starred/terminal
1
0
Fork 0
mirror of https://github.com/microsoft/terminal.git synced 2026-02-03 21:25:34 +00:00
Code Issues 19.0k Packages Projects Releases 20 Wiki Activity

Opening conhost.exe without Terminal installed leads to an administrator command prompt without asking user for administrator authentication #803

New Issue
Closed
opened 2026-01-30 22:04:40 +00:00 by claunia · 7 comments
claunia commented 2026-01-30 22:04:40 +00:00
Owner
Copy Link

Originally created by @connormcdermid on GitHub (May 8, 2019).

Noob question: I seem to be able to get an administrator command prompt without confirming that I am, in fact, a system administrator (I am not).

I am running Windows 10.0.17134.706

I open conhost.exe from the Run dialog (Win + R) or from the start menu

An administrator command prompt opens without prompting me for an administrator password (my account is not an administrator account) (cmd line prompt is C:\WINDOWS\system32>
I tested this by running a command that would require administrator privileges to execute:
net user xxxx /active:yes and received output The command completed successfully.

This seems like a rather large security flaw; while I don't think this is a widespread issue (might be a bug with my version), I'd like to know if I can fix this.

Originally created by @connormcdermid on GitHub (May 8, 2019). Noob question: I seem to be able to get an administrator command prompt without confirming that I am, in fact, a system administrator (I am not). I am running Windows 10.0.17134.706 I open `conhost.exe` from the Run dialog (Win + R) or from the start menu An administrator command prompt opens without prompting me for an administrator password (my account is *not* an administrator account) (cmd line prompt is `C:\WINDOWS\system32>` I tested this by running a command that would require administrator privileges to execute: `net user xxxx /active:yes` and received output `The command completed successfully`. This seems like a rather large security flaw; while I don't think this is a widespread issue (might be a bug with my version), I'd like to know if I can fix this.
claunia added the Issue-QuestionResolution-Answered labels 2026-01-30 22:04:41 +00:00
claunia commented 2026-01-30 22:04:42 +00:00
Author
Owner
Copy Link

@honglibin commented on GitHub (May 8, 2019):

I have the same issue

@honglibin commented on GitHub (May 8, 2019): I have the same issue
claunia commented 2026-01-30 22:04:42 +00:00
Author
Owner
Copy Link

@fghzxm commented on GitHub (May 8, 2019):

I think in Windows you don't have to be Administrator literally in order to carry out administrative activities, as long as your personal account is marked as "administrator". When you launch programs like taskmgr.exe and mmc.exe, you are still on your personal account, but your administrative privileges get somehow "activated" (though I'm not entirely clear with the Windows security model).

@fghzxm commented on GitHub (May 8, 2019): I think in Windows you don't have to be `Administrator` literally in order to carry out administrative activities, as long as your personal account is marked as "administrator". When you launch programs like `taskmgr.exe` and `mmc.exe`, you are still on your personal account, but your administrative privileges get somehow "activated" (though I'm not entirely clear with the Windows security model).
claunia commented 2026-01-30 22:04:42 +00:00
Author
Owner
Copy Link

@parkovski commented on GitHub (May 8, 2019):

I'm on the same version Windows version, and I do not get an admin prompt doing this - tbh I'm not sure of the privilege checks on that net user command, but can you try this command?

whoami /groups | findstr /b Mandatory

If you see "High Mandatory Level", this means you have active admin permissions. If it says Medium (or lower), you don't.

Just FYI, the startup directory being system32 doesn't have anything to do with whether you have admin permissions or not, but the command I listed above should tell you for sure.

@parkovski commented on GitHub (May 8, 2019): I'm on the same version Windows version, and I do not get an admin prompt doing this - tbh I'm not sure of the privilege checks on that `net user` command, but can you try this command? ``` whoami /groups | findstr /b Mandatory ``` If you see "High Mandatory Level", this means you have active admin permissions. If it says Medium (or lower), you don't. Just FYI, the startup directory being system32 doesn't have anything to do with whether you have admin permissions or not, but the command I listed above should tell you for sure.
claunia commented 2026-01-30 22:04:43 +00:00
Author
Owner
Copy Link

@zadjii-msft commented on GitHub (May 8, 2019):

Does the titlebar say "Administrator: " at the front of it?

I'm very confident that running conhost.exe by itself won't auto-elevate itself.

@zadjii-msft commented on GitHub (May 8, 2019): Does the titlebar say "Administrator: " at the front of it? I'm very confident that running `conhost.exe` by itself won't auto-elevate itself.
claunia commented 2026-01-30 22:04:43 +00:00
Author
Owner
Copy Link

@honglibin commented on GitHub (May 11, 2019):

Mandatory Label\Medium Mandatory Level 标签 S-1-16-8192
so I have no admin permissions, but how I can get the admin permissions?

在 2019-05-08 21:16:25，"Parker Snell" notifications@github.com 写道：

I'm on the same version Windows version, and I do not get an admin prompt doing this - tbh I'm not sure of the privilege checks on that net user command, but can you try this command?

whoami /groups | findstr /b Mandatory

If you see "High Mandatory Level", this means you have active admin permissions. If it says Medium (or lower), you don't.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or mute the thread.

@honglibin commented on GitHub (May 11, 2019): `Mandatory Label\Medium Mandatory Level 标签 S-1-16-8192` so I have no admin permissions, but how I can get the admin permissions? 在 2019-05-08 21:16:25，"Parker Snell" <notifications@github.com> 写道： I'm on the same version Windows version, and I do not get an admin prompt doing this - tbh I'm not sure of the privilege checks on that net user command, but can you try this command? whoami /groups | findstr /b Mandatory If you see "High Mandatory Level", this means you have active admin permissions. If it says Medium (or lower), you don't. — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.
claunia commented 2026-01-30 22:04:43 +00:00
Author
Owner
Copy Link

@honglibin commented on GitHub (May 11, 2019):

Mandatory Label\High Mandatory Level ?? S-1-16-12288
I can run powershell as admin, so I must run the new ternimal in powershell?

在 2019-05-08 21:16:25，"Parker Snell" notifications@github.com 写道：

I'm on the same version Windows version, and I do not get an admin prompt doing this - tbh I'm not sure of the privilege checks on that net user command, but can you try this command?

whoami /groups | findstr /b Mandatory

If you see "High Mandatory Level", this means you have active admin permissions. If it says Medium (or lower), you don't.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or mute the thread.

@honglibin commented on GitHub (May 11, 2019): `Mandatory Label\High Mandatory Level ?? S-1-16-12288` I can run powershell as admin, so I must run the new ternimal in powershell? 在 2019-05-08 21:16:25，"Parker Snell" <notifications@github.com> 写道： I'm on the same version Windows version, and I do not get an admin prompt doing this - tbh I'm not sure of the privilege checks on that net user command, but can you try this command? whoami /groups | findstr /b Mandatory If you see "High Mandatory Level", this means you have active admin permissions. If it says Medium (or lower), you don't. — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.
claunia commented 2026-01-30 22:04:44 +00:00
Author
Owner
Copy Link

@parkovski commented on GitHub (May 12, 2019):

@honglibin - from the UI, right click -> run as administrator. From powershell, start program_name -verb runas.

@parkovski commented on GitHub (May 12, 2019): @honglibin - from the UI, right click -> run as administrator. From powershell, `start program_name -verb runas`.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
⛺ Reserved
A11yCO
A11yMAS
A11ySev1
A11ySev2
A11ySev3
A11yTTValidated
A11yUsable
A11yVoiceAccess
A11yWCAG
Area-Accessibility
Area-AtlasEngine
Area-AzureShell
Area-Build
Area-Build
Area-Chat
Area-CmdPal
Area-CodeHealth
Area-Commandline
Area-CookedRead
Area-DefApp
Area-Extensibility
Area-Fonts
Area-GroupPolicy
Area-i18n
Area-Input
Area-Interaction
Area-Interop
Area-Localization
Area-Output
Area-Performance
Area-Portable
Area-Quality
Area-Remoting
Area-Rendering
Area-Schema
Area-Server
Area-Settings
Area-SettingsUI
Area-ShellExtension
Area-ShellExtension
Area-ShellExtension
Area-Suggestions
Area-Suggestions
Area-TerminalConnection
Area-TerminalControl
Area-Theming
Area-UserInterface
Area-VT
Area-Windowing
Area-WPFControl
AutoMerge
Blocking-Ingestion
Culprit-Centennial
Culprit-WinUI
Disability-All
Disability-Blind
Disability-LowVision
Disability-Mobility
External-Blocked-WinUI3
Fixed
Gathering-Data
good first issue
HCL-E+D
HCL-WindowsTerminal
Help Wanted
Impact-Compatibility
Impact-Compliance
Impact-Correctness
Impact-Visual
In-PR
InclusionBacklog
InclusionBacklog-Windows TerminalWin32
InclusionCommitted-202206
Issue-Bug
Issue-Docs
Issue-Feature
Issue-Feature
Issue-Question
Issue-Samples
Issue-Scenario
Issue-Task
Needs-Attention
Needs-Author-Feedback
Needs-Bisect
Needs-Discussion
Needs-Repro
Needs-Tag-Fix
Needs-Tag-Fix
Needs-Triage
No-Recent-Activity
Priority-0
Priority-1
Priority-2
Priority-3
Product-Cmd.exe
Product-Colortool
Product-Colortool
Product-Colortool
Product-Conhost
Product-Conpty
Product-Meta
Product-Powershell
Product-Terminal
Product-WSL
pull-request
Mirrored from GitHub Pull Request
 Resolution-Answered
Resolution-By-Design
Resolution-Duplicate
Resolution-External
Resolution-Fix-Available
Resolution-Fix-Committed
Resolution-No-Repro
Resolution-Won't-Fix
Severity-Blocking
Severity-Crash
Severity-DataLoss
spam
this-will-be-a-breaking-change
Tracking-External
WindowsTerminal_Win32
Work-Item
zAskModeBug
zInbox-Bug
No Label Issue-Question Resolution-Answered
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
claunia
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/terminal#803
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?