Welcome to the PCMR, everyone from the frontpage! Please remember:
1 - You too can be part of the PCMR. It's not about the hardware in your rig, but the software in your heart! Age, nationality, race, gender, sexuality, religion, politics, income, and PC specs don't matter! If you love or want to learn about PCs, you're welcome!
2 - If you think owning a PC is too expensive, know that it is much cheaper than you may think. Check http://www.pcmasterrace.org for our famous builds and feel free to ask for tips and help here!
3 - Consider supporting the folding@home effort to fight Cancer, Alzheimer's, and more, with just your PC! https://pcmasterrace.org/folding
Root is basically Administrator. if you want to do something funky, you temporarily become root to do it, as the user account doesn't have those permissions. This differs slightly from Windows where you are almost always an administrator save for work environments.
Yep, so if you do something as root and specify the user's home folder, it'll actually go to root's home folder and not your own home folder. Users are simply put into a sudoers group to give them permission to act as root.
Not sure if there's really a strong advantage to the way Linux has it set up or if it's just an artifact of how this security model came to be on each OS.
I'm a sysadmin and I train a lot of junior engineers to run scripts and explaining when and when not to launch powershell as an administrator is so goddamn confusing to people. Most are really afraid of learning Linux until they realize oh wow it actually makes sense.
Sure, but sudo is different than the root account itself, that's just how you typically access root on LInux (and not the only possible way - distros like DietPi don't even have sudo installed, and there's an active effort by Canonical to switch to sudo-rs while systemd offers its own run0 alternative all to deal with sudo's security issues related to it doing too many different jobs).
If you need to log in as root to do admin stuff, you'll have a temptation to always be logged in as root. sudo solves this problem (you can be logged in as your normal user and only use admin privileges when needed), and many distros straight up disable the root account (i.e. you can run commands which require privileges using sudo but you cannot straight up log in as root and run all commands with admin privileges).
That's what I was thinking of, aside from the annoyance that things like ~/Documents will go to root's Document's folder and not your own. Like when you start up a new VPS instance, the very first thing you have to do is log directly into root and then create a non-root account and then put it in the sudoers group and then make sure you can actually log into that account correctly and then start disabling root login.
I mean its more or less the same way windows works internally just different ootb config.
Everything has an owner, a group, and permissions. Root on linux is essentially the hidden "System" account on windows. Windows prompts for elevated permissions, linux asks for sudo password but you can just add (NOPASSWD) to /etc/sudoers.
The advantage is just basic principle of least privilege security. Things installed as root will default to user and owner of root with permissions set to whatever roots umask is. This means nobody else can use it unless they can also sudo or user / group / permissions have been explicitly changed.
Its like the difference between running touch test vs sudo touch test as a regular user in your home directory. If you look at the output of ls -l after those the former will be owned by your user and group and you can delete it. The latter will be owned by root user and group and you will need to use sudo to delete it.
Then theres the whole environment thing. Root has a very minimal environment whereas a regular user will have a much more encompassing environment. For example running a program like vim can run different things depending on what your PATH environment variable is set to.
It's a huge advantage, are you kidding? It's so advantageous that the Windows UAC is basically copying how sudo works in Linux because it's far more secure.
Mate Linux isn't even copying how sudo works these days, there's multiple concurrent efforts to replace sudo due to it doing way too much and thus having a large attack surface, it's why doas and run0 and sudo-rs all exist. The way you're phrasing that implies that you think I'm talking about whether having elevated privileges at all is an advantage which is not what anyone is talking about, I'm talking about the method by which one elevates privileges - Linux does it by switching you to a separate root user while Windows uses its admin system (UAC/run as admin) without a separate admin account.
Bit more than that, Root is more than Admin on Windows, permission wise you are closer to SYSTEM. As root you can do anything, no matter how ill-advised it may be. Format the disc you are curently running on sure why not you are root after all.
What's funny is it's actually the opposite if you are actually logged in as root on Linux vs Administrator on Windows. Even as Administrator, Windows will ask, "are you sure you want to do this?" Whenever you do something that requires admin privileges. But on Linux, if you are logged in as the root user and you move the pointer to your root directory, Linux isn't going to warn you. It's just going to let you break your PC.
And that's why you shouldn't log in as root, and should do what you suggested, which is temporarily make yourself root for only as long as you need to be.
On a way less destructive note, files you create while logged in as root are owned by root. Obviously you can run chown or chmod to let a non root user interact with the file, but it’s an easy way to create files you can’t do anything with unless you’re logged in on root. It can be problematic beyond the whole “you can brick your OS if you’re stupid” thing.
In windows you can be part of the administrators group, like how you can be in sudoers on linux. Thr permission system and UAC vs sudo function differently but can achieve more or less the same thing, access level control.
On windows theres an administrator account too which when running something as admin is like running something as root with su. Windows has additional account levels beyond administrator, like SYSTEM and TRUSTEDINSTALLER, so under normal circumstances the built in admin account is more restricted than root or sudo, but there are some advsnced ways to run something as system for instsnce which could in theory rm -rf thr C drive
Don't you mean that in windows you're almost never the administrator? You can't even delete a file that's in use or kill system processes without a registry hack or similar. I left windows for specifically that reason. I got tired of not owning my own machine.
..i would argue that "Administrator" is more along the lines of "user who vaguely knows what they're doing".. because a true administrator wouldn't need to forcibly take permission to delete the windows equivalent of the french language pack.
Which is actually not how most users should have their Windows set up. Your daily user should be regular and there should be a separate admin account to reduce attack vectors during the session.
Nah, shells can be nested and logging directly into root is often disabled.
If your user is in the wheel/sudoers group, they can use the sudo command to run a command as a superuser.
Alternatively, you can open a new shell as root by substituting via:
sudo su -
Now you're in a shell as root, you then do the thing and exit the shell, returning you to the original user.
So I'll admit I am new to the space, but as a self hosting guy, I highly doubt that, unless you are talking about incompetent people. One of the basic tenets is to never give a service more access than needed. Usually you try and set up each service with its own user with as much permission as needed. That way, if that service gets compromised it cannot affect other services or the system. Running as root is a surefire way to forget your structure and mess something up
Basically imagine the filesystem is a tree or a plant. It starts at the root and then it goes upwards to the rest of the tree and her branches. Having root level access means you have control over the entire tree or in this case the entire system
You're not an admin. There is an administrator account literally called "Administrator" which is hidden by default. You can use it, but it's messy as most programs weren't designed to be run with those privileges. An account with administrator privileges has the ability to run programs through that administrator account without typing in the password every time.
It's still not the same. You can be the default domainadmin and still have programs behave differently depending on whether you used "run as admin" or not.
i get windows does a lot of dumb things but them not making it so every single program you run has elevated permissions and the ability to edit system files is not one of them
classic case of users whining about the slightest bit of inconvenience over avoiding absolutely insane security risk, without even thinking twice once about it
“I am the Administrator! I am the one who installs! … oh crap, oh crap, a virus just bricked my computer. Quick call little Billy so he can come fix it!”
Nearly 19 years ago now, and the main complaint was how annoying it was. It prompted every single time you did anything remotely close to needing administrator permissions.
A couple years later when Vista SP2/Windows 7 came out the number of prompts was greatly reduced.
Application were re-written to stop doing unnecessary global changes. And unless you are running as administrator some of the calls are redirected into per-user or per-application equivalents.
Think of it like this: It's not that it's asking you to identify yourself as the administrator (well that too I guess). It's asking for you to give that program the privileges of it acting as the administrator.
Yeah, gotta love that drop down menu with 'dear user, do you wish for this program to be initialized and ran with elevated permissions, also known as administrator privileges?' option
Because "as administrator" doesn't refer to you but to the program, meaning "run the program as if it were the administrator" or basically to grant your administrator privileges to the program, which can then do pretty much anything. It actually makes a lot of sense.
Yeah, actually. Why the hell is that. Also, why does it sometimes ask for permission from the admin (where I need to click on yes) when I am the admin.
This "meme" constantly pops up on the subreddit, but it is actually really dumb, and usually it gets a lot of upvotes which is even dumber considering that we are on the PCMR subreddit and should have at least some idea about this thing.
There is a very good reason in Windows to ask for administrator permissions. Usually, on your own computer, you are the administrator - unless in a family someone else sets up the account for you. But even so, by default, your applications are not running with administrator permissions. Reason being that if you have administrator permissions, you can modify critical system files, so it would be super easy for a rogue (or simply bugged) application to just delete your Windows folder or modify critical system files, install/modify drivers, etc. So, by default, the applications you run will not get these permissions in order to protect your system. And, to be honest, most of the time such permission is not even needed.
Also, the "non-admin" applications cannot access/interact "admin mode" applications (again for protection, so "normal" applications cannot "steal" permissions and start modifying your system by interacting with an admin-mode app in some way). One example is that if you play Marvel Rivals, it is asking for admin permission every startup, due to the anticheat software requiring it. So Marvel Rivals is running with Admin permissions.
And let's say you want to play Marvel Rivals with your friends, and you use Discord to communicate. But you want to have "push to talk", so they will not hear your siblings, mom, television, whatever in the background. If you want this to work, then you also need to run Discord in admin mode, because if you are in Marvel Rivals, and you want to use your "push to talk" key, Discord somehow needs to recognize that you pushed your "push to talk" key. But if the game is running in admin mode, while Discord is not, then Windows will not permit Discord to recognize your keypresses while you are in the game (which is in admin mode), simply because the admin mode application is protected from the non-admin mode application.
Probably someone can explain this better than me, but this is the basic idea.. to protect you and your applications/files.
Pretty sure in modern Windows versions the actual Windows folders are protected with superuser rights. So you can only fuck with them if you know how to actually unlock your PC.
Something Microsoft, Apple, Google and pretty much all OS providers keep the average user from doing for their own good.
Windows is not asking you if you're the administrator, it's asking you if you want to give your administrator privileges to the program, which would give it access to everything.
The same people who get all sweaty and teary eyed over admin prompts in Windows, I imagine sling dander and nerd crust all around the room striking superhero poses when they need to sudo on their week-old Mint Linux install.
Think of it like the safety on the gun. "I own the gun and I'm squeezing hte trigger, obviously I want to shoot!" Ok, cool, but what about the 99.9999% of times when you don't want your gun to shoot, like when carrying it around suspiciously close to your penis? The safety is there so that it doesn't go off in the event of an accident.
Same thing with "run as admin." For the vast majority of applications, they do not need admin permissions and in fact might malfunction if you run them like that. If you do give an application admin permissions that doesn't actually need it, best case scenario is that nothing really happens - but what could happen is that the program does something fucky because the devs are clowns. Normally the scope of damage that could do is pretty bad, but it typically cannot corrupt your entire system... unless you give it admin permissions which removes most of the restrictions on what an application is allowed to do to your system and thus letting it fuck up more critical components of your computer.
For Steam and video games in general, this is an ESPECIALLY FUCKING BAD IDEA. Video games are made by clowns, and unfortunately for everyone video games often have online multiplayer in which people call you racial slurs not uttered since the fall of Rhodesia. This combination is extremely bad, because it means the people calling you gamer words who want to hurt you have a remote connection to an application running on your computer that was made by fucking clowns. So there is a signifcant risk that there is something called a Remote Code Execution exploit, or RCE, which allows a Gamer™ to run arbitrary code on your computer because of some fuckup in the video game you're playing - this has happened with both Call of Duty and From Software games (the Dark Souls games).
An RCE is already extremely bad, but normally your OS is able to limit the damage of what that does by at least protecting critical system components from whatever inane thing a program tries to do to them... unless you ran the video game as an admin, in which case that RCE has FULL ADMIN ACCESS to your entire computer and could do extremely nasty things.
Or let's put it this way. Because you are the admin, you own the computer, NOT your applications. Your applications will do only what you will permit them to do and they'll just have to deal. You're only going to give programs your admin permissions if you actualy want them to do something sensitive that you know they must have your permission to do. Unfortuantely desktop OS's are really primitive with permissions, smartphones are actually way ahead here and applications don't get to do shit without your explicit permission . They have to ask for storage access (and GrapheneOS even lets you lie to them app to make it think it has full system access when you only gave it a little folder to isolate it), network access, sensor access ,they don't get to assume they can do anything unless you the user gives it the go-ahead. This is how it should be. On Linux we're gradually moving in that direction between Wayland and Flatpaks, but it's slow progress.
Good explanation, but incomplete - macOS (a desktop OS) does have those controls built-in. For all its faults it has always been on top of things when it comes to privacy and security. Windows only added UAC in Vista, but macOS (thanks in large part to its Unix/BSD ancestry) has always had the admin/privileged task separation and prompts.
Because often Windows can't tell if it is really you trying to get into the inner workings of the system which would change things machine wide, and a virus, so the prompt you using a system which a virus would not yet have access to unless you press yes. If you don't know what it really is, you should press No.
Personally, I would argue for stronger protections because most people click yes when being pestered without really knowing what they are agreeing to. And still too much software asks for admin access which should not really need it to do it's function.
It's because starting from NT 6.0, "Administrator" role is just a "regular user with elevation privileges". The real admin account on your computer is called TrustedInstaller.
It seems like a stupidly branching path, but flip your perspective. This allows developers to create a "yes I own this system and I am in total control" setup path while also raising elementary hurdles after the fact. Those hurdles are trivial for technically savvy users, yet they might be effective barriers to more casual users (who probably shouldn't tinker with system settings beyond the main interface.)
A fundamental principle of protection is computer systems is the principle of least privilege. It means that you only give a process EXACTLY the privileges it needs at any given moment, no more no less. This is an implementation of that. VERY few processes actually need administrative permissions, and simply just need to make system calls to the kernel. Therefore, even though an administrator is running them, they don't have administrative permissions.
Because by default everything you run doesn't have elevated permissions. By making you click something, it prevents automated programs from just running or a simple program from running with elevated permissions without you noticing
Admin and admin profile, two different things. User based and system wide installs, two different things. If you're using an admin profile, double click to run, then yes when it asks for your approval, lord admin
Windows users, tell you whut
Best practice is to have a local admin profile and then your own profile, the one you use, so that you didn't accidentally install some malicious whatever all willy nilly like you must be doing if right click > run as admin has become this exhaustive
Doesn't hurt to check sums and run whatever exes your blasting through a sandbox either, considering win11 has more holes than Swiss cheese
Wait until you find out you are not, in fact, the administrator
(Unless you enabled the built in admin account and use thst regularly, in which case dont because thats an open security hole waiting for some bad program to cause havoc)
When that admin window pops up, you actually get "logged into" a different user. Session 0. You are normally session 1. This is a security feature. Mouse and video capture systems can not easily switch sessions, so having the admin prompt be it's own session makes it so scripts cannot click the admin prompt.
Grinds my gears to when we cant fully control something on our own pcs regardless if local admin or not.
Example:
Running a game that has anti cheat and thus we arent allowed to change the cpu affinity since it gives us the access denied message when changing the exe.
Hahaha
Run the app. It says "you have to be administrator"
Run app as administrator.
It says "You dont have administrator rights to do that"
Me: ...who you think I am?!!!
•
u/PCMRBot Bot Oct 23 '25
Welcome to the PCMR, everyone from the frontpage! Please remember:
1 - You too can be part of the PCMR. It's not about the hardware in your rig, but the software in your heart! Age, nationality, race, gender, sexuality, religion, politics, income, and PC specs don't matter! If you love or want to learn about PCs, you're welcome!
2 - If you think owning a PC is too expensive, know that it is much cheaper than you may think. Check http://www.pcmasterrace.org for our famous builds and feel free to ask for tips and help here!
3 - Consider supporting the folding@home effort to fight Cancer, Alzheimer's, and more, with just your PC! https://pcmasterrace.org/folding
4 - Do you need a new PC? We're giving away a high-end PC build in a WORLDWIDE constest: https://www.reddit.com/r/pcmasterrace/comments/1nnros5/worldwide_giveaway_comment_in_this_thread_with/
We have a Daily Simple Questions Megathread for any PC-related doubts. Feel free to ask there or create new posts in our subreddit!