Posey's Tips & Tricks
How To Run Universal Apps While Logged in as an Administrator
While the cause to run universal apps logged in as an admin may never come up, it's now possible to do this in Windows 10.
Conventional wisdom has long held that you should avoid logging in as an administrator unless you have no other choice. Using a conventional user account limits the damage that could potentially be done if your account were to be compromised or exploited by malware. Even so, administrative accounts exist for a reason. Even if you don't use administrative accounts on a daily basis, they are periodically needed.
Enter one of my big Windows 10 pet peeves. Microsoft will not allow you to run universal apps while logged in as an administrator. I realize that security is important, and that it's a bad idea for an administrator to be downloading apps from the app store, but what about the built-in apps? Why is it OK for an administrator to run desktop apps, but not universal apps?
Incidentally, Windows 8 had a similar limitation in that Microsoft did not allow Modern apps (also known as Windows Store apps or "Metro" apps) to be run while logged in as an administrator. Since this limitation has been around for a long time, you may be wondering why I am just now writing about it. The reason is simple. In Windows 8, the fact that you couldn't run Modern apps while logged in as an administrator wasn't usually a big deal (at least it wasn't for me, I don't want to speak for anyone else). I honestly can't think of one single situation in which I had a legitimate need to run a Modern app in Windows 8 while logged in as an administrator. In fact, I hardly ever used Modern apps in Windows 8 at all. Almost every app that I used was a desktop app.
Things are a little bit different in Windows 10. In Windows 10, there is a possibility that you may really need to run a universal app while logged in as an administrator. The Edge browser, for example, is a universal app.
OK, time for a quick reality check. I'm sure that some of you have already begun composing e-mail messages to tell me that you should never use a browser while logged in as an administrator, or that Windows 10 includes Internet Explorer (which is still a desktop app), or that the Edge browser is garbage and that anybody with any common sense uses <insert the name of your favorite browser here>. Believe me, I get it. But let's declare a temporary cease fire, and put the browser wars to rest for a moment so that we can focus on the real issue.
The key takeaway is that universal apps are going to be Microsoft's preferred type of app going forward. Not being able to run universal apps while logged in as an administrator might not be a big issue for you today, but it could be down the road. There may eventually come a day when not being able to run universal apps while logged in as an administrator becomes a barrier to performing an important administrative task.
Microsoft has provided its customers with a way of running universal apps while logged in as an administrator. Keep in mind that I am not recommending that you apply this workaround indiscriminately. After all, it is always important to think about security, and about the implications of doing anything that could weaken security. If, however, you find that you legitimately need to run a universal app while logged in as an administrator, then there is a way to do so.
To allow the Administrator account to run universal apps, you will need to modify the system's local security policy. To do so, open the Local Group Policy Editor, and navigate through the console tree to Computer Configuration | Windows Settings | Security Settings | Local Policies | Security Options. Now, enable the policy setting named User Account Control: Admin Approval Mode for the Built-in Administrator account. You can see what this setting looks like in Figure 1.
[Click on image for larger view.] Figure 1. Enable this policy setting to allow the built-in administrator account to run universal apps.
As you look at the figure above, you will notice that the policy setting pertains to User Account Control. Consequently, you must have User Account Control enabled in order to access universal apps while logged in as an administrator.
As previously noted, you should not allow the administrator account to run universal apps unless you have a compelling reason to do so. If you do enable this capability, then it is a good idea to disable access once you have finished with whatever you are working on.
About the Author
Brien Posey is a 22-time Microsoft MVP with decades of IT experience. As a freelance writer, Posey has written thousands of articles and contributed to several dozen books on a wide variety of IT topics. Prior to going freelance, Posey was a CIO for a national chain of hospitals and health care facilities. He has also served as a network administrator for some of the country's largest insurance companies and for the Department of Defense at Fort Knox. In addition to his continued work in IT, Posey has spent the last several years actively training as a commercial scientist-astronaut candidate in preparation to fly on a mission to study polar mesospheric clouds from space. You can follow his spaceflight training on his Web site.