all started with a question to let Windows and it's crappy permissions let me install my backed up fonts from the previous machine." What does that mean exactly? What Question? What did you do at that time to try and fix that problem? If you revert what you did then, does the UAC prompt work as expected? – Ƭᴇcʜιᴇ007 Dec 31 '15 at 18:25
  • If the built-in Administrator account is disabled and you are using a normal User that would describe this behavior. – Ramhound Dec 31 '15 at 18:43
  • @Ƭᴇcʜιᴇ007 Originally I was trying to copy over a backup of my fonts from a previous Windows install. However the permissions on my user account will not let me copy the files from the backup to the fresh install. How can I join this user to the admin account - at the moment it's not letting me doing anything. I seem to be blocked from performing most things. – Gerico Dec 31 '15 at 20:58
  • There are no other admin accounts on the computer. Which makes it no admin accounts at all, since the one you use is not an admin account. That would be pretty unusual. Maybe you should provide more context on how Windows was installed, and how it ended up without any admin accounts at all. – dxiv Jan 01 '16 at 04:04

2 Answers2

1

If you don't know the Administrator password or if it's disabled, you'll need to boot into a different OS to reset the password or otherwise get system-level access. I'm partial to using Universal USB Installer to produce a live Ubuntu disk and then using that to copy cmd.exe to sethc.exe. (Make a back-up of sethc.exe before you write over it!) When Windows comes back up to the login prompt, hit Shift five times, and you'll have a command prompt running as SYSTEM, from which you can do anything.

If you have a Windows recovery disk or the installation media, you do the same tricks without any of the Linux.

Once you get the admin command prompt, you can run net localgroup administrators /add matdoidge to make your normal account an admin. (To enable the Administrator account, do net user administrator /active:yes.)

Ben N
  • 40,965
  • The author will have to specifically enable the Administrator account if they want to use it if its disable. Simply booting into Safe Mode will not enable it. – Ramhound Dec 31 '15 at 20:14
  • @Ramhound Ah, you're right. I was thinking of audit mode. I updated my answer. – Ben N Dec 31 '15 at 20:17
  • There are also other ways to active the Administrator account. Tons of documentation on that subject if the method described in this answer is to complicated. – Ramhound Dec 31 '15 at 20:25
  • @Ramhound How might one change the status of another account without there being any admin account active on the machine? You'd have to boot a different OS. There are, of course, pre-made password reset utilities, shall I include a link to one or two? – Ben N Dec 31 '15 at 20:28
  • @BenN you mention if I have the install disk. I have a bootable USB, I assume this would work? – Gerico Dec 31 '15 at 21:04
  • @Doidgey If you have the Windows install disk, there is an option to open a command prompt. From there, you can navigate the drive and temporarily replace sethc.exe with cmd.exe. If you don't have the install disk, you can create a bootable USB drive and this will work, provided you can navigate the flavor of Linux you choose. Let me know if you need help with that. – Ben N Dec 31 '15 at 21:06
  • @BenN I'll try and do some digging based on your suggestions. Seems quite complicated and I might need some further materials to help guide me through it! – Gerico Dec 31 '15 at 21:23
  • @BenN - Here are four options. – Ramhound Dec 31 '15 at 21:24
  • @Ramhound All of those except the last (which is, effectively, what I'm suggesting) require admin powers on the live computer, which we don't have here. "You must be signed in as an administrator to be able to do the steps in this tutorial." – Ben N Dec 31 '15 at 21:25
  • @BenN - I just simply pointed out there are multiple ways to active the default Administrator account. What you are suggesting isn't "basically" what you are suggesting, your method is something else entire, still gets you the same net result though. – Ramhound Dec 31 '15 at 21:27
  • @Doidgey Here's a tutorial on doing the sethc.exe thing with a Windows disc, and here's one (note: from my own blog) on doing it with Ubuntu if you are admin on a different computer. – Ben N Dec 31 '15 at 21:28
  • @BenN it appears that your answer helped someone here. The only thing is that while you say "When Windows comes back up, hit Shift five times" but you don't explicitly mention doing this from the login prompt. – Mokubai Mar 26 '18 at 16:57
0

Thank you to @BenN for his answer pointing me in the right direct.

Please note I am not accepting Ben's Answer as I found only the last part worked - or at least was understandable for me personally, so I felt it best to post what worked for me.

I fixed the issue by booting via my USB which has the installation of Windows on. I then went to 'repair' and then 'advanced' and accessed the command console.

From here I activated the admin account by entering: 

net user administrator /active:yes

Then I rebooted and logged in via the admin account and ran another console and entered:

net localgroup administrators /add matdoidge

Then I disabled the admin account by running

net user administrator /active:no

And rebooted. Seems to have worked this time. I am not sure how I got to that point in the first instance, but very happy I can now use the machine properly again. Thank you to everyone, specially @BenN.

Gerico
  • 807