Run As Administrator

[mohammedha]

Seems there is an issue running the terminal "As Administrator"

Error: Windows cannot find "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_0.2.1831.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe" Make sure you've typed the name correctly, then try again

[zadjii-msft]

@DHowett-MSFT I could've swore we had a duplicate issue sitting around somewhere for this, but I can't find it now. Do you remember what causes this?

[mohammedha]

Ahh man, sorry if it is a duplicate.

there is no reason, start the app fine but r-click and start as admin fails, windows UAC prompt for admin password twice then you get the error.

I'm also currently experiencing this issue. I searched for terminal in the taskbar

Then I was prompted to enter my admin credentials twice! One admin prompt after another. Then when I finished entering my credentials the second time this error message popped up:

I just installed the terminal today.

Terminal Version:
Version: 0.2.1831.0

OS Version:
Windows 10 Pro
10.0.18362 Build 18362

Also as a suggestion instead of running the WHOLE terminal as admin from the taskbar, perhaps have alternatives?

For example:

When opening a new tab prompt the user or have some UI asking if they want to open the new instance as an administrator?

Or just right click on the terminal to open up a admin tab from the exact same directory. (That would be very useful for powershell-core since it doesn't have nice functionality like sudo)

[fcharlie]

Windows Terminal support running in admin mode may not be a good behavior, which means that all shells in other tabs opened from Ctrl+T may be administrator privilege. As far as I know, Windows Terminal does not implement any code from the Administrator to the restricted user. In fact, what Windows lacks is the kind of privilege implementation that does not require UI interaction, like sudo.

But implementing sudo can also be cumbersome. The flow of runas verb is roughly as follows (if anything is wrong, please remind me):

1. AppInfo goes and talks to the Local Security Authority to get the elevated token of the logged in user of Session 1.
2. AppInfo loads up a STARTUPINFOEX structure (new to Vista), and calls the brand new Vista API InitializeProcThreadAttributeList() with room for one attribute.
3. OpenProcess() is called to get a handle to the process that initiated the RPC call.
4. UpdateProcThreadAttribute() is called with PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, and uses the handle retrieved in step 3.
5. CreateProcessAsUser() is called with EXTENDED_STARTUPINFO_PRESENT and the results of steps 1 and 4.
6. DeleteProcThreadAttributeList() is called.
7. Results are gathered, and handles are cleaned up.

We can draw a simple conclusion. In fact, runas is actually a normal process that initiates an RPC request to a high-privileged process. The high-privilege process (AppInfo service) creates an Administrator process and sets its parent process as a normal process.

AppInfo does not currently support setting up a working directory, input and output (although calling CreateProcessAsUser) when launching the administrator process. This is a problem that needs to be solved to enable sudo support to run in Windows Terminal. (ShellExecuteEx SEE_MASK_NO_CONSOLE not work)

SHELLEXECUTEINFOW:

typedef struct _SHELLEXECUTEINFOW {
  DWORD     cbSize;
  ULONG     fMask;
  HWND      hwnd;
  LPCWSTR   lpVerb;
  LPCWSTR   lpFile;
  LPCWSTR   lpParameters;
  LPCWSTR   lpDirectory;
  int       nShow;
  HINSTANCE hInstApp;
  void      *lpIDList;
  LPCWSTR   lpClass;
  HKEY      hkeyClass;
  DWORD     dwHotKey;
  union {
    HANDLE hIcon;
    HANDLE hMonitor;
  } DUMMYUNIONNAME;
  HANDLE    hProcess;
} SHELLEXECUTEINFOW, *LPSHELLEXECUTEINFOW;

See: https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-updateprocthreadattribute

Value

Meaning

PROC_THREAD_ATTRIBUTE_PARENT_PROCESS

The lpValue parameter is a pointer to a handle to a process to use instead of the calling process as the parent for the process being created. The process to use must have the PROCESS_CREATE_PROCESS access right. Attributes inherited from the specified process include handles, the device map, processor affinity, priority, quotas, the process token, and job object. (Note that some attributes such as the debug port will come from the creating process, not the process specified by this handle.)

[DHowett-MSFT]

This is definitely a windows platform issue. I'm assigning it to myself to follow up with the team that owns it and close this out. Thanks.

[FranklinYu]

I like @YMba9g8j9CJp0wLoQf5y’s proposal of authorizing a tab with escalated privilege. I’m from ConEmu where we can create a tab with or without admin privilege. When creating an admin tab I will be prompted with UAC (for good).

[cking22001]

Is this not just normal behavior of Windows store applications? This looks like the Preview app recently released.
But I do need a way to run elevated shells. It does not seem possible to do that today (open tabs as admin).