Still stuck in Administrator mode

[rdipardo]

Just a shot in the dark, but it’s possible the list of security principals was recently changed on the notepad++.exe image. If you peek at the Security tab of the file’s Properties dialog, you may see the principals have been limited to the “SYSTEM” and “Administrators” groups, e.g.

Under that configuration, a non-admin user won’t even be able to execute the application, so the whole process takes on elevated privileges.

Whatever the cause, sounds like I.T. is adopting a paranoid security posture, probably for a good reason…

[PeterJones]

@Martin-Olsson said in Still stuck in Administrator mode:

I hope that you, the developers, would take a deep look into what is happening.

The readers of this Community forum are fellow users of Notepad++. Though a few of us have made contributions, we are not the core developer, nor is this the place for feature requests or bug reports.

For some issues, we can help with workarounds or commisseration, but posting here will not get the developer working on it.

[Martin Olsson]

@rdipardo
Nope, the users and rights for the exe seem normal to me:

[Alan Kilborn]

@PeterJones said in Still stuck in Administrator mode:

…but posting here will not get the developer working on it.

Also, even if it were a real bug report…to be worked on, it needs to be reproducible on demand, and that might be a dubious thing (but maybe @rdipardo 's setup would be a reasonable way to simulate?).

[xomx]

N++ devs cannot help you, it is caused by an invalid domain group policy (GPO) for sure.

@Alan-Kilborn said in Still stuck in Administrator mode:

it needs to be reproducible on demand

If you are lucky and have a helpful and communicative domain admin, you can show him that there is a real problem. But your domain admin will have to temporarily reset back the GPO settings to its defaults and you will have to use the ‘gpupdate /force’ command. Then when it starts to behave normally again, you will have proof where the problem is …

Or (if you have that power) remove your machine temporarily from the domain and do the resetting stuff yourself.

If the above will not help, your Windows Security Accounts Manager (SAM) database is probably screwed up and the best thing to do is reinstalling your Windows OS.

[xomx]

@Martin-Olsson said in Still stuck in Administrator mode:

UAC dialog has been replaced with some corporate software called “BeyondTrust Privilege Management”.

Some relevant info:
https://www.beyondtrust.com/docs/privilege-management/windows/admin/index.htm

And maybe something to check:
%ProgramData%\Avecto\Privilege Guard\ePO Cache\Machine\PrivilegeGuardConfig.xml

(it is from here: https://www.beyondtrust.com/docs/privilege-management/windows/epo-admin/troubleshoot.htm )

There is one more thing to try (if you have local admin rights on your PC):

• temporarily unplug network cable from your PC (or disable your active network adapter), this is only to prevent your domain to interfere somehow
• try to disable that BeyondTrust SW somehow (look for the running services, try to kill some proceses, etc…, if it cannot be done, try to restart your Windows into SafeMode and continue)
• test your problem again, if the above helps, the BeyondTrust is the culprit

[Martin Olsson]

@xomx
Thanks. Unfortunatley I have zero hope that the IT dept will make any changes.

But… Since my problem is that N++ is starting itself in Admin-mode (the “dangerous” mode), wouldn’t it be possible (and quite simple?) for the developers to add an option to force N++ to never enter Admin-mode.

Problem solved for people like me, whom don’t want N++ to be running in Admin mode.

There exist an option -noPlugin to Launch N++ without loading any plugin.
My suggestion would then be to add the new option -noAdmin.

-noAdmin :
Prevent Notepad++ from running in Administrator mode (do not elevate privileges). If launched from the Administrator account itself, there’s no ordinary user to fall back on, so Notepad++ will bail with a warning message.

[Coises]

@Martin-Olsson said in Still stuck in Administrator mode:

wouldn’t it be possible (and quite simple?) for the developers to add an option to force N++ to never enter Admin-mode.

I suspect it would not be possible. Windows (most likely at the behest of BeyondTrust) is launching in Admin mode. It’s already happened by the time Notepad++ gets control.

Have you tried any of the following:

1. Using a portable copy rather than an installed copy?

2. Installing somewhere other than Program Files?

3. Installing the 32-bit version?

I’m not saying any of those will necessarily work, but if they are possible under the controls imposed on your system, they might avoid whatever is triggering BeyondTrust to think it should elevate privileges.

[rdipardo]

I would not be overly worried about the purported dangers of running N++ as admin. That BeyondTrust crapware probably logs every application start, so there’s not much you can do in “the dangerous mode” without detection — or which can’t be reversed with a system backup. Every current edition of Windows Defender supports controlled folder access anyway.

[Martin Olsson]

@rdipardo
The problem has less to do with security.
The problem is the annoying user experience.
When N++ is (unintentionally stuck) in Admin mode, lots of features are lost/restricted. :-( Like you can’t drag-n-drop files, remote editing is not allowed, the N++ window becomes an annoying sticky window in desktop managers, etc.

Oh well, I have now created a Feature request:
https://github.com/notepad-plus-plus/notepad-plus-plus/issues/14310

[Alan Kilborn]

For me it was more of an annoyance than a “danger”. Since my Explorer was running non-admin, I couldn’t drag and drop from there into Notepad++.

[xomx]

@Martin-Olsson said in Still stuck in Administrator mode:

wouldn’t it be possible (and quite simple?) for the developers to add an option to force N++ to never enter Admin-mode.

Do not forget that your PC is not in a normal state. I mean - even if someone implements that “-noAdmin” feature (and the project maintainer accepts that), it is more than possible that it will not work on your machine!

Anyway, at normal circumstances such feature is doable, yes. You can withdraw the admin privileges from the already running app by the AdjustTokenPrivileges WINAPI. Or you can use the CreateRestrictedToken WINAPI and restart the app without that privilege. But, as I said, all of this could be impossible on your machine in its current state…

[Martin Olsson]

@xomx
I know.
I’m just hoping that someone will try to add the option.

If it works - great! Me and a lot of others now have a workaround for our “Stuck in admin” issue.
If it don’t work for me, but it works for PCs in normal state - then the work is not wasted. Paranoid people have an option to keep N++ from getting too high privileges.

[LordKenmou]

I have the same issue on a corporate Windows 10 managed by “BeyondTrust Privilege Management”, and I found an bit lazy solution.
Somehow the npp starts as non-admin mode if I run npp as administrator from the right click context menu of notepad++exe or its shortcut. It does not work if you enable “run as administrator” checkbox on a property of notepad++exe or its shortcut.

[JohnWren]

@Martin-Olsson
Hi!
Suddenly I have had the same issue.
Apparently was after made a cleaning with “Bleachbit”, I think was something in the Registry.
Anyway, I have solved the issue by doing this:
In Regedit
Equipo\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
EnableLUA
Change 1 to 0

Restart Windows

And then in the Start Menu search for
User Account Control Settings
(or UAC)
With the slider down just accept and Restart again.

And that’s it!
The [Administrator] in Notepad++ disappeared, and also others issues I had with other programs.
I hope this helps.

[Ekopalypse]

For future readers: The tip mentioned by @JohnWren disables the User Account Control feature.
I strongly recommend NOT doing this, it has a purpose.
That’s like removing the airbag from your car to save weight so you use less fuel?