.

Least privilege & Windows Explorer

[Edit: clarified the wording in the paragraph starting with “Otherwise...“]

As I mentioned the other day, I've started running day-to-day as non-Admin. I used links in Andrew Duthie's blog to grab a couple of command scripts and a cool DLL that displays the context in which you're running (Administrator, Power User, User, etc.) in the Windows Explorer and Internet Explorer toolbars.

I had a problem, though, when I launched Windows Explorer from the Administrator command line. It wouldn't run with Administrator privileges. It would run as a normal User. Internet Explorer didn't have this problem.

Last night I ran into Andrew Duthie who gave me the following tip...

Before you launch Windows Explorer from the command prompt you need to make sure you've checked the checkbox in Windows Explorer, Tools | Folder Options | View | Advanced settings | Launch folder windows in separate process. (That's where it's located in Windows XP, anyway.)

Otherwise when you launch Windows Explorer it will run in the same context as the userID in which you logged into Windows - the one with least privilege. By checking the checkbox, when you launch Windows Explorer from the administrator command window a command window that's running as Administrator, it will run in the Administrator security context.