What is the difference between Local Administrator and Machine Administrator?

With our new SharePoint Server 2010 running only on 64bit and Windows 2008 (R2) we as Administrators are having something more to check than it was necessary with Windows 2003.

As a Farm Administrator the login might be MyDomain\SPFarm and you are member of the “Local Administrator” Group of the machine (The SharePoint Server).


You are now logged in as a Local Administrator.

What is now the Machine Administrator?

Short Answer:
You will get the permissions as a Machine Administrator when you start the particular application with Run As Administrator or you configured the UAC (UserAccountControl) in that way to be always also Machine Administrator.

Long Answer:
Enable SharePoint PowerShell Commandlets in the PowerShell ISE

Or create a link (MyPSShell.LNK) with: %windir%\system32\WindowsPowerShell\v1.0\PowerShell_ISE.exe "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\CONFIG\POWERSHELL\Registration\sharepoint.ps1"

If you start the PwerShell ISE by a click you might get the this:
You will be “Only” Local Administrator.

If you start the PowerShell ISE by using Run As Administrator you might get the this:

Now you are also Machine Administrator!

Why I tell you that?

To not see something like this:

New-SPProfileServiceApplication : Access denied.  Only machine administrators are allowed
to create administration service job definitions of type: Microsoft.SharePoint.Administrat
ion.SPServiceApplicationInstanceProvisioningJobDefinition, Microsoft.SharePoint, Version=1, Culture=neutral, PublicKeyToken=71e9bce111e9429c

Comments (4)

  1. Doan Vu says:

    Seem that this post is telling how to be the Machine Administator. It does not really explain what the Machine Administrator is and how it's different from the Local Administrator.

  2. The local administrator you might be when you are able to login to a Server box with Admin rights. To run an application with Machine Admin rights you need to understand what User Account Control settings means. My motivation to write this post was a problem with standard UAC settings and running a powershell script.

  3. DanTheManXX says:

    Hi when you refere to Machine Administrators are your referring to "Built in Administrators" .. I have just seen the same error you describe whilst running ISE as administrator but attempting to run another script with start process  The sp_farm. credential supplied the second script seems to be the current user but does not seem to have the correct  permissions  

  4. First of all; You account must have the right permissions to do that what you want.

    Secondly: You need to start PowerShell in the "Elevated Mode" and that means you will read "Administrator SharePoint PowerShell ISE" in the title, after it starts.