padlocks instead of arrows on shortcuts? And how to stop specific UAC popups?

This is probably a newbie question, but:

Some of the shortcut icons on my desktop have the usual arrows, but some
have a yellow or gold padlock where I'd expect the arrow to be. What
gives? Is it something to do with whether I ran the installer as
administrator?

And some of my app.s (including a couple I have set to run at startup,
including Everything) always pop up the "do you want to allow" window.
There must presumably be a way to turn those off for specific prog.s
(without turning them off altogether, which I don't want to do).
--
J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

Does my Bradshaw look big in this?

J. P. Gilliver (John) wrote:

This is probably a newbie question, but:

Some of the shortcut icons on my desktop have the usual arrows, but
some have a yellow or gold padlock where I'd expect the arrow to be.
What gives? Is it something to do with whether I ran the installer as
administrator?

And some of my app.s (including a couple I have set to run at
startup, including Everything) always pop up the "do you want to
allow" window. There must presumably be a way to turn those off for
specific prog.s (without turning them off altogether, which I don't
want to do).

This page explains why and how to remove.

https://www.sevenforums.com/tutorial...es-folders-rem
ove-windows-7-a.html

JT

--

In message , JT
writes:
J. P. Gilliver (John) wrote:

This is probably a newbie question, but:

Some of the shortcut icons on my desktop have the usual arrows, but
some have a yellow or gold padlock where I'd expect the arrow to be.
What gives? Is it something to do with whether I ran the installer as
administrator?

And some of my app.s (including a couple I have set to run at
startup, including Everything) always pop up the "do you want to
allow" window. There must presumably be a way to turn those off for
specific prog.s (without turning them off altogether, which I don't
want to do).

This page explains why and how to remove.

https://www.sevenforums.com/tutorial...es-folders-rem
ove-windows-7-a.html

JT

Thanks. That page is a bit over my head - and says how to remove them,
and that they denote private files in a public folder (is my desktop
public then?), but not (as far as I could see) whether they're likely to
be any problem. (OK, that's not what I asked the first time.)
--
J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

offensive speech is something to be protected, not celebrated.
- "yoni", 2015-8-5

On Tue, 6 Feb 2018 14:14:34 +0000, J. P. Gilliver (John) wrote:
This is probably a newbie question, but:

Some of the shortcut icons on my desktop have the usual arrows, but some
have a yellow or gold padlock where I'd expect the arrow to be. What
gives? Is it something to do with whether I ran the installer as
administrator?

The yellow padlock indicator means that the security attributes for the
file/folder are specially configured so that it would require Administrator
priviledges in order to access them. Those folders/files are usually set up
by software installers which require Administrator rights in order to
install the software.

For shortcut files (i.e. *.lnk files), the blue-yellow shield indicator in
their icon means that the shortcut is pointing to an application whose
embedded manifest (within the EXE file) states that it require Administrator
rights in order to run it. This indicator doesn't apply to shortcuts which
point to a folder.

And some of my app.s (including a couple I have set to run at startup,
including Everything) always pop up the "do you want to allow" window.

That's because those applications have embedded manifest states that they
require Administrator rights. It can also be that the shortcut's "Run as
administrator" setting is enabled, whether the applications require
Administrator rights or not.

There must presumably be a way to turn those off for specific prog.s
(without turning them off altogether, which I don't want to do).

For specific application, you can turn the UAC prompt off by manually
editing the EXE file using a resource editor. But as a result, the
application may not be able to do its job completely because it was not run
using enough security priviledges. Moreover, if the EXE file is digitally
signed, editing it will break the digital signature, and that may trigger an
alert by the OS or third party security tools due to file tampering. In this
case, the digital signature should be removed also.

For specific folder, you can turn the UAC prompt off by changing the
security attributes of the folder in order to allow your account to access
it without Administrator rights. Keep in mind that any application which was
run using your account will be access that folder without Administrator
rights. Other users in your system may or may not be able to access it,
depending on which account(s)/group(s) are allowed to access - as specified
in the folder's security attributes.

Both of the above simply turns off the UAC prompt for an application or
folder, it won't give you Administrator rights.

In message , JJ
writes:
On Tue, 6 Feb 2018 14:14:34 +0000, J. P. Gilliver (John) wrote:
[]
And some of my app.s (including a couple I have set to run at startup,
including Everything) always pop up the "do you want to allow" window.

That's because those applications have embedded manifest states that they
require Administrator rights. It can also be that the shortcut's "Run as
administrator" setting is enabled, whether the applications require
Administrator rights or not.

There must presumably be a way to turn those off for specific prog.s
(without turning them off altogether, which I don't want to do).

For specific application, you can turn the UAC prompt off by manually
editing the EXE file using a resource editor. But as a result, the
application may not be able to do its job completely because it was not run
using enough security priviledges. Moreover, if the EXE file is digitally
signed, editing it will break the digital signature, and that may trigger an
alert by the OS or third party security tools due to file tampering. In this
case, the digital signature should be removed also.

That sounds complicated. For example, I get the UAC prompt whenever I
run "Everything" (the filename searcher) (including when it runs as part
of startup). Surely, there must be some way of turning it off just for
that without having to hack the .exe? (Maybe something to do with how I
install it?)
[]
Both of the above simply turns off the UAC prompt for an application or
folder, it won't give you Administrator rights.

I don't know if Everything _does_ need Ad. rights (can't think why it
should), but I think that's separate from whether the UAC prompt pops
up, am I right?

Needless to say, I am the only user here.
--
J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

Does God believe in people?

J. P. Gilliver (John) wrote:
In message , JJ
writes:
On Tue, 6 Feb 2018 14:14:34 +0000, J. P. Gilliver (John) wrote:
[]
And some of my app.s (including a couple I have set to run at startup,
including Everything) always pop up the "do you want to allow" window.

That's because those applications have embedded manifest states that they
require Administrator rights. It can also be that the shortcut's "Run as
administrator" setting is enabled, whether the applications require
Administrator rights or not.

There must presumably be a way to turn those off for specific prog.s
(without turning them off altogether, which I don't want to do).

For specific application, you can turn the UAC prompt off by manually
editing the EXE file using a resource editor. But as a result, the
application may not be able to do its job completely because it was
not run
using enough security priviledges. Moreover, if the EXE file is digitally
signed, editing it will break the digital signature, and that may
trigger an
alert by the OS or third party security tools due to file tampering.
In this
case, the digital signature should be removed also.

That sounds complicated. For example, I get the UAC prompt whenever I
run "Everything" (the filename searcher) (including when it runs as part
of startup). Surely, there must be some way of turning it off just for
that without having to hack the .exe? (Maybe something to do with how I
install it?)
[]
Both of the above simply turns off the UAC prompt for an application or
folder, it won't give you Administrator rights.

I don't know if Everything _does_ need Ad. rights (can't think why it
should), but I think that's separate from whether the UAC prompt pops
up, am I right?

Needless to say, I am the only user here.

Originally, Everything.exe needed admin in order to read the $MFT
directly. That's what made the filename-fetching part of the
program so fast. Reading the $MFT only takes two seconds.

However, the inclusion of filesize and datestamps in later
versions, requires traversal of the file system. More "permissioning"
is needed to gather information at that level, plus the seek time to
go all over the damn disk.

I don't think you can read the $MFT with just a regular account.
And even if Everything.exe dropped back to just providing filename
searches with no other attributes on the screen, it still needs
to read the $MFT metadata file. While you can hook into the USN
Journal to find out about "new" files, that's not enough to find
out about all of the files and folders.

The key accounts are Administrator, SYSTEM, and you.

While TrustedInstaller is used for Program Files and WinSXS,
its neighborhood isn't one you'll be wandering around in
all that often, and SYSTEM is likely to own everything
that TrustedInstaller does anyway.

Some things are easier to do, if you impersonate the
SYSTEM account. One way to get there, is to be set up
in the Task Scheduler and launched at a particular hour
of the day, or in response to a particular event
("oh, we've just booted").

Another way, as Administrator, is to do something like

psexec -msi cmd.exe

It depends on what barriers have been set up, as to how
hard it is to read something. Permission capabilities
include "Allow" and "Deny", with "Allow" being best
practice. (I.e. Allow enabled, or allow disabled.)
"Deny" isn't considered a best practice because
of the difficulty it causes for legit work. Permissions
can also be inherited from objects above you, and the
file system does seem to do a good deal of that.
Inheritance is one thing I haven't figured out how
to deal with properly. I look at each level, and still
cannot set the levers correctly to remove it.

For example, there are items in the system that NO application
can read. I've tried. NFI can't read them. Everything.exe can't
touch them. But I was able to get there in Linux (which
ignores permissions as they're not implemented). So if
you think "I'm seeing everything here", probably not,
and you're four items short of a full load (if done
from Windows). And trust me, things that are Access Denied,
they're that way for a reason. The one little "accident"
I had, I was unable to reproduce the meltdown a second
time, but I'm still a wee bit nervous of touching
the insides of System Volume Information. Not too nervous
about WinXP, more nervous about later OSes and what they do
there (as VSS includes a persistent capability and a shadow
could be "live" when you access it from Linux). WinXP doesn't
have persistence across reboots on VSS, or it's not supposed to,
making me less nervous.

I've not spent time, trying to break all the OSes, and
getting a failure to reproduce a meltdown of Win7, that was
irritating. I want things to break in a reproducible way,
so I can draw conclusions about them.

Paul

In message , Paul
writes:
J. P. Gilliver (John) wrote:
[]
There must presumably be a way to turn those off for specific prog.s
(without turning them off altogether, which I don't want to do).

For specific application, you can turn the UAC prompt off by manually
editing the EXE file using a resource editor. But as a result, the
[]
That sounds complicated. For example, I get the UAC prompt whenever
[]
I don't know if Everything _does_ need Ad. rights (can't think why it
should), but I think that's separate from whether the UAC prompt pops
up, am I right?
Needless to say, I am the only user here.

Originally, Everything.exe needed admin in order to read the $MFT
directly. That's what made the filename-fetching part of the
program so fast. Reading the $MFT only takes two seconds.

However, the inclusion of filesize and datestamps in later
[Long and I'm sure informative post snipped (you're like me, you like to
give full background).]

All I want is to know if it's possible to stop the UAC popup when I
start "Everything" (and the odd other prog.), since I always click "yes"
anyway for that prog. (and some others) - hopefully without hacking the
..exe or similarly complex procedures. (Without turning off UAC popups
altogether.)
--
J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

W-E-H-T-H-U-R: This is the worst spell of weather in months!

J. P. Gilliver (John) wrote:
In message , Paul
writes:
J. P. Gilliver (John) wrote:
[]
There must presumably be a way to turn those off for specific prog.s
(without turning them off altogether, which I don't want to do).

For specific application, you can turn the UAC prompt off by manually
editing the EXE file using a resource editor. But as a result, the
[]
That sounds complicated. For example, I get the UAC prompt whenever
[]
I don't know if Everything _does_ need Ad. rights (can't think why it
should), but I think that's separate from whether the UAC prompt pops
up, am I right?
Needless to say, I am the only user here.

Originally, Everything.exe needed admin in order to read the $MFT
directly. That's what made the filename-fetching part of the
program so fast. Reading the $MFT only takes two seconds.

However, the inclusion of filesize and datestamps in later
[Long and I'm sure informative post snipped (you're like me, you like to
give full background).]

All I want is to know if it's possible to stop the UAC popup when I
start "Everything" (and the odd other prog.), since I always click "yes"
anyway for that prog. (and some others) - hopefully without hacking the
.exe or similarly complex procedures. (Without turning off UAC popups
altogether.)

They suggest a psexec attack here. This assumes you
belong to the Admin Group and would normally have the required
privileges to do it anyway.

https://serverfault.com/questions/50...rights-windows

psexec.exe -h yourprogram.exe

From the help:

-h If the target system is Vista or higher, has the process
run with the account's elevated token, if available.

Psexec and Psexec64 are in PSTools on Sysinternals.ocm .

Paul

In message , Paul
writes:
J. P. Gilliver (John) wrote:
[]
All I want is to know if it's possible to stop the UAC popup when I
start "Everything" (and the odd other prog.), since I always click
"yes" anyway for that prog. (and some others) - hopefully without
hacking the .exe or similarly complex procedures. (Without turning
off UAC popups altogether.)

They suggest a psexec attack here. This assumes you
belong to the Admin Group and would normally have the required
privileges to do it anyway.

https://serverfault.com/questions/50...with-pre-allow
ed-admin-rights-windows

psexec.exe -h yourprogram.exe

From the help:

-h If the target system is Vista or higher, has the process
run with the account's elevated token, if available.

Psexec and Psexec64 are in PSTools on Sysinternals.ocm .

Paul

Really, there's no way to fix it other than command-line messing with
something I have to download? (Though I do respect Sysinternals.)

Is there something I can do involving removing and then reinstalling
"Everything" (say), perhaps selecting different options, and/or running
the installer as admin., or similar?

I find it difficult to believe that everybody who uses "Everything" on 7
accepts a UAC prompt every time they use it, or does magic spells to
avoid having to.
--
J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

Our thorny national debate about Brexit could turn out to be irrelevant.
Sooner or later the EU as we know it may no longer be there for us to leave.
- Katya Adler, BBC Europe editor (RT, 2017/2/4-10)

On Wed, 7 Feb 2018 22:50:16 +0000, "J. P. Gilliver (John)"
wrote:

Really, there's no way to fix it other than command-line messing with
something I have to download? (Though I do respect Sysinternals.)

I could have sworn that your request used to be fairly common when UAC
first hit the scene. IIRC, there was an easy solution available, as
well. One of the first things I do on any of my PCs is disable UAC, so I
never paid attention to the details, but it seems like it had something
to do with starting Everything as a Logon task in Task Scheduler, where
you could run it with better credentials. Ring any bells, or am I
thinking of something else entirely?

Is there something I can do involving removing and then reinstalling
"Everything" (say), perhaps selecting different options, and/or running
the installer as admin., or similar?

I don't think that was it.

I find it difficult to believe that everybody who uses "Everything" on 7
accepts a UAC prompt every time they use it, or does magic spells to
avoid having to.

I personally don't know anyone in real life who leaves UAC enabled.

--

Char Jackson

On 06 Feb 2018, "J. P. Gilliver (John)" wrote
in alt.windows7.general:

And some of my app.s (including a couple I have set to run at
startup, including Everything) always pop up the "do you want to
allow" window. There must presumably be a way to turn those off
for specific prog.s (without turning them off altogether, which I
don't want to do).

In the case of Everything, choose to install it as a service when you
first install it. You won't get a UAC prompt.

There's a workaround for other programs that involves setting them up
in Task Scheduler. I don't remember the details, but it should be
Googleable.

J. P. Gilliver (John) wrote:
In message , Paul
writes:
J. P. Gilliver (John) wrote:
[]
All I want is to know if it's possible to stop the UAC popup when I
start "Everything" (and the odd other prog.), since I always click
"yes" anyway for that prog. (and some others) - hopefully without
hacking the .exe or similarly complex procedures. (Without turning
off UAC popups altogether.)

They suggest a psexec attack here. This assumes you
belong to the Admin Group and would normally have the required
privileges to do it anyway.

https://serverfault.com/questions/50...with-pre-allow
ed-admin-rights-windows

psexec.exe -h yourprogram.exe

From the help:

-h If the target system is Vista or higher, has the process
run with the account's elevated token, if available.

Psexec and Psexec64 are in PSTools on Sysinternals.ocm .

Paul

Really, there's no way to fix it other than command-line messing with
something I have to download? (Though I do respect Sysinternals.)

Is there something I can do involving removing and then reinstalling
"Everything" (say), perhaps selecting different options, and/or running
the installer as admin., or similar?

I find it difficult to believe that everybody who uses "Everything" on 7
accepts a UAC prompt every time they use it, or does magic spells to
avoid having to.

Can't you make a shortcut icon with those details
stuffed into it ?

Paul

On Wed, 7 Feb 2018 22:50:16 +0000, "J. P. Gilliver (John)"
wrote:

In message , Paul
writes:
J. P. Gilliver (John) wrote:
[]


Is there something I can do involving removing and then reinstalling
"Everything" (say), perhaps selecting different options, and/or running
the installer as admin., or similar?

You are almost there and (courtesy of Nil a couple of rungs up the
ladder) about all you have to do is UNINSTALL "Everything" and on the
reinstall, you need to select "Install Everything Service".

You will find this option in the Everything Setup panel under the
heading Select Install Options.

Good luck,

On Wed, 7 Feb 2018 22:50:16 +0000, J. P. Gilliver (John) wrote:
Really, there's no way to fix it other than command-line messing with
something I have to download? (Though I do respect Sysinternals.)

Is there something I can do involving removing and then reinstalling
"Everything" (say), perhaps selecting different options, and/or running
the installer as admin., or similar?

I find it difficult to believe that everybody who uses "Everything" on 7
accepts a UAC prompt every time they use it, or does magic spells to
avoid having to.

Group Policy has a setting which auto-elevate applications that require
Administrator rights (i.e. those with Administrator rights requirement
within their EXE file), but this setting applies globally, not per
application.

In message , Monty
writes:
On Wed, 7 Feb 2018 22:50:16 +0000, "J. P. Gilliver (John)"
wrote:

In message , Paul
writes:
J. P. Gilliver (John) wrote:
[]


Is there something I can do involving removing and then reinstalling
"Everything" (say), perhaps selecting different options, and/or running
the installer as admin., or similar?

You are almost there and (courtesy of Nil a couple of rungs up the
ladder) about all you have to do is UNINSTALL "Everything" and on the
reinstall, you need to select "Install Everything Service".

You will find this option in the Everything Setup panel under the
heading Select Install Options.
[]
Thanks Monty and Nil for this tip.

I uninstalled Everything. To make sure, I used Revo.
Then I ran the installer, selecting "run as administrator" to be sure,
and looked out for this "service" thing, and selected it.

Unfortunately, I still get the UAC prompt when I start Everything,
whether I start it from the tray icon or the context menu.

A webpage on the site told me "This setting can be changed in the
Everything options at anytime." So I checked, and indeed, under Tools |
Options | General, there's a box "Everything Service", that is ticked.
(I tried unticking and reticking it - no change.) (This comment implies
I didn't need to do the uninstall/reinstall, but I did anyway.)

FWIW, I'm using Everything "Version 1.4.1.877 (x86)".
--
J. P. Gilliver