If I type "cmd" in the "Type here to search" box and press
Ctrl+Shift+Enter, I get a UAC prompt, and when I give permission I
get an administrative command prompt with "Administrator: Command
Prompt" in the title bar.

If I open Task Manager, click File, then Ctrl-click Run new task, I
get _no_ UAC prompt, and a command prompt appears, with
"Administrator: C:\Windows\system32\cmd.exe" in the title bar.

In Windows 7, there were also two admin command prompts with those
title bars. The cmd.exe one would run the convert command, but the
Command prompt one would. In Windows 10, both of them will run
convert, at least to the point of complaining that I didn't specify a
filename, but that proves nothing since an ordinary non-elevated
prompt does the same.

Does anyone know the functional differences (if any) between the two
elevated Windows 10 command prompts? The fact that one has a UAC
prompt and the other does not suggests that there should be
_something_ the second one can do that the first cannot.

--
Stan Brown, Tehachapi, California, USA https://BrownMath.com/
Shikata ga nai...

On 23/12/2021 15:14, Stan Brown wrote:
> If I type "cmd" in the "Type here to search" box and press
> Ctrl+Shift+Enter, I get a UAC prompt, and when I give permission I
> get an administrative command prompt with "Administrator: Command
> Prompt" in the title bar.
>
> If I open Task Manager, click File, then Ctrl-click Run new task, I
> get _no_ UAC prompt, and a command prompt appears, with
> "Administrator: C:\Windows\system32\cmd.exe" in the title bar.
>
> In Windows 7, there were also two admin command prompts with those
> title bars. The cmd.exe one would run the convert command, but the
> Command prompt one would. In Windows 10, both of them will run
> convert, at least to the point of complaining that I didn't specify a
> filename, but that proves nothing since an ordinary non-elevated
> prompt does the same.
>
> Does anyone know the functional differences (if any) between the two
> elevated Windows 10 command prompts? The fact that one has a UAC
> prompt and the other does not suggests that there should be
> _something_ the second one can do that the first cannot.
>

I doubt there is any difference.

I think it's just that with the default UAC settings, some things are
allowed to bypass the UAC prompt and elevate anyway. They have perhaps
been a little inconsistent when choosing those things.

I bet if you turn UAC up to full you'll get a UAC prompt both ways.

--
Brian Gregory (in England).

On Thu, 23 Dec 2021 07:14:15 -0800, Stan Brown wrote:

> If I type "cmd" in the "Type here to search" box and press
> Ctrl+Shift+Enter, I get a UAC prompt, and when I give permission I
> get an administrative command prompt with "Administrator: Command
> Prompt" in the title bar.

Me too only the title bar says:
Administrator: C:\Windows\system32\cmd.exe

And the three lines of text (one line is blank) say:
Microsoft Windows [Version 10.0.19042.1415]
(c) Microsoft Corporation. All rights reserved.

C:\Windows\system32>

> If I open Task Manager, click File, then Ctrl-click Run new task, I
> get _no_ UAC prompt, and a command prompt appears, with
> "Administrator: C:\Windows\system32\cmd.exe" in the title bar.

My task manager is set to run "Process Explorer" which only has:
File > {Run, Run as Administrator, Run as Limited User}

No matter how I "Run as Administrator" (whether with a control click or
without a control click) I _still_ get the UAC prompt after typing "cmd".
> In Windows 7, there were also two admin command prompts with those
> title bars. The cmd.exe one would run the convert command, but the
> Command prompt one would. In Windows 10, both of them will run
> convert, at least to the point of complaining that I didn't specify a
> filename, but that proves nothing since an ordinary non-elevated
> prompt does the same.
>
> Does anyone know the functional differences (if any) between the two
> elevated Windows 10 command prompts? The fact that one has a UAC
> prompt and the other does not suggests that there should be
> _something_ the second one can do that the first cannot.

I don't know the answer to the question, but bear in mind what someone else
said which is you can have two ways to open the same thing, only one of
which might invoke the UAC prompt.

For example, I have "regedit" set to "regit" which not only doesn't bring up
the UAC prompt but which also opens the registry even as both commands run
the same "regedit.exe" file.

I forget the details but I used the task scheduler & a shortcut to do it.
<https://www.google.com/search?q=regedit+remove+uac+prompt+for+one+program+only>

In another case, I know that there is "magic" in this command below which,
somehow, avoids the UAC prompt (which I've never figured out _how_ it does
that trick - but it runs commands as admin without being admin _and_ without
bringing up the UAC prompt last I tested it anyway).
<https://www.raymond.cc/blog/automatic-vpn-kill-switch/>

My point being that you can end up running the same command and in some
cases get a UAC prompt but in other cases not getting that UAC prompt.

On 12/23/2021 10:14 AM, Stan Brown wrote:
> If I type "cmd" in the "Type here to search" box and press
> Ctrl+Shift+Enter, I get a UAC prompt, and when I give permission I
> get an administrative command prompt with "Administrator: Command
> Prompt" in the title bar.
>
> If I open Task Manager, click File, then Ctrl-click Run new task, I
> get _no_ UAC prompt, and a command prompt appears, with
> "Administrator: C:\Windows\system32\cmd.exe" in the title bar.
>
> In Windows 7, there were also two admin command prompts with those
> title bars. The cmd.exe one would run the convert command, but the
> Command prompt one would. In Windows 10, both of them will run
> convert, at least to the point of complaining that I didn't specify a
> filename, but that proves nothing since an ordinary non-elevated
> prompt does the same.
>
> Does anyone know the functional differences (if any) between the two
> elevated Windows 10 command prompts? The fact that one has a UAC
> prompt and the other does not suggests that there should be
> _something_ the second one can do that the first cannot.
>

whoami /user /priv

Such a command gives you a wall of text that is intended
to give you some idea what mode you're in.

If a user belonging to the Admin Group is elevated, they
should have the same privilege list as the Real Admin
would have.

If the list of privs is short, then you're un-elevated.

Just the length of the list, is a good start. And the
Enabled versus Disabled in the list, isn't a reliable
indicator of anything. Don't get too hung up on those
values.

The single most important privilege, might be related
to "Impersonation".

Some hacker-ware can add an item or two, to the
Administrator Group. So if you were thinking "I don't
need to read this shit", that is mostly true, but if
you dabble in hacker-ware, you know which of those
require comparing the "before and after" of the /priv,
for signs of modification. You should really take
a snapshot of the /priv and keep it for later, for
comparison purposes. The hacker-ware I was using,
put a notification in the output, as to what it
was doing.

Paul

On Thu, 23 Dec 2021 15:48:23 -0000 (UTC), Andy Burnelli wrote:
> On Thu, 23 Dec 2021 07:14:15 -0800, Stan Brown wrote:
>
> > If I type "cmd" in the "Type here to search" box and press
> > Ctrl+Shift+Enter, I get a UAC prompt, and when I give permission I
> > get an administrative command prompt with "Administrator: Command
> > Prompt" in the title bar.
>
> Me too only the title bar says:
> Administrator: C:\Windows\system32\cmd.exe

I wonder if that's a difference between Home and Pro. I have Pro, and
I'm assuming you have Home. If you also have pro, that explanation
falls to the ground.

--
Stan Brown, Tehachapi, California, USA https://BrownMath.com/
Shikata ga nai...

On Thu, 23 Dec 2021 10:49:05 -0500, Paul wrote:
>
> On 12/23/2021 10:14 AM, Stan Brown wrote:
> > If I type "cmd" in the "Type here to search" box and press
> > Ctrl+Shift+Enter, I get a UAC prompt, and when I give permission I
> > get an administrative command prompt with "Administrator: Command
> > Prompt" in the title bar.
> >
> > If I open Task Manager, click File, then Ctrl-click Run new task, I
> > get _no_ UAC prompt, and a command prompt appears, with
> > "Administrator: C:\Windows\system32\cmd.exe" in the title bar.
> >
> > In Windows 7, there were also two admin command prompts with those
> > title bars. The cmd.exe one would run the convert command, but the
> > Command prompt one would. In Windows 10, both of them will run
> > convert, at least to the point of complaining that I didn't specify a
> > filename, but that proves nothing since an ordinary non-elevated
> > prompt does the same.
> >
> > Does anyone know the functional differences (if any) between the two
> > elevated Windows 10 command prompts? The fact that one has a UAC
> > prompt and the other does not suggests that there should be
> > _something_ the second one can do that the first cannot.
> >
>
> whoami /user /priv
>
> Such a command gives you a wall of text that is intended
> to give you some idea what mode you're in.
>
> If a user belonging to the Admin Group is elevated, they
> should have the same privilege list as the Real Admin
> would have.
>
> If the list of privs is short, then you're un-elevated.
>
> Just the length of the list, is a good start. And the
> Enabled versus Disabled in the list, isn't a reliable
> indicator of anything. Don't get too hung up on those
> values.
>
> The single most important privilege, might be related
> to "Impersonation".

The same 24 privileges were in both lists. However,
SeSystemProfilePrivilege Profile system performance
and
SeDebugPrivilege Debug programs
were Disabled in the Administrator: Command Prompt window and Enabled
in the Administrator: C:\Windows\system32\cmd.exe window.

Since you say that "Enabled versus Disabled in the list isn't a
reliable indicator of anything" I guess we don't know whether the two
windows have the same privileges or not.

--
Stan Brown, Tehachapi, California, USA https://BrownMath.com/
Shikata ga nai...