Solved

Running Control Panel as admin in Windows 7

Posted on 2011-09-08
16
5,486 Views
Last Modified: 2012-05-12
I have applied a User GPO to disable the Programs and Features in Windows 7.  I am trying to give our Help Desk the ability to then do a runas to open up Control Panel to uninstall programs.  

I have tried several things found here and other sites, but it still tells me that the "Systems Administrator has disabled this...".  Here is an example of what I am running.

runas /u:domain\adminaccount cmd.exe
runas /u:domain\adminaccount "control appwiz.cpl"
runas /u:domain\adminaccount "explorer.exe /seperate"

They all prompt me for the password, and all open up the tool.  However, it still gives me the disabled message.

When I log on as the admin account I have full access to the Programs and Features.

Any ideas?

Thanks in advance!
0
Comment
Question by:BassBerry
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 8
  • 3
  • 3
  • +1
16 Comments
 
LVL 28

Assisted Solution

by:Run5k
Run5k earned 150 total points
ID: 36503961
One potential option would be to configure Local Group Policies so that they only apply to specific users or groups, such as non-administrators:

Local Group Policies - Apply to All Users Except Administrators

Step-by-Step Guide to Managing Multiple Local Group Policy Objects

Explore the benefits of the Multiple Local Group Policy feature in Windows 7
0
 

Author Comment

by:BassBerry
ID: 36504062
I applied the group policy to only one user, logged on as that user, but still cannot load Programs and Features using a runas with an admin account.

Thanks for the suggestion though.
0
 
LVL 28

Expert Comment

by:Run5k
ID: 36504189
My apologies, since I probably didn't communicate that effectively.  What I was actually suggesting is that you utilize the Multiple Group Policies method to apply the Group Policy that hides Programs and Features specifically to the non-administrators group.  In that manner, your help desk staff (who are administrators) would still have access to Programs and Features by default.
0
Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.

 
LVL 66

Accepted Solution

by:
johnb6767 earned 350 total points
ID: 36504228
What about doing a "Run as a different user" via the Rt Click on C:\Windows\System32\cmd.exe, and THEN executing "control appwiz.cpl"?

Should work fine.....
0
 

Author Comment

by:BassBerry
ID: 36504383
Yes, I modified those links to apply to our Domain Group Policy environment, however, doing a runas as an admin account still does not give us the ability to see Programs.  It was always working correctly for our admin accounts when they log on.  Just not runas.  

Runas an admin account ALWAYS worked in XP...I'm not sure I understand the reasoning for Microsoft changing the way this works.
0
 

Author Comment

by:BassBerry
ID: 36504456
Good idea John - but I get the same message "system administrator has disabled Programs and Features".  I'm wondering if there is a different GPO setting that I could use.

Here is the current GPO:

User Configuration
Administrative Templates
Control Panel/Programs
Hide "Get Programs" page Enabled  
Hide "Programs and Features" page Enabled  
Hide "Windows Features" Enabled  
Hide "Windows Marketplace" Enabled
0
 
LVL 28

Expert Comment

by:Run5k
ID: 36504776
That's a shame... I thought that John's suggestion would do the trick.

If you don't mind me asking, is it really even necessary to hide/disable the Programs and Features interface in that manner?  If you leave it visible, your non-administrators still won't have the privileges to accidentally remove an application.  At the same time, while a standard user is logged in your Help Desk staff could open the Programs and Features interface, click on the Uninstall button and they will then be queried for their admin credentials, allowing them to successfully remove an application.
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 36505129
Yea, me too...   :-(

Just to clarify.... You are using "Run As Administrator", or SHIFT+RT CLICK (if needed to have the option visible)>"Run as different user"?
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 36505143
Actually, lets verify....

in the CMD windows you open using the method above, type 'set u' Is the "USERNAME" value the one you used the alternate credentials for?
0
 

Author Comment

by:BassBerry
ID: 36505156
For the cmd.exe I am selecting Run as a Different User.  But I also still do not have access by doing Run as Administrator (as expected).

Sadly the users need to be Power Users for certain other applications in our environment.  
0
 

Author Comment

by:BassBerry
ID: 36505409
John - yes, by using set u it does confirm that it is using my administrator account credentials.

Thanks!
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 36903611
I've requested that this question be deleted for the following reason:

This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0
 

Assisted Solution

by:BassBerry
BassBerry earned 0 total points
ID: 36903589
I created a Microsoft ticket for this and got an explaination.  To summarize, this is intended in Windows 7 as many applications in the Control Panel are tied to the logon account and cannot be opened as a different user.

A workaround they provided is to open up Internet Explorer with a runas and then open Control Panel from there.

Thanks everyone for your help.
0
 

Author Comment

by:BassBerry
ID: 36903612
I would like to award point and post this to the knowledge base as I have finally got a response from Microsoft.
0
 

Author Closing Comment

by:BassBerry
ID: 36935174
I found the answer by contacting Microsoft.
0

Featured Post

[Webinar] How Hackers Steal Your Credentials

Do You Know How Hackers Steal Your Credentials? Join us and Skyport Systems to learn how hackers steal your credentials and why Active Directory must be secure to stop them. Thursday, July 13, 2017 10:00 A.M. PDT

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
Assume you have an outside contractor who comes in seasonally or once a week to do some work in your office, but you only want to give him access to the programs and files he needs and keep all other documents and programs private. Can you do this o…
This Micro Tutorial will teach you how to change your appearance and customize your Windows 7 interface to your unique preference. This will be demonstrated using Windows 7 operating system.
This Micro Tutorial will give you a introduction in two parts how to utilize Windows Live Movie Maker to its maximum capability. This will be demonstrated using Windows Live Movie Maker on Windows 7 operating system.

622 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question