5

I've notepad++ stuck in Administrator mode: stuck in Administrator

Debug info:

Notepad++ v7.9.1 (64-bit)
Build time : Nov 2 2020 - 01:07:46
Path : C:\Program Files\Notepad++\notepad++.exe
Admin mode : ON
Local Conf mode : OFF
OS Name : Windows 10 Enterprise (64-bit)
OS Version : 1809
OS Build : 17763.1518
Current ANSI codepage : 1252
Plugins : mimeTools.dll NppConverter.dll NppExport.dll

How it happened:

  1. installed notepad++
  2. launched it
  3. installed two plugins (xml tools and xml treeview) while connected to a VPN
  4. download filed due to VPN
  5. stopped the VPN and installed the plugins again
  6. closed and re-opened notepad++
  7. is now stuck in administrator mode (no UAC prompt)

What I tried:

  1. uninstalling and reinstalling;
  2. uninstalling, cleaning all regkeys(*) that I found for notepad++, reinstalling;
  3. uninstalling, installing different versions (different builds/bit);
  4. checked these keys for runas command:
    • HKEY_CLASSES_ROOT\Applications\notepad++.exe --> runas not present
    • HKEY_CURRENT_USER\Software\Classes\Applications\notepad++.ex --> runas not present
  5. everything in this thread;
  6. everything in this other thread.

Nothing worked.

(*) "Suspicious" regkeys:

  • HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatability Assistant\Store
  • HKU<my-user-sid>\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatability Assistant\Store

The clue: renaming the executable "notepad++.exe" to "_notepad++.exe" or "notepad++_test.exe" solves the problem entirely and can run it as a normal user.

I suspect that there is a list of "names" that Windows uses to just run something as an Administrator but can't find it anywhere.
Also renaming the installer and running it shows the UAC prompt, with the original name it starts as Administrator without prompting anything.

Any tips/hint?

Thank you in advance!

Zenigata
  • 151
  • 3
  • Just to verify, if you rename the exe back and you run it, the problem comes back, right? – LPChip Nov 27 '20 at 11:37
  • What is your UAC level set to in Windows? – spikey_richie Nov 27 '20 at 11:55
  • @LPChip: yes, exactly as you described. Tried renaming another program to "notepad++.exe" but it started normally. – Zenigata Nov 27 '20 at 12:35
  • @spikey_richie: is set at its max level "Always notify" (I've it in Italian and that's my translation). Indeed when running other programs that needs admin rights the UAC prompt popup. The Notepad++ installer comes up in "Administrator" mode too and without UAC, if I rename the installer the UAC prompt pops up. – Zenigata Nov 27 '20 at 12:37
  • Do you see anything suspicious in the "virtual stores" `HKCU\Software\Classes\VirtualStore\MACHINE` and `%USERPROFILE%\AppData\Local\VirtualStore`? – Wolf Jan 28 '21 at 11:07
  • @Wolf nothing, there are some entries about other software but totally unrelated to notepad++. Thank you for the suggestion though. – Zenigata Jan 29 '21 at 17:12

0 Answers0