“以管理员身份运行"究竟能做什么? [英] What precisely does 'Run as administrator' do?

问题描述

在Windows 7上，我有一个命令行程序，该命令由于文件写入权限错误而失败，并弹出烦人的 UAC 对话框就会出现.

On Windows 7, I have a command-line program that fails due to file write permission errors, and popping up annoying UAC dialogs every time I run command-line programs that are from an 'unknown publisher'.

但是，如果我通过右键单击并选择以管理员身份运行"来启动控制台，则即使UAC对话框仍然存在，安装也可以正常进行.

However, if I start my console by right clicking and choosing 'run as administrator', then the install works fine, even if the UAC dialogs are still present.

我的用户已经是管理员"组的成员，那么以管理员身份运行"究竟能使我的安装工作做什么?

My user is already a member of the 'administrators' group, so what precisely does 'run as administrator' do that makes my install work?

我的具体问题恰恰是:以管理员身份运行"是做什么的?到目前为止，没有一个答案可以解决这个问题. (例如，它是否以管理员"用户身份运行新进程?还是以当前用户身份运行该进程，但是具有提升的特权?如果是，则具有哪些特权?这与我从我的特权中获得的特权有何不同?用户在管理员"组中?

My specific question is precisely: What does 'run as administrator' do? Neither of the answers thus far address this. (for example, does it run the new process as the 'Administrator' user? Or does it run the process as the current user, but with elevated privileges? If so, what privileges? How does that differ from the privileges I get from my user being in the 'Administrators' group?

(具体来说，我使用的是 SourceForge 中的控制台"，而不是常规CMD窗口，但我认为这并不重要，这是在通过python.org在新安装的Python3 MSI上运行"python Distribution_setup.py"来安装Python"distribute"软件包时的全部操作.它是64位上的32位Python位Windows.请参见 在Windows 7上安装Python并分发会给出写入失败...权限被拒绝" )

(Specifically, I'm using the 'Console' from SourceForge, not a regular CMD window, but I don't think that's important. This is all while installing the Python 'distribute' package by running 'python distribute_setup.py' on a newly installed Python3 MSI from python.org. It's a 32-bit Python on 64-bit Windows. See Installing Python and distribute on Windows 7 gives "Writing failed ... permission denied")

推荐答案

在Windows上登录时，会创建一个访问令牌.这可以识别您，您所属的组以及您的特权.并且请注意，用户是否是管理员取决于用户是否是Administrators组的成员.

When you log on Windows creates an access token. This identifies you, the groups you are a member of and your privileges. And note that whether a user is an administrator or not is determined by whether the user is a member of the Administrators group.

没有UAC，当您运行程序时，它将获得访问令牌的副本，并控制程序可以访问的内容.

Without UAC, when you run a program it gets a copy of the access token, and this controls what the program can access.

使用UAC，当您运行程序时，它将获得受限的访问令牌.这是原始访问令牌，其中管理员"已从组列表中删除(以及其他一些更改).即使您的用户是Administrators组的成员，该程序也不能使用Administrator特权.

With UAC, when you run a program it gets a restricted access token. This is the original access token with "Administrators" removed from the list of groups (and some other changes). Even though your user is a member of the Administrators group, the program can't use Administrator privileges.

当您选择以管理员身份运行"并且您的用户是管理员时，将使用原始的非限制访问令牌启动程序.如果您的用户不是管理员，则系统会提示您输入管理员帐户，程序将在该帐户下运行.

When you select "Run as Administrator" and your user is an administrator the program is launched with the original unrestricted access token. If your user is not an administrator you are prompted for an administrator account, and the program is run under that account.

这篇关于“以管理员身份运行"究竟能做什么?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！