Issue with Run as NoAdmin and Everything Service

[David.P]

Hello Forum,

apparently I am not able to get the Everything service to run correctly, and start Everything in NoAdmin mode.



See screenshot. Apparently, the service runs correctly according to the Windows services list. On the other hand, Flow Launcher reports that the service is supposedly not running.

Also, every time I deselect "Run as Administrator" in the Everything options, Everything still runs as administrator the next time It is started.

Am I doing something wrong, or what could be causing this issue?

[void]

Looks like Everything is being launched as an admin externally.


How are you launching Everything?
If you exit Everything (File -> Exit) and launch Everything directly from Everything64.exe, does Everything open as an admin?


Please make sure Everything is running as a standard user:

• Right click your Everything.exe or a shortcut to Everything
• Click Properties.
• Click the Shortcut tab.
• Click the Advanced button.
• Uncheck Run as administrator.
• Click OK.
• Click OK.

Flow Launcher might be looking for the Everything 1.4 service?
I am not familiar with Flow Launcher sorry.

[David.P]

Thank you for the quick reply.

I start Everything as NoAdmin with a shortcut from the start menu with the following properties:



Regarding Flow Launcher, I shall check out the community over there.

[void]

Are you using the true administrator account?
-If so, then Yes, Everything will also run as an administrator and the Service is not required.

[David.P]

I believe I'm not using the true Admin account, however I'm not sure and will check.

What I can say is that other programs run with normal rights and not admin rights.

[void]

If you are using the true admin account, %APPDATA% will redirect to C:\Users\administrator\...


What is the command line used to start Everything:

• In Everything, from the Tools menu, under the Debug submenu, check Console.
• The command line is shown at the top of the debug console.
  For example:
  cmdline "C:\Program Files\Everything\Everything64.exe" -startup

To close the debug console:

• In Everything, from the Tools menu, under the Debug submenu, uncheck Console.

[David.P]

This can be taken from the console:

Code: Select all

Everything
Version 1.5.0.1304a (x64)
Windows NT 10.0
Processors 8
IsAdmin 1
AppData 1
Service 2
cmdline "F:\Portable Program Files\Everything File Search\Everything64.exe".

My user account is a normal user with administrator rights:


However, the account name does not match the account path, and the size of the account is not specified. Not sure if this means anything?

[void]

Thanks for the debug output.

The command line is normal.
Everything is not trying to launch itself as an administrator.


It doesn't look like you are using the true administrator account.


The debug log shows the Everything Service is not running, which is really odd as this contradicts the Tools -> Options -> Everything Service setting.
Is Tools -> Options -> Everything Service still tick-checked?


Could you please try the following:

• Exit Everything (File -> Exit)
• Copy:
  F:\Portable Program Files\Everything File Search\Everything64.exe
  to:
  F:\Portable Program Files\Everything File Search-1304a\Everything64-1304a.exe
• Launch F:\Portable Program Files\Everything File Search-1304a\Everything64-1304a.exe
• Are you prompted with: "Everything" requires administrative privileges to index system NTFS volumes?
  -If so, choose Install Everything Service.
• What is shown under Tools -> Options -> General?

[David.P]

OK I did as you said.

I was not prompted with: "Everything requires administrative privileges to index system NTFS volumes".

Maybe this is because I have Windows UAC set to "Never".

This is Tools -> Options -> General just after the first start:



Here is some more console output of the moved version of Everything64.exe:

Code: Select all

Everything
Version 1.5.0.1304a (x64)
Windows NT 10.0
Processors 8
IsAdmin 1
AppData 0
Service 2
cmdline "F:\Portable Programme\Everything File Search-1304a\Everything64.exe"

In my case, a certain peculiarity is that the Windows user folders are on a separate SSD with drive letter F:. This has been running for about a year without any problems.

[void]

Thanks for the logs and screenshots,

Everything is still running as an administrator.

The "Everything requires administrative privileges to index system NTFS volumes" prompt will not be shown when Everything is running as an administrator.



Could you please try the following:

• From the Start menu, search for: cmd
• Click Command Prompt.
• In the command prompt window, what is shown in the window title bar?
  It should be either:
  Administrator: C:\Windows\System32\cmd.exe
  -or-
  C:\Windows\System32\cmd.exe

If cmd.exe is also running as an administrator it might indicate your Explorer process is also running as an administrator.



If not, please try renaming your Everything64.exe to something else, just in case another third party tool is relaunching Everything as an admin:

• Exit Everything (File -> Exit)
• Copy your Everything64.exe to Everything64-1304a.exe
• Launch Everything64-1304a.exe
• What is shown under Tools -> Options -> General?

[David.P]

Ok -- this is the CMD window:




And this is the renamed Everything:




It could be that Windows Explorer is started by this script at Windows Login, but I believe that the script does not have admin rights:

[void]

Thanks for the information.

That script could be causing the issue.

cmd.exe is also running as an administrator, which is unexpected.
The issue doesn't appear to be with just Everything.


What is shown in your Task Manager?

• Open the Task Manager (Ctrl + Shift + ESC)
• Click the Processes tab.
• Click/check Show processes from all users.
• Sort the list by User Name
• Could you please send a screenshot to support@voidtools.com

[David.P]

O.k. I have sent the screenshot!

[horst.epp]

What a strange idea to use such an AHK script at logon to even start Explorer.
Any stuff in such a script can be made with normal Windows functions.
Explorer is the default Windows shell which starts automatically on every logon.

[void]

Thanks for the screenshot.

The task manager processes look fine.
Explorer is running under your username.
However, it may still be running elevated.

This logon script might be running elevated (even when that setting is disabled)
Could you please try disabling this script, restarting your PC and seeing if the issue persists?

[David.P]

Yep have disabled the script, and will report back.

The script opens an Explorer window, opens and does things with a certain file, and then closes the Explorer window again.

[NotNull]

When you login as an administrator and have UAC "disabled" (set to "Never"), Windows will silently elevate when requested [1][2].
So ANY program that needs elevation will get it. Everything is one of those programs.
Security-wise, this is the worst possible setup (but I am not your mother )
To check: start regedit.exe. If you don't get the UAC prompt, regedit is now running elevated.
Double-check: Start taskmgr.exe, go to the Details tab and add the 'Elevated' column to the list.


So the solution is to change your UAC settings or to log in as a regular user.


[1] Ignoring the fact that some Admin Approval Mode group policies can change all that. But I assume you didn't configure those.

[2]When running as a restricted user (recommended), UAC set to "Never" will prevent elevation completely on Windows 10

[David.P]

O.k. I have deactivated only the AutoHotkey script and then rebooted.

Now Everything starts with the expected request:



So indeed that AutoHotkey script seems to have started the Explorer shell (prematurely) with administrator rights.

Also, I shall bump my UAC settings one notch higher. Actually, two.