There are a number of things I find confusing with Windows. The word "Administrator" is one of them. It has multiple meanings.
As a proper noun, "Administrator" is the name associated with a user account. In this account, ACL, or Access Control List, is disabled completely. That's why many activities that are blocked normally are allowed while "Running as Administrator."
As an adjective, "Administrator" describes a set of user privileges. These privileges permit much more than what is allowed users using "Limited" accounts.
Where things get messy. . .
Because many users become impatient with the restrictions on "Limited" accounts, they simply use an "Administrator" account for all their work. This practice leaves them profoundly vulnerable to malicious code. They aren't getting the full protection built into Windows.
To fix this, Windows features "Protected Administrator" accounts. These accounts combine much of the freedom of an "Administrator" account with some degree of protection provided by "Limited" accounts. For some insane reason, known only to Microsoft, they didn't change the name! These "Protected Administrator" accounts are called "Administrator."
So when a person uses Control Panel > User Accounts > Change your account type to give an account "Administrator" privileges, in actual fact, they're assigning "Protected Administrator" privileges.
This may explain the annoying extra step Windows requires from users in "Administrator" accounts being reminded that the operation they're trying to complete requires "Administrator" privileges. Many wonder why they're seeing this, thinking "But I'm already running as Administrator."
Cheers, PW. |
