Everything Service & Elevated Programs

[vanisk]

I'm using Windows 8.1 64bit and Everything Version 1.4.1.895 (x64). On installation of Everything, i chose "Everything Service" and deselected "Run as Administrator".

All the programs/files executed from Everything search results opens with elevated rights. Is this the default behavior or am i doing something wrong.

[horst.epp]

No thats your fault.
I guess you are starting an Everything search from within an enhanced process.
Then the started processes get enhanced rights of course.
Using a normal user and starting Everything search it queries the running service
and delivers the results to your process running with normal rights.

[NotNull]

There are a couple of placs where elevation can be configured:

Check Everything settings

• Go to Menu:Tools > Options > General
• Enable Everything Service
• Disable Run as administrator
• Press OK button

Exit Everything

• rightclick Everything icon in the systemtray
• Choose Exit

Check Everything executable

• Right-click Everything.exe
• Select Properties
• Select the Compatibility tab
• Press Change settings for all users
• Disable Run this program as administrator
• Press OK button
• Disable Run this program as administrator
• Press OK button

Check Everything shortcut

• Right-click your Everything.shortcut
• Select Properties
• Select the Compatibility tab
• Press Change settings for all users
• Disable Run this program as administrator
• Press OK button
• Disable Run this program as administrator
• Select the Shortcut tab
• Press the Advanced button
• Disable Run as administrator
• Press OK button
• Press OK button

Now you can start Everything again.
Please report back if this fixed your issue.


And like @horst.epp already mentioned: If you start Everything from some other program that is already running elevated (like some 3rd party filemanager), that will cause Everything to be running elevated, too

[vanisk]

Thanks for the reply.

Everything starts with windows as a service. Also i verified once again that in
Tools->Options->General, "Run as Administrator" is disabled.

Also checked with Everything executable, and "Run as Administrator" is disabled there too.

For shortcut, not using everything shortcut. But set a global hotkey for New Window [Win+Contr+S] and using the shortcut key instead.

[froggie]

To see if Everything is running as an administrator, type /debug and then press enter. The debug window will open and a few lines from the top will have an entry

Code: Select all

IsAdmin  0 or 1

(you may have to push the scroll bar on the right to the top to see the first few lines)

If the value is "1" then Everything is running as admin, if "0", not.

Type /debug off and press enter to close the debug window.

[vanisk]

To see if Everything is running as an administrator, type /debug and then press enter. The debug window will open and a few lines from the top will have an entry

Code: Select all

IsAdmin  0 or 1

(you may have to push the scroll bar on the right to the top to see the first few lines)

If the value is "1" then Everything is running as admin, if "0", not.

Type /debug off and press enter to close the debug window.

Thanks for the reply & info. Here is the output of /debug

Everything
Version 1.4.1.895 (x64)
Windows NT 6.2
Processors 4
IsAdmin 0
AppData 1
Service 1
cmdline "C:\Program Files\Everything\Everything.exe"

[froggie]

That's fine, you are not running as admin.

Now try this:

in everything, search for

Code: Select all

c:\windows\system32\cmd.exe

double click cmd.exe in the result list, a cmd (dos) window should open

type FSUTIL at the c:\Windows\System32> prompt

do you get a message "The FSUTIL utility requires that you have administrative privileges." ?

[vanisk]

That's fine, you are not running as admin.

Now try this:

in everything, search for

Code: Select all

c:\windows\system32\cmd.exe

double click cmd.exe in the result list, a cmd (dos) window should open

type FSUTIL at the c:\Windows\System32> prompt

do you get a message "The FSUTIL utility requires that you have administrative privileges." ?

Actually C:\windows was in exclude list. Now i deleted the entry and searched for cmd and opened it.

FSUTIL responded with a list of commands supported.

[froggie]

What happens when you run this same test from windows explorer, instead of everything

[vanisk]

Thanks everyone. Sorry for the inconvenience caused.

Idk what caused the issue. So I did uninstall Everything, ran SFC and installed Everything again. Now its working fine.

[froggie]

Would you kindly do me a favor and still run the windows explorer test? I would really like to know if Everything has some failure mode where it bypasses Windows UAC security or if it is just turned off on your system.

[vanisk]

Would you kindly do me a favor and still run the windows explorer test? I would really like to know if Everything has some failure mode where it bypasses Windows UAC security or if it is just turned off on your system.

Sure. But i executed SFC beforehand. ran cmd.exe thru windows explorer
FSUTIL results in
Error: Access is denied.

[froggie]

Thanks.

VOID -

It is a bit worrisome that Everything seems to have been bypassing UAC elevation control somehow. Probably not enough info to diagnose but still.....

[void]

Everything should not be bypassing the Windows UAC.

UAC is most likely disabled.
Perhaps the default verb for execuables is set to runas? Everything will open files with the default verb.

Check to see if programs run from Everything are run elevated:
https://winaero.com/blog/how-to-check-i ... n-windows/

Is Everything also listed as elevated?

Run UAC restricted programs without the UAC prompt:
https://www.techrepublic.com/blog/windo ... ac-prompt/
This does not seem possible to do through Everything. -Requires setting up a scheduled task for each executable.

What are your current UAC settings
https://www.dummies.com/computers/compu ... windows-7/

Did you change your open command under Tools -> Options -> Context menu -> Open (Files) -> Command

[void]

vanisk wrote:

Yes, program i ran through everything is listed as Elevated in Windows Task Manager.

Yes, There are 2 everything.exe with different PIDs and both are listed as "Yes" in Elevated column.

UAC is set to "Notify me only when apps try to make changes to my computer (default)"

[void]

Yes, There are 2 everything.exe with different PIDs and both are listed as "Yes" in Elevated column.

One will be for the Service which does run elevated.
The other will be for the search client and should not be running as elevated.

The Service Everything.exe should only be using about 1MB ram.

Are you starting Everything from a scheduled task?

[vanisk]

Yes, There are 2 everything.exe with different PIDs and both are listed as "Yes" in Elevated column.

One will be for the Service which does run elevated.
The other will be for the search client and should not be running as elevated.

The Service Everything.exe should only be using about 1MB ram.

Are you starting Everything from a scheduled task?

Yes, you are right, its because of scheduled task [which i didn't create]. Actually i installed everything service and deselected "Run as admin" on installation. But i have a program in my PC which sometimes push some programs to "delay load" so as to boost my pc bootup time and it did move everything to delay load. I guess its creating a scheduled task to delay load the programs, thus creating elevated everything.exe. I disabled delay load option in that app for everything.exe and restarted my PC. now in Task manager, there are 2 everything.exe with 1MB one as elevated and the other as not-elevated. Also the program i run from everything is now not-elevated.

Sorry for causing so much trouble.

Thanks for the support.

[NotNull]

Glad that one is sorted out!

But i have a program in my PC which sometimes push some programs to "delay load" ...

Just out of curiosity: what program is this?