Error when you use the runas command, the Run as Administrator option, or the Run as a different user option after you upgrade Windows Server: Access is denied

This article provides some workarounds for an issue where you can’t use the runas command, the Run as Administrator option, or the Run as a different user option after you upgrade Windows Server.

Original product version: В Windows Server 2012 R2
Original KB number: В 977513

Symptoms

Consider the following scenario:

• You upgrade a computer that’s running Windows Server.
• You sign in as a standard user.
• You try to use one of the following features:
  • runas command
  • Run as Administrator option
  • Run as a different user option

In this scenario, you receive the following error message:

Cause

The discretionary access control list (DACL) for the Secondary Logon service isn’t set correctly when you upgrade Windows Server. This problem prevents a standard user from starting this service and from running an application as a different user.

Workaround 1: Use the Sc.exe command prompt utility

You can use the Sc.exe command prompt utility to set the security to the default configuration after you upgrade the server.

You should log on as an administrator before you run these commands.

To do so, follow these steps:

Open a Command Prompt window.

At the command prompt, type the following command, and then press ENTER:

At the command prompt, type the following command, and then press ENTER:

This command is wrapped for readability.

Close the Command Prompt window.

Try to use one of the following features:

• runas command
• Run as Administrator option
• Run as a different user option

Also, make sure that you can switch users and that the Secondary Logon service starts correctly.

Workaround 2: Use Group Policy

You can use the Group Policy Management Console to configure a domain-based policy that sets security to the default configuration after you upgrade the server. A new Group Policy object (GPO) should be created for this workaround. And it should be linked so that the new GPO is applied to only the affected computers.

To do so, follow these steps:

Edit Group Policy in the Group Policy Management Console.

Locate the policy: Computer Configuration\Policies\Windows Settings\Security Settings\System Services.

Open the Secondary Logon service.

Select the Define this policy setting check box, and then select Enabled.

Set the service startup mode to Manual.

Expand the Security node to make sure that the following properties and objects are set to Allow.

Property	Objects
Authenticated Users	Query Template, Query Status, Enumerate Dependents, Start, Pause, and continue, Interrogate, Read Permissions, User-Defined Control
Builtin\Administrators	Full Control
Interactive	Query Template, Query Status, Enumerate Dependents, Start, Pause, and continue, Interrogate, Read Permissions, User-Defined Control
Service	Query Template, Query Status, Enumerate Dependents, Pause, and continue, Interrogate, User-Defined Control
System	Query Template, Query Status, Enumerate Dependents, Start, Pause, and continue, Interrogate, Stop

Select OK to apply the security changes.

Select OK to apply the Group Policy changes.

Apply the GPO to the affected computers by waiting for Group Policy to update or by starting the update manually.

Try to use one of following features:

• runas command
• Run as Administrator option
• Run as a different user option

Also, make sure that you can switch users and that the Secondary Logon service starts correctly.

We don’t recommend this workaround because the permissions are reapplied during Group Policy updates. However, you have to fix the incorrect security only one time after the upgrade.

More information

For more information about the runas command, visit the following Microsoft TechNet Web site:

For more information about how to use the Group Policy Management Console, visit the following Microsoft TechNet Web site:

RIGHT CLICK OPTIONS «RUN AS ADMINISTRATOR» DOES NOT WORK

I tried start cmd as admin by using search bar -> cmd -> right click -> run as administrator.

after that i tried by start -> windows system -> command prompt right click -> run as administrator.

but above steps doesn’t work for me

i tried to run by file explorer -> c:\windows\system32\cmd.exe right click -> run as administrator. and then it open as administrator.

but when i tried to start any another application as administrator same problem occurred. and it does not start from desktop icon.

Replies (2) 

Sounds like your system is corrupt.

try performing a repair upgrade:

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

This might be your account is no longer an administrator.
Click start and then far left of the start menu right click your account name and select «Change Account Settings».
Does it show your account as an administrator?
If not, click other people and then click your account and choose change account type and set it to administrator.

If you can’t do this then you will need to go into safe mode and assign the rights.
Hopefully in safe mode the command prompt will work.

If you still are unable to do this then This maybe an issue with a system file being corrupt.
You can try a couple things.

Right click your start button and select Command prompt (Admin) to bring up elevated Command prompt.
In Command prompt type sfc /scannow and press enter.
Restart the computer.

If that doesn’t work then try this,

Right click your start button and select Command prompt (Admin) to bring up elevated Command prompt.

In the Administrator: Command Prompt window, type the following commands.
Press Enter key after each command:

DISM.exe /Online /Cleanup-image /Scanhealth

DISM.exe /Online /Cleanup-image /Restorehealth

Important: When you run this command, DISM uses Windows Update to provide the files that are required to fix corruptions.
To close the Administrator: Command prompt window, type Exit, and then press Enter.
Restart your computer.

The «Run As Administrator» Option is missing from the context menu.

1. Were there any changes made on the computer prior to the issue?

2. Does the issue occur for any particular program?

3. Which program are you referring to?

I would suggest you to follow these steps:

a. Right click on the program.

b. Under Compatibility tab, check if you have the option “Run this program as an administrator”.

Try to run Microsoft Safety Scanner for any spyware or malware infection and check if it helps.

Note : The Microsoft Safety Scanner expires 10 days after being downloaded. To rerun a scan with the latest anti-malware definitions, download and run the Microsoft Safety Scanner again. Any data files that are infected may only be cleaned by deleting the file entirely, which means there is a potential for data loss.

I would suggest you to refer to the link to use the system file checker tool (sfc) to troubleshoot missing or corrupted system files in Windows:

How to use the System File Checker tool to troubleshoot missing or corrupted system files on Windows Vista or on Windows 7

I would suggest you to do a system restore to an earlier point of time before the issue occurred.

What is System Restore?

For more protection, use System Restore with Backup and Restore , which is designed to help safeguard email, pictures, documents, and other personal files.

I would suggest you to create a new Administrator user account and check if the issue persists.

Create a user profile.

If the new user profile resolves the issue, you can fix the corrupt profile.

Run as administrator not working in Windows 10

If you are trying to use the Run as administrator context menu option in Windows 10 but find that it is not working or opening the program with administrator privilege, then you may need to carry out a few things.

Run as administrator not working

To fix this Run as administrator not working issue, follow these suggestions:

1. Turn on User Account Control
2. Clean up Contect Menu items
3. Perform SFC & DISM scans
4. Change Group Membership
5. Scan system with anti-malware
6. Troubleshoot in Clean Boot State
7. Create a new Administrator account.

1] Turn on User Account Control

If you try to open software with administrator privilege, the UAC or User Account Control prompt appears, where you need to confirm the permission. However, if you have disabled UAC by mistake or some malware has done it without your consent, you might face this issue. Therefore, verify if the UAC is turned on or not. If not, enable User Account Control and see if this helps.

2]Clean up Context Menu items

Use one of these Context Menu Editor software to remove unwanted context menu items – especially those whch may have been added in the recent past.

3] Perform SFC & DISM scans

If some system file has got corrupted, this issue can occur. So run the System File Checker as well as DISM to repair your OS files.

4] Change Group Membership

Sign in with your administrator account or ask your administrator to do this. If you have a Standard User account, add your account to the Administrators Group.

To do this, search for netplwiz in the taskbar search box and open the result. After that, select your user account and click the Properties button.

Next, go to Group Membership tab > select Administrator > click Apply and OK buttons to save the change.

Then, re-sign into your computer and check if the Run as administrator option is working or not.

5] Scan system with antimalware

Sometimes this problem occurs due to malware. If none of the solutions are working for you, you should install an antimalware software and scan your whole system. There are many free antivirus software such as Bitdefender, Kaspersky, etc., available which can do a good job.

6] Troubleshoot in Clean Boot State

You can troubleshoot in Clean Boot State to see which third-party Service may be causing the issue. A Clean Boot starts a system with minimal drivers and startup programs. When you start the computer in clean boot, the computer starts by using a pre-selected minimal set of drivers and startup programs, and because the computer starts with a minimal set of drivers, some programs may not work as you expected.

7] Create a new Administrator User account

If your standard user account fails to utilize the ‘Run as administrator’ functionality, try to create a new administrator user account and check if you can use the same or not. You need to sign in with your main admin account and then create another admin account and use it.

Missing Option: Run as Administrator

Replies (5) 

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

In Windows 8, right-clicking on a program in the Start screen won’t display Run as administrator option. While Run as administrator option is available when you right-click on a program shortcut on the desktop, the same option doesn’t appear when you right-click on program shortcut in the Start screen. So, how to run a program with administrator rights in Windows 8? Here is how:

Step 1: Switch to the Modern Start screen and start typing the program’s name to see your program under Applications list.

Step 2: Right-click on the program name to see Advanced option.

Step 3: Click on Advanced and then select Run as administrator option.

You can also use the good old hotkey (Ctrl + Shift + Enter) method to run a program with admin rights. That is, for example, type CMD in Start screen and then press Ctrl + Shift + Enter keys to open elevated Command Prompt.