PoppyDisk User Guide
Administrator access

How administrator access works

What the elevated helper can and cannot do before you grant anything.

When you finish, you can accept or decline Windows' administrator prompt from PoppyDisk knowing exactly what saying yes allows.

PoppyDisk runs without administrator rights

PoppyDisk never asks for administrator rights when it starts, and the app you use is never elevated. That is why an ordinary Scan leaves some folders Restricted: Windows keeps them private from unprivileged programs, and PoppyDisk marks them rather than forcing its way in. See What the sizes mean.

The helper

When you choose to measure Restricted areas, PoppyDisk does not relaunch itself as administrator. It starts a separate, much smaller program, the scan helper, and that is what Windows asks you about.

  • It starts only after you confirm. The prompt follows your Measure or Continue, never a launch, a Scan, or a timer.
  • It measures only what you asked about. The helper is handed the exact Scan root and the exact Restricted paths, and it validates them before it reads anything.
  • It can only measure. The helper has no way to delete, move, or change a file. It reads sizes and hands them back.
  • It talks to PoppyDisk over a private channel. The results stream back over a named pipe that only your account, Administrators, and SYSTEM can open, and nothing is saved to the Drive on the way.
  • It goes away when the measurement ends.
The privilege boundaryOn the left, PoppyDisk runs as you, without administrator rights, and deletes only from there. A dashed boundary separates it from the scan helper on the right, which runs as administrator for one measurement only. Windows asks you before the helper starts. The helper receives the exact Scan root and Restricted paths, returns sizes over a private pipe, can only measure, and ends when the measurement does. Deletion never crosses the boundary.AS YOU, NEVER ELEVATEDPoppyDiskScans, the Disk Map, the Inspector,the Cleanup Basket, and every deletion.Runs with your rights only.DeletionAsks Windows as you. A refusal is reported per item.Deletion never crosses this lineAS ADMINISTRATOR, ONE MEASUREMENTScan helperReads sizes in the paths it was given.Cannot delete, move, or change a file.Ends when the measurement ends.Windows asks you firstthe exact Scan rootand Restricted pathssizes only, over a private pipe(you, Administrators, and SYSTEM)The window you see has no direct access to files or the shell either: every real action crossesa narrow, typed boundary into the Rust core of PoppyDisk, which validates it before calling Windows.
The app runs as you and does every deletion from there. The helper runs as administrator for one measurement, receives only the paths you asked about, and hands back sizes.

Deletion is never elevated

Deleting runs in the unelevated app, always. If Windows refuses to delete an item because it needs administrator rights, PoppyDisk reports that failure for that item and moves on; it never raises its own privileges to get past the refusal. See Read your Recovered Space report. The same principle keeps Protected locations out of the Cleanup Basket entirely. See Understand Risk.

Declining

If you decline the prompt, PoppyDisk says Administrator access wasn’t granted. Nothing changed. and means it: no helper ran, nothing was measured, and the Scan is exactly as it was. See Measure Restricted areas.

The rest of the boundary

The window you see is a web view with no direct access to the filesystem or the shell. Every real action, opening a file, revealing it, showing its properties, deleting, opening Windows Settings, buying, and unlocking, crosses a narrow, typed boundary into PoppyDisk's Rust core, which validates the request before it calls Windows. Demo Mode's synthetic items cannot cross it at all, which is why their Windows actions are disabled. See What PoppyDisk sends and stores.

Data and network

What PoppyDisk sends and stores

Keyboard and screen readers

Use PoppyDisk with a keyboard or a screen reader

On this page

PoppyDisk runs without administrator rightsThe helperDeletion is never elevatedDecliningThe rest of the boundary