Everything Service & Elevated Programs

If you are experiencing problems with "Everything", post here for assistance.
Post Reply
vanisk
Posts: 10
Joined: Sat Oct 27, 2018 11:33 am

Everything Service & Elevated Programs

Post by vanisk » Sat Oct 27, 2018 2:46 pm

I'm using Windows 8.1 64bit and Everything Version 1.4.1.895 (x64). On installation of Everything, i chose "Everything Service" and deselected "Run as Administrator".

All the programs/files executed from Everything search results opens with elevated rights. Is this the default behavior or am i doing something wrong.

horst.epp
Posts: 136
Joined: Fri Apr 04, 2014 3:24 pm

Re: Everything Service & Elevated Programs

Post by horst.epp » Sat Oct 27, 2018 3:40 pm

No thats your fault.
I guess you are starting an Everything search from within an enhanced process.
Then the started processes get enhanced rights of course.
Using a normal user and starting Everything search it queries the running service
and delivers the results to your process running with normal rights.

NotNull
Posts: 917
Joined: Wed May 24, 2017 9:22 pm

Re: Everything Service & Elevated Programs

Post by NotNull » Sat Oct 27, 2018 4:15 pm

There are a couple of placs where elevation can be configured:

Check Everything settings
  • Go to Menu:Tools > Options > General
  • Enable Everything Service
  • Disable Run as administrator
  • Press OK button
Exit Everything
  • rightclick Everything icon in the systemtray
  • Choose Exit

Check Everything executable
  • Right-click Everything.exe
  • Select Properties
  • Select the Compatibility tab
  • Press Change settings for all users
  • Disable Run this program as administrator
  • Press OK button
  • Disable Run this program as administrator
  • Press OK button

Check Everything shortcut
  • Right-click your Everything.shortcut
  • Select Properties
  • Select the Compatibility tab
  • Press Change settings for all users
  • Disable Run this program as administrator
  • Press OK button
  • Disable Run this program as administrator
  • Select the Shortcut tab
  • Press the Advanced button
  • Disable Run as administrator
  • Press OK button
  • Press OK button

Now you can start Everything again.
Please report back if this fixed your issue.


And like @horst.epp already mentioned: If you start Everything from some other program that is already running elevated (like some 3rd party filemanager), that will cause Everything to be running elevated, too

vanisk
Posts: 10
Joined: Sat Oct 27, 2018 11:33 am

Re: Everything Service & Elevated Programs

Post by vanisk » Sat Oct 27, 2018 5:00 pm

Thanks for the reply.

Everything starts with windows as a service. Also i verified once again that in
Tools->Options->General, "Run as Administrator" is disabled.

Also checked with Everything executable, and "Run as Administrator" is disabled there too.

For shortcut, not using everything shortcut. But set a global hotkey for New Window [Win+Contr+S] and using the shortcut key instead.

froggie
Posts: 104
Joined: Wed Jun 12, 2013 10:43 pm

Re: Everything Service & Elevated Programs

Post by froggie » Sat Oct 27, 2018 10:29 pm

To see if Everything is running as an administrator, type /debug and then press enter. The debug window will open and a few lines from the top will have an entry

Code: Select all

IsAdmin  0 or 1
(you may have to push the scroll bar on the right to the top to see the first few lines)

If the value is "1" then Everything is running as admin, if "0", not.

Type /debug off and press enter to close the debug window.

vanisk
Posts: 10
Joined: Sat Oct 27, 2018 11:33 am

Re: Everything Service & Elevated Programs

Post by vanisk » Sat Oct 27, 2018 10:34 pm

froggie wrote:To see if Everything is running as an administrator, type /debug and then press enter. The debug window will open and a few lines from the top will have an entry

Code: Select all

IsAdmin  0 or 1
(you may have to push the scroll bar on the right to the top to see the first few lines)

If the value is "1" then Everything is running as admin, if "0", not.

Type /debug off and press enter to close the debug window.
Thanks for the reply & info. Here is the output of /debug

Everything
Version 1.4.1.895 (x64)
Windows NT 6.2
Processors 4
IsAdmin 0
AppData 1
Service 1
cmdline "C:\Program Files\Everything\Everything.exe"

froggie
Posts: 104
Joined: Wed Jun 12, 2013 10:43 pm

Re: Everything Service & Elevated Programs

Post by froggie » Sat Oct 27, 2018 10:45 pm

That's fine, you are not running as admin.

Now try this:

in everything, search for

Code: Select all

c:\windows\system32\cmd.exe
double click cmd.exe in the result list, a cmd (dos) window should open

type FSUTIL at the c:\Windows\System32> prompt

do you get a message "The FSUTIL utility requires that you have administrative privileges." ?

vanisk
Posts: 10
Joined: Sat Oct 27, 2018 11:33 am

Re: Everything Service & Elevated Programs

Post by vanisk » Sat Oct 27, 2018 10:59 pm

froggie wrote:That's fine, you are not running as admin.

Now try this:

in everything, search for

Code: Select all

c:\windows\system32\cmd.exe
double click cmd.exe in the result list, a cmd (dos) window should open

type FSUTIL at the c:\Windows\System32> prompt

do you get a message "The FSUTIL utility requires that you have administrative privileges." ?
Actually C:\windows was in exclude list. Now i deleted the entry and searched for cmd and opened it.

FSUTIL responded with a list of commands supported.

froggie
Posts: 104
Joined: Wed Jun 12, 2013 10:43 pm

Re: Everything Service & Elevated Programs

Post by froggie » Sun Oct 28, 2018 12:03 am

What happens when you run this same test from windows explorer, instead of everything

vanisk
Posts: 10
Joined: Sat Oct 27, 2018 11:33 am

Re: Everything Service & Elevated Programs

Post by vanisk » Sun Oct 28, 2018 12:31 am

Thanks everyone. Sorry for the inconvenience caused.

Idk what caused the issue. So I did uninstall Everything, ran SFC and installed Everything again. Now its working fine.

froggie
Posts: 104
Joined: Wed Jun 12, 2013 10:43 pm

Re: Everything Service & Elevated Programs

Post by froggie » Sun Oct 28, 2018 12:43 am

Would you kindly do me a favor and still run the windows explorer test? I would really like to know if Everything has some failure mode where it bypasses Windows UAC security or if it is just turned off on your system.

vanisk
Posts: 10
Joined: Sat Oct 27, 2018 11:33 am

Re: Everything Service & Elevated Programs

Post by vanisk » Sun Oct 28, 2018 1:01 am

froggie wrote:Would you kindly do me a favor and still run the windows explorer test? I would really like to know if Everything has some failure mode where it bypasses Windows UAC security or if it is just turned off on your system.
Sure. But i executed SFC beforehand. ran cmd.exe thru windows explorer
FSUTIL results in
Error: Access is denied.

froggie
Posts: 104
Joined: Wed Jun 12, 2013 10:43 pm

Re: Everything Service & Elevated Programs

Post by froggie » Sun Oct 28, 2018 1:44 am

Thanks.

VOID -

It is a bit worrisome that Everything seems to have been bypassing UAC elevation control somehow. Probably not enough info to diagnose but still.....

void
Site Admin
Posts: 4197
Joined: Fri Oct 16, 2009 11:31 pm

Re: Everything Service & Elevated Programs

Post by void » Mon Oct 29, 2018 9:29 am

Everything should not be bypassing the Windows UAC.

UAC is most likely disabled.
Perhaps the default verb for execuables is set to runas? Everything will open files with the default verb.

Check to see if programs run from Everything are run elevated:
https://winaero.com/blog/how-to-check-i ... n-windows/

Is Everything also listed as elevated?

Run UAC restricted programs without the UAC prompt:
https://www.techrepublic.com/blog/windo ... ac-prompt/
This does not seem possible to do through Everything. -Requires setting up a scheduled task for each executable.

What are your current UAC settings
https://www.dummies.com/computers/compu ... windows-7/

Did you change your open command under Tools -> Options -> Context menu -> Open (Files) -> Command

void
Site Admin
Posts: 4197
Joined: Fri Oct 16, 2009 11:31 pm

Re: Everything Service & Elevated Programs

Post by void » Tue Oct 30, 2018 9:12 am

vanisk wrote:
Yes, program i ran through everything is listed as Elevated in Windows Task Manager.

Yes, There are 2 everything.exe with different PIDs and both are listed as "Yes" in Elevated column.

UAC is set to "Notify me only when apps try to make changes to my computer (default)"

void
Site Admin
Posts: 4197
Joined: Fri Oct 16, 2009 11:31 pm

Re: Everything Service & Elevated Programs

Post by void » Tue Oct 30, 2018 9:15 am

Yes, There are 2 everything.exe with different PIDs and both are listed as "Yes" in Elevated column.
One will be for the Service which does run elevated.
The other will be for the search client and should not be running as elevated.

The Service Everything.exe should only be using about 1MB ram.

Are you starting Everything from a scheduled task?

vanisk
Posts: 10
Joined: Sat Oct 27, 2018 11:33 am

Re: Everything Service & Elevated Programs

Post by vanisk » Tue Oct 30, 2018 11:02 am

void wrote:
Tue Oct 30, 2018 9:15 am
Yes, There are 2 everything.exe with different PIDs and both are listed as "Yes" in Elevated column.
One will be for the Service which does run elevated.
The other will be for the search client and should not be running as elevated.

The Service Everything.exe should only be using about 1MB ram.

Are you starting Everything from a scheduled task?
Yes, you are right, its because of scheduled task [which i didn't create]. Actually i installed everything service and deselected "Run as admin" on installation. But i have a program in my PC which sometimes push some programs to "delay load" so as to boost my pc bootup time and it did move everything to delay load. I guess its creating a scheduled task to delay load the programs, thus creating elevated everything.exe. I disabled delay load option in that app for everything.exe and restarted my PC. now in Task manager, there are 2 everything.exe with 1MB one as elevated and the other as not-elevated. Also the program i run from everything is now not-elevated.

Sorry for causing so much trouble.

Thanks for the support.

NotNull
Posts: 917
Joined: Wed May 24, 2017 9:22 pm

Re: Everything Service & Elevated Programs

Post by NotNull » Tue Oct 30, 2018 2:06 pm

Glad that one is sorted out!
vanisk wrote:
Tue Oct 30, 2018 11:02 am
But i have a program in my PC which sometimes push some programs to "delay load" ...
Just out of curiosity: what program is this?

Post Reply