I ran every query in this post on MySQL 8.4.6 on 11 October 2026, with the default sql_mode (which includes ONLY_FULL_GROUP_BY), and pasted the real output under each one. Everything below is copy-and-paste ready: create the two tables, insert the rows and run each query in order. If you run your queries from PHP, my guide to PDO fetch() and fetchAll() shows how to read the results back.

The sample tables

The examples use two small tables: students and the subjects they’ve taken, with an optional score. I’ve deliberately included a duplicate (Chloe took Biology twice), a NULL score and a row with a NULL subject, because that’s where GROUP_CONCAT behaves in surprising ways.

CREATE TABLE students (id INT PRIMARY KEY, name VARCHAR(40), class VARCHAR(10));
CREATE TABLE subjects (student_id INT, subject VARCHAR(40), score INT NULL);

INSERT INTO students VALUES
  (1,'Ayesha','10A'), (2,'Ben','10A'), (3,'Chloe','10B'), (4,'Dev','10B');

INSERT INTO subjects VALUES
  (1,'Maths',91), (1,'Physics',84), (1,'English',77),
  (2,'History',68), (2,'Maths',73),
  (3,'Biology',88), (3,'Maths',NULL), (3,'Biology',90),
  (4,NULL,NULL);

Basic GROUP_CONCAT: one row per group

GROUP_CONCAT() is an aggregate function, like COUNT() or SUM(). The MySQL aggregate function reference describes it simply as “return a concatenated string”. You group the rows, and it glues each group’s values together.

SELECT s.name, GROUP_CONCAT(sub.subject) AS subjects
FROM students s
JOIN subjects sub ON sub.student_id = s.id
GROUP BY s.id, s.name
ORDER BY s.id;

+--------+-----------------------+
| name   | subjects              |
+--------+-----------------------+
| Ayesha | Maths,Physics,English |
| Ben    | History,Maths         |
| Chloe  | Biology,Maths,Biology |
| Dev    | NULL                  |
+--------+-----------------------+

Notice three things. The default separator is a comma with no space. The order inside each list isn’t guaranteed; here it happens to follow insertion order, but you shouldn’t rely on that. And Dev’s only subject is NULL, so his whole result is NULL.

GROUP_CONCAT with ORDER BY and SEPARATOR

To control the order of values inside each string, put ORDER BY inside the function call. To change the separator, add SEPARATOR after it. Both are part of GROUP_CONCAT’s own syntax, separate from the query’s outer ORDER BY.

SELECT s.name,
       GROUP_CONCAT(sub.subject ORDER BY sub.subject SEPARATOR ', ') AS subjects
FROM students s
JOIN subjects sub ON sub.student_id = s.id
GROUP BY s.id, s.name
ORDER BY s.id;

+--------+-------------------------+
| name   | subjects                |
+--------+-------------------------+
| Ayesha | English, Maths, Physics |
| Ben    | History, Maths          |
| Chloe  | Biology, Biology, Maths |
| Dev    | NULL                    |
+--------+-------------------------+

The outer ORDER BY s.id sorts the rows of the result. The inner ORDER BY sub.subject sorts the values within each string. You’ll often want both.

Ordering by a different column

The inner ORDER BY doesn’t have to use the column you’re concatenating. Here I list each student’s subjects best score first, with the score in brackets and a pipe as the separator:

SELECT s.name,
       GROUP_CONCAT(CONCAT(sub.subject, ' (', sub.score, ')')
                    ORDER BY sub.score DESC SEPARATOR ' | ') AS best_first
FROM students s
JOIN subjects sub ON sub.student_id = s.id
GROUP BY s.id, s.name
ORDER BY s.id;

+--------+------------------------------------------+
| name   | best_first                               |
+--------+------------------------------------------+
| Ayesha | Maths (91) | Physics (84) | English (77) |
| Ben    | Maths (73) | History (68)                |
| Chloe  | Biology (90) | Biology (88)              |
| Dev    | NULL                                     |
+--------+------------------------------------------+

Look closely at Chloe. Her Maths entry has disappeared. Its score is NULL, CONCAT() returns NULL if any argument is NULL, and GROUP_CONCAT skips NULL values. That leads us to the biggest gotcha.

Why NULL values disappear from GROUP_CONCAT

The MySQL manual states that, unless otherwise stated, aggregate functions ignore NULL values, and GROUP_CONCAT follows that rule. If every value in a group is NULL, the result is NULL rather than an empty string.

SELECT s.name, GROUP_CONCAT(sub.subject) AS subjects, COUNT(*) AS rows_in_group
FROM students s
LEFT JOIN subjects sub ON sub.student_id = s.id
WHERE s.id = 4
GROUP BY s.id, s.name;

+------+----------+---------------+
| name | subjects | rows_in_group |
+------+----------+---------------+
| Dev  | NULL     |             1 |
+------+----------+---------------+

There’s one row in the group, but its subject is NULL, so the concatenated result is NULL. Two fixes:

• Default for the whole result: wrap it in COALESCE(GROUP_CONCAT(sub.subject), 'none'), which returned none for Dev in my test.
• Keep NULL items visible: use COALESCE() or IFNULL() on the value inside, for example GROUP_CONCAT(CONCAT(sub.subject, ' (', COALESCE(sub.score, '-'), ')')), so Chloe’s Maths stays in the list instead of vanishing. In my test that returned Biology (90) | Biology (88) | Maths (-). Note that NULL scores sort last with DESC, which is usually what you want.

GROUP_CONCAT DISTINCT: removing duplicates

Put DISTINCT first inside the brackets to keep only unique values. You can combine it with ORDER BY and SEPARATOR:

SELECT s.name,
       GROUP_CONCAT(DISTINCT sub.subject ORDER BY sub.subject SEPARATOR ', ') AS subjects
FROM students s
JOIN subjects sub ON sub.student_id = s.id
WHERE s.id = 3
GROUP BY s.id, s.name;

+-------+----------------+
| name  | subjects       |
+-------+----------------+
| Chloe | Biology, Maths |
+-------+----------------+

Biology now appears once. If duplicate rows are a symptom of bad data rather than a legitimate repeat, fix the table instead; my post on deleting duplicate rows in MySQL covers safe ways to do that.

Custom separators: no separator, new lines and more

Any string literal works as a separator, including an empty one and escape sequences:

SELECT class,
       GROUP_CONCAT(name ORDER BY name SEPARATOR '')   AS squashed,
       GROUP_CONCAT(name ORDER BY name SEPARATOR '\n') AS one_per_line
FROM students
GROUP BY class;

+-------+-----------+--------------+
| class | squashed  | one_per_line |
+-------+-----------+--------------+
| 10A   | AyeshaBen | Ayesha
Ben   |
| 10B   | ChloeDev  | Chloe
Dev    |
+-------+-----------+--------------+

The new-line version breaks the text table, which is exactly what you want when you’re building a plain-text email or a CSV cell. Other separators I find handy are ' | ' for readable reports and ';' for exporting to spreadsheets that treat commas as column breaks.

The 1024 limit: group_concat_max_len and truncated results

This one causes real bugs in production. GROUP_CONCAT results are capped by the group_concat_max_len system variable. On my MySQL 8.4.6 server, SELECT @@group_concat_max_len; returned 1024. When a result is longer, MySQL cuts it off and raises a warning, but the query still succeeds, so your application never notices.

To demonstrate, I set a tiny limit of 20 bytes:

SET SESSION group_concat_max_len = 20;
SELECT GROUP_CONCAT(name ORDER BY id SEPARATOR ', ') AS names FROM students;
SHOW WARNINGS;

+----------------------+
| names                |
+----------------------+
| Ayesha, Ben, Chloe,  |
+----------------------+
+---------+------+---------------------------------+
| Level   | Code | Message                         |
+---------+------+---------------------------------+
| Warning | 1260 | Row 4 was cut by GROUP_CONCAT() |
+---------+------+---------------------------------+

Dev was silently dropped, and the string even ends with a stray separator. Raising the limit for the session fixes it:

SET SESSION group_concat_max_len = 1000000;
SELECT GROUP_CONCAT(name ORDER BY id SEPARATOR ', ') AS names FROM students;

+-------------------------+
| names                   |
+-------------------------+
| Ayesha, Ben, Chloe, Dev |
+-------------------------+

Practical advice:

• Run SET SESSION group_concat_max_len = ... right after connecting, in the same connection that runs the query. It only lasts for that session.
• If you can’t predict the size, check warnings (warning code 1260) or compare the result length with the limit.
• If the list could be huge, ask whether you need one string at all. Fetching the rows and joining them in PHP or Python is often simpler and has no cut-off.

Top N per group with GROUP_CONCAT

MySQL’s GROUP_CONCAT has no LIMIT clause inside the brackets (MariaDB added one, MySQL hasn’t), so a common trick is to order the list and then keep the first N items with SUBSTRING_INDEX():

SELECT s.name,
       SUBSTRING_INDEX(GROUP_CONCAT(sub.subject ORDER BY sub.score DESC SEPARATOR ','), ',', 2) AS top2
FROM students s
JOIN subjects sub ON sub.student_id = s.id
WHERE s.id = 1
GROUP BY s.id, s.name;

+--------+---------------+
| name   | top2          |
+--------+---------------+
| Ayesha | Maths,Physics |
+--------+---------------+

SUBSTRING_INDEX(str, ',', 2) returns everything before the second comma. It breaks if the values themselves contain your separator, so pick one that can’t appear in the data. For anything more complex, a window function such as ROW_NUMBER() in a subquery is more robust.

GROUP_CONCAT vs JSON_ARRAYAGG

If the result is going to code rather than a human, consider JSON_ARRAYAGG(), which the MySQL manual lists as returning the result set “as a single JSON array”. You get proper quoting for free, so commas inside values can’t break your parsing:

SELECT s.name, JSON_ARRAYAGG(sub.subject) AS subjects_json
FROM students s
JOIN subjects sub ON sub.student_id = s.id
WHERE s.id IN (1, 2)
GROUP BY s.id, s.name
ORDER BY s.id;

+--------+---------------------------------+
| name   | subjects_json                   |
+--------+---------------------------------+
| Ayesha | ["Maths", "Physics", "English"] |
| Ben    | ["History", "Maths"]            |
+--------+---------------------------------+

In PHP you can json_decode() that column straight into an array. The trade-off: JSON_ARRAYAGG doesn’t accept an ORDER BY inside the brackets. When I tried JSON_ARRAYAGG(name ORDER BY name) on MySQL 8.4.6, it failed with syntax error 1064. Use GROUP_CONCAT when the order of items matters, or sort the array in your application code after decoding it.

Error 1055 and ONLY_FULL_GROUP_BY

Because MySQL 8.4 enables ONLY_FULL_GROUP_BY by default, every non-aggregated column in your SELECT must be in the GROUP BY or depend on it. Grouping by the primary key s.id while selecting s.name is fine, since the name depends on the id. But this query fails:

SELECT s.class, s.name, GROUP_CONCAT(sub.subject)
FROM students s
JOIN subjects sub ON sub.student_id = s.id
GROUP BY s.class;

ERROR 1055 (42000): Expression #2 of SELECT list is not in GROUP BY clause and contains
nonaggregated column 'gc_demo.s.name' which is not functionally dependent on columns in
GROUP BY clause; this is incompatible with sql_mode=only_full_group_by

Each class has several names, so MySQL can’t pick one. Either add s.name to the GROUP BY or aggregate it too, for example GROUP_CONCAT(DISTINCT s.name). Don’t switch the SQL mode off to make the error go away; it’s protecting you from random results.

When not to use GROUP_CONCAT

GROUP_CONCAT is brilliant for display: a tag list next to a blog post, a comma-separated list of products in an order summary, or a quick report you paste into a spreadsheet. It’s a poor fit when you need to filter, count or join on the individual values later. Searching inside a concatenated string with LIKE '%Maths%' is slow and matches partial words, and storing comma-separated lists in a column breaks the basic rule of one value per field. Keep the data in proper rows and only concatenate at the very end, in the query that feeds the page.

Using GROUP_CONCAT safely from PHP

If any part of the query comes from user input, such as a class name from a dropdown, bind it with a prepared statement rather than gluing it into the SQL string. My guide to PHP PDO prepared statements shows the pattern. GROUP_CONCAT itself is just another column in the result; you read it with fetch() like any other value and explode(', ', $row['subjects']) if you need an array back.

FAQ

How do I use ORDER BY inside GROUP_CONCAT?

Put it inside the brackets, after the column: GROUP_CONCAT(subject ORDER BY subject ASC). It sorts the values within each concatenated string. The query’s outer ORDER BY sorts the result rows separately.

How do I change the GROUP_CONCAT separator?

Add SEPARATOR as the last part inside the brackets: GROUP_CONCAT(subject SEPARATOR ', '). The default is a comma with no space. Use SEPARATOR '' for no separator or SEPARATOR '\n' for one value per line.

Why is my GROUP_CONCAT result cut off?

It has hit group_concat_max_len, which was 1,024 bytes by default on my MySQL 8.4 server. MySQL truncates the string and raises warning 1260. Run SET SESSION group_concat_max_len = 1000000; before the query.

Why does GROUP_CONCAT return NULL?

Every value in that group was NULL, and aggregate functions ignore NULLs. Wrap the call in COALESCE(GROUP_CONCAT(col), '') to get an empty string or a default label instead.

How do I remove duplicates in GROUP_CONCAT?

Add DISTINCT straight after the opening bracket: GROUP_CONCAT(DISTINCT subject ORDER BY subject SEPARATOR ', ').

Can I limit the number of values in GROUP_CONCAT?

Not with a LIMIT inside the function in MySQL, but you can order the values and keep the first N with SUBSTRING_INDEX(GROUP_CONCAT(col ORDER BY score DESC), ',', N). For complex cases, use ROW_NUMBER() in a subquery.

What is the difference between GROUP_CONCAT and JSON_ARRAYAGG?

GROUP_CONCAT returns a plain string with your chosen separator and supports ORDER BY and DISTINCT inside the call. JSON_ARRAYAGG returns a JSON array with proper quoting, which is safer to parse in code.

Originally published on mfaysal.com.

I'm learning cybersecurity on TryHackMe — follow my progress at tryhackme.com/p/mfaysal.dev.

I kept seeing %windir%, %appdata% and %temp% in Windows security labs and setup guides without really knowing what they were, so I worked through Microsoft’s documentation (checked on 11 October 2026) and wrote down what actually matters. This post covers what the common variables mean, where they come from and how to view or change them safely.

What is an environment variable?

An environment variable is a named piece of text that Windows hands to every program it starts. Each process gets an environment block, a list of NAME=value pairs. Microsoft’s environment variables documentation explains that there are two types, user variables (set for each user) and system variables (set for everyone), and that a child process inherits the environment of its parent by default.

That inheritance is the key idea. When you open Command Prompt from the Start menu, it inherits the environment from Explorer. Any program you start from that Command Prompt inherits it from there. That’s why changing a variable in one window doesn’t magically change it in programs that are already running.

A few more rules from the same page:

• A variable name can’t contain an equals sign (=).
• A user-defined variable can be up to 32,767 characters long.
• Names aren’t case-sensitive on Windows, so %WINDIR%, %windir% and %WinDir% are the same thing.

What %windir% and %SystemRoot% mean

Microsoft’s list of recognised environment variables describes WINDIR as the variable that “refers to the Windows folder located on the system drive” and lists SYSTEMROOT as “same as WINDIR”. Its typical value is C:\Windows.

So why do both exist? Historically, %SystemRoot% belongs to the Windows NT family, while %windir% was already used by the older DOS-based versions of Windows, and both were kept for compatibility. Today they hold the same path on a normal installation, and you’ll see both in Microsoft’s own documentation and registry values. In my experience, %SystemRoot% turns up more in registry paths and service settings, and %windir% more in scripts and Run-box shortcuts.

Useful folders under %windir%:

• %windir%\System32: What’s there: Core 64-bit system programs and libraries (cmd.exe, notepad.exe, most .msc consoles).
• %windir%\SysWOW64: What’s there: 32-bit system files on 64-bit Windows.
• %windir%\System32\drivers\etc: What’s there: The hosts file, which maps names to IP addresses.
• %windir%\Temp: What’s there: Temporary files used by the system and services.
• %windir%\Fonts: What’s there: Installed fonts.
• %windir%\Logs: What’s there: Various Windows log files.

That hosts file comes up a lot in security courses, because malware has historically edited it to redirect websites. It’s protected: you need admin rights to change anything under %windir%.

Common Windows environment variables (list)

These are the variables you’ll meet most often. Typical values are from Microsoft’s recognised variables list and assume Windows is on C: and the user is called mahir.

• %windir% / %SystemRoot%: C:\Windows (system variable).
• %SystemDrive%: C: (a drive, not a folder: no trailing backslash) (system variable).
• %ProgramFiles%: C:\Program Files (system variable).
• %ProgramFiles(x86)%: C:\Program Files (x86) on 64-bit Windows (system variable).
• %ProgramData%: C:\ProgramData (application data for all users) (system variable).
• %ALLUSERSPROFILE%: C:\ProgramData (system variable).
• %USERPROFILE%: C:\Users\mahir (user variable).
• %APPDATA%: C:\Users\mahir\AppData\Roaming (user variable).
• %LOCALAPPDATA%: C:\Users\mahir\AppData\Local (user variable).
• %TEMP% / %TMP%: C:\Users\mahir\AppData\Local\Temp (user variable).
• %USERNAME%: mahir (user variable).
• %COMPUTERNAME%: The PC’s name (system variable).
• %PATH%: A semicolon-separated list of folders (user and system values combined).
• %COMSPEC%: C:\Windows\System32\cmd.exe (system variable).

Roaming vs Local AppData: Microsoft describes %APPDATA% (Roaming) as a common repository for application-specific data, which can roam with a user profile on managed networks, and %LOCALAPPDATA% as the home for local, non-roaming application data. Browser caches and large files usually sit in Local; small settings files often sit in Roaming.

How to use environment variables in Explorer and the Run box

You can type a variable anywhere Windows accepts a path:

1. Press Win + R to open Run.
2. Type %temp% and press Enter. Your temporary files folder opens.
3. Try %appdata%, %userprofile%\Downloads or %windir%\System32\drivers\etc.

Explorer’s address bar works the same way. This is handy when a guide says “delete the app’s folder in AppData”: you don’t have to un-hide anything or know the user name, you just type %appdata%.

Clearing %temp% is a classic safe tidy-up: close your programs, open %temp%, select everything and delete it. Windows will skip any file that’s still in use.

Viewing environment variables in Command Prompt

In Command Prompt (cmd.exe) you read a variable by wrapping its name in percent signs:

C:\> echo %windir%
C:\Windows

C:\> echo %USERPROFILE%
C:\Users\mahir

To see everything, use the built-in set command. Microsoft notes that with no parameters it “displays the current environment variable settings”, and that set with part of a name lists every variable that begins with it:

C:\> set
C:\> set prog
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
ProgramFiles(x86)=C:\Program Files (x86)

The output above is the typical shape; exact values depend on your PC.

One quirk worth knowing: if a variable doesn’t exist, Command Prompt doesn’t show an error. echo %NOSUCHVAR% simply prints %NOSUCHVAR% back at you, percent signs and all. So if you see the raw name in a script’s output, that’s your clue the variable is misspelt or was never set in that window. In a batch file, if defined NOSUCHVAR echo yes is the tidy way to test for it before you use it.

Temporary vs permanent variables: set vs setx

This is where most beginners get caught out.

set is temporary. set MYVAR=hello creates or changes a variable for the current Command Prompt window and the programs started from it. Close the window and it’s gone. Microsoft’s user environment variables page says the same thing: variables created with set “apply only to the command window in which they are set, and to its child processes”.

setx is permanent. Microsoft’s setx documentation says it writes variables “to the master environment in the registry”. By default it sets a user variable; add /m to set a system variable (which needs an elevated prompt).

setx MYVAR "hello"
setx MYVAR "hello" /m

Three setx gotchas, all straight from the docs:

1. It doesn’t affect the current window. “Variables set with setx variables are available in future command windows only, not in the current command window.” Open a new window to see the change.
2. It truncates at 1,024 characters. If you assign more, the content is cropped, and if you were overwriting an existing variable you can lose data.
3. It expands references. If %PATH% contains %JAVADIR% and you rewrite PATH with setx, the reference is replaced with its current value, so later changes to JAVADIR won’t flow through.

Point 2 and point 3 are why you should never run setx PATH "%PATH%;C:\something". On many PCs, PATH is already near or over 1,024 characters, and that command merges the user and system PATH into your user variable while cropping it. Use the graphical editor below instead.

Environment variables in PowerShell: $Env:windir

PowerShell doesn’t use percent signs. According to Microsoft’s about_Environment_Variables page, you use the $Env: prefix:

$Env:windir
# C:\Windows

$Env:Foo = 'An example'   # current session only
Get-ChildItem Env:        # list every variable

Setting $Env:Foo only changes the current PowerShell session, just like set in Command Prompt. The same page notes that environment variable names are case-sensitive on macOS and Linux, unlike on Windows, so $Env:Path and $Env:PATH are different there. That difference bites people who write cross-platform scripts.

How to edit environment variables in Windows 11 and 10

For permanent changes, the graphical editor is the safest route:

1. Press Win, type environment variables and choose Edit the system environment variables (or Edit environment variables for your account for user-only changes).
2. Click Environment Variables….
3. The top list holds your user variables; the bottom list holds system variables.
4. Select a variable and click Edit. For Path, Windows shows one folder per line, so you can add, remove or reorder entries without editing one long string.
5. Click OK in every window, then restart any program that needs the new value.

Behind the scenes, Microsoft documents that system variables live in the registry under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment, and that programs which change them should broadcast a WM_SETTINGCHANGE message so the shell picks up the update. User variables live under HKEY_CURRENT_USER\Environment.

How PATH works (and why order matters)

PATH is the most important variable for anyone who codes. When you type python or git without a full path, Windows searches the current folder and then each folder listed in PATH, in order, for a matching program. The first match wins.

That has two consequences:

• “Not recognised as an internal or external command” usually means the program’s folder isn’t in PATH, or you haven’t opened a new terminal since adding it.
• Order matters for security. If an attacker can write to a folder that appears early in PATH, they can drop a fake python.exe or git.exe there and it will run instead of the real one. Keep user-writable folders out of the system PATH, and check new entries before adding them.

You can see which copy of a program wins with where:

C:\> where python

Environment variables and security: what to look for

Once you know these variables, a lot of security advice makes more sense. Here’s why they keep appearing in labs and incident write-ups.

User-writable folders are where unwanted programs hide. %TEMP%, %APPDATA% and %LOCALAPPDATA% all sit inside your user profile, so any program you run can write there without an admin prompt. That makes them convenient for legitimate apps and for malware alike. When you’re checking a PC for something suspicious, look for unfamiliar .exe files in these folders, especially ones set to start automatically.

Protected folders need elevation. %windir% and %ProgramFiles% are writable only with administrator rights. A program that installs itself there had to get past a UAC prompt (I explain those in what UAC in Windows is), which is a useful clue when you’re working out how something arrived.

Variables are visible to every process you run. Any program started under your account can read your user and system environment variables. They’re fine for configuration, and better than hard-coding secrets in source files, but they aren’t a vault. On a shared PC, don’t store passwords in system variables, and on a server, give each app only the keys it needs.

Scripts should use variables, not hard-coded paths. A script that writes to C:\Users\mahir\Desktop breaks for every other user and on any PC where Windows isn’t on C:. Using %USERPROFILE%\Desktop or %SystemDrive% keeps it portable, and it’s easier to review, because the intent is obvious.

Reading environment variables in code

Environment variables are also how developers keep configuration and secrets out of source code. The same idea runs from a Windows PC up to a cloud host:

import os
print(os.environ.get("WINDIR"))      # C:\Windows on Windows, None on Linux
print(os.environ.get("APPDATA", "not set"))

<?php
echo getenv('windir') ?: 'not on Windows';

Using .get() with a default in Python, or checking getenv()’s false return in PHP, means your script won’t crash on a machine where the variable doesn’t exist. Hosting platforms use the same mechanism for API keys; I used it when setting a Gemini API key on Vercel, so the key never lands in the code repository.

FAQ

What is %windir% in Windows?

%windir% is an environment variable that stores the path of the Windows folder on the system drive, usually C:\Windows. Windows replaces the variable with that path when you use it in the Run box, Explorer, a script or a shortcut.

What is the difference between %windir% and %SystemRoot%?

On a normal installation there’s no difference in value: Microsoft lists SYSTEMROOT as “same as WINDIR”, and both point to the Windows folder. %SystemRoot% comes from the Windows NT line and is common in registry values, while %windir% is older and common in scripts.

Where is %appdata%?

%appdata% points to the Roaming application data folder, typically C:\Users\<username>\AppData\Roaming. %localappdata% points to C:\Users\<username>\AppData\Local. Type either into the Run box to open it.

Is it safe to delete files in %temp%?

Generally yes. %temp% holds temporary files, and Windows won’t let you delete files that are still in use. Close your programs first, then delete what’s left. Don’t delete the Temp folder itself.

What is the difference between set and setx?

set changes a variable only in the current Command Prompt window and its child processes. setx saves the variable permanently in the registry, but the change only appears in new windows, and values longer than 1,024 characters are cropped.

How do I see all environment variables in Windows?

Run set in Command Prompt or Get-ChildItem Env: in PowerShell. For permanent user and system variables, open Edit the system environment variables and click Environment Variables….

Why does my new PATH entry not work?

Programs read their environment when they start, so close and reopen your terminal or editor after editing PATH. Also check the folder you added actually contains the program, and that there isn’t a typo or a stray quote in the entry.

Originally published on mfaysal.com.

I'm learning cybersecurity on TryHackMe — follow my progress at tryhackme.com/p/mfaysal.dev.

I’m learning Windows security alongside web development, and UAC was one of the first things that confused me. Why does an admin account still get asked? Why does the whole screen go dark? Is turning it off a sensible shortcut? This guide answers those questions using Microsoft’s own documentation, checked on 11 October 2026, and avoids the scary jargon where possible.

What UAC actually does

Microsoft describes UAC as a feature that “protects the operating system from unauthorized changes”. When a change needs administrator permission, UAC notifies you and gives you the chance to approve or deny it. The important idea is least privilege: programs only get the rights they need, and only when you agree.

Without UAC, any program you start from an admin account would inherit full control of the machine. A dodgy download, a malicious macro or a compromised browser extension could install drivers, change system files or disable your antivirus without asking. UAC puts a speed bump in that path. Malware still has to trick you into clicking Yes, and that’s a much harder job than running quietly in the background.

UAC also protects itself. Microsoft notes that, unless you disable UAC, malicious software is prevented from disabling or interfering with UAC settings. You need admin rights to change how it behaves.

How UAC works: one account, two access tokens

When you sign in, Windows creates an access token: a small bundle of data that says who you are, which groups you belong to and which privileges you hold. Every program you start carries a copy of that token, and Windows checks it whenever the program tries to open a file, change a setting or talk to another process.

Here’s the clever bit. According to Microsoft’s explanation of how UAC works, when an administrator signs in, Windows creates two tokens:

• A standard user access token, with the administrative privileges and group SIDs removed.
• An administrator access token, with everything.

Windows uses the standard token to start explorer.exe, the desktop shell. Because almost every program you launch is a child of Explorer, they all inherit the standard token too. So your browser, your email client and that random installer all start with ordinary rights, even though your account is technically an admin.

Only when a program asks for admin rights does UAC step in, show a prompt, and (if you agree) start that one program with the full administrator token. Microsoft calls this setup Admin Approval Mode.

Integrity levels

Windows also tags each process with an integrity level, a measure of trust. A disk partitioning tool that changes system data runs at high integrity. A web browser, which handles untrusted content all day, runs at a lower level. A process with a lower integrity level can’t modify a process with a higher one. That’s one reason a compromised browser tab can’t simply reach into an elevated admin tool.

The consent prompt vs the credential prompt

You’ll see one of two prompts, depending on what kind of account you’re using.

• Who sees it: Consent prompt: Members of the Administrators group; Credential prompt: Standard users (by default).
• What it asks: Consent prompt: Click Yes or No; Credential prompt: Type an administrator’s user name and password.
• What happens on Yes: Consent prompt: The app runs with your admin token; Credential prompt: The app runs with that admin account’s token.

The consent prompt is what most home users know, because the first account on a new PC is usually an administrator. The credential prompt appears when you’re signed in as a standard user and something needs admin rights. In that case, typing your own password won’t help; you need the details of an account that’s in the Administrators group.

Microsoft’s own recommendation is that “your primary user account is a standard user”. Running day to day as a standard user means a malicious program can’t even get a Yes-click elevation from you; it needs a password you’d have to type deliberately.

Why the UAC prompt is grey or yellow

The colour of the banner tells you something about the program asking for permission. Before showing the prompt, Windows checks the executable’s digital signature:

• Grey banner: a Windows administrative app, such as a Control Panel item, or a program signed by a verified publisher.
• Yellow banner: the program is unsigned, or it’s signed but not trusted.

A yellow prompt isn’t automatically evil. Plenty of small, legitimate tools are unsigned. But it is a cue to slow down. Ask yourself: did I just start this? Do I know where it came from? Is the program name what I expected? If a yellow prompt appears out of nowhere while you’re browsing, click No.

The shield icon

You’ve probably seen a small blue-and-yellow shield on certain buttons in Windows. It marks an action that needs admin rights. Microsoft’s example is the Date and Time settings: a standard user can change the time zone freely, but changing the system clock itself requires a full administrator token, so that button carries the shield.

The secure desktop: why your screen goes dark

When a UAC prompt appears, the rest of the screen dims and you can’t click anything else. That isn’t just a visual effect. Windows has switched to the secure desktop, a separate desktop that only Windows processes can access.

The point is to stop other programs from tampering with the prompt. On the normal (interactive) desktop, a malicious program could try to send fake mouse clicks to the Yes button, or draw something over the prompt to mislead you. On the secure desktop, ordinary programs simply can’t reach the prompt. Microsoft recommends keeping the Switch to the secure desktop when prompting for elevation policy enabled, and it’s enabled by default. Since Windows Server 2019, you also can’t paste clipboard content onto the secure desktop, and the same applies to supported Windows client versions.

Malware can draw an imitation of the dimmed screen, but Microsoft points out that with the default consent behaviour it doesn’t gain elevation even if you click Yes on the fake. The real risk is a fake credential prompt that harvests a password, which is another reason to only type admin passwords when you started the action yourself.

The four UAC slider levels

To see your current setting, open the Start menu, type UAC and choose Change User Account Control settings. You’ll see a slider with four positions. The descriptions below follow Microsoft’s UAC architecture documentation.

• Always notify: prompts when apps make changes and when you change Windows settings; dims the desktop.
• Notify me only when apps try to make changes (default): prompts for apps but not for your own settings changes; dims the desktop.
• Notify me only when apps try to make changes (do not dim my desktop): same prompts as the default, but no dimming.
• Never notify: no prompts and no dimming.

Always notify is the strictest level. Microsoft suggests it if you often install new software or visit unfamiliar websites. You’ll see more prompts, including when you open built-in admin tools.

The default level prompts when programs try to install software or change your computer, but not when you change Windows settings yourself. It still uses the secure desktop. For most people, this is the right balance.

The “do not dim” level shows the prompt on your normal desktop. Microsoft doesn’t recommend it and says to choose it only if dimming takes a long time on your computer. You lose the secure desktop protection described above.

Never notify doesn’t fully switch UAC off, which surprises many people. The UAC service keeps running, elevation requests from administrators are approved automatically with no prompt, and elevation requests from standard users are automatically denied. Microsoft labels this option “not recommended due to security concerns”.

Where UAC settings live: policies and the registry

The slider is a friendly front end for a set of security policies. On Pro, Enterprise and Education editions you can see them in the Local Security Policy console (secpol.msc) under Security Settings › Local Policies › Security Options; every one starts with “User Account Control:”. Behind those policies are registry values under this key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

These are the values beginners most often run into, with the defaults taken from Microsoft’s UAC settings reference:

• EnableLUA (default 1, enabled): Run all administrators in Admin Approval Mode, the master switch.
• ConsentPromptBehaviorAdmin (default 5): What admins see: 0 = elevate without prompting, 1 = credentials on secure desktop, 2 = consent on secure desktop, 3 = credentials, 4 = consent, 5 = consent for non-Windows binaries.
• ConsentPromptBehaviorUser (default 3): What standard users see: 0 = automatically deny, 1 = credentials on secure desktop, 3 = credentials.
• PromptOnSecureDesktop (default 1, enabled): Show prompts on the secure desktop.
• FilterAdministratorToken (default 0, disabled): Admin Approval Mode for the built-in Administrator account.
• EnableVirtualization (default 1, enabled): Redirect failed writes from old apps to per-user locations.

You can read these safely in PowerShell without changing anything:

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' |
  Select-Object EnableLUA, ConsentPromptBehaviorAdmin, ConsentPromptBehaviorUser, PromptOnSecureDesktop

Notice that the default for admins, value 5, means “prompt for consent for non-Windows binaries”. That’s why some built-in Windows tools open without a prompt at the default slider level, while third-party installers always ask.

The built-in Administrator account is different

Windows has a hidden account literally called Administrator. By default, FilterAdministratorToken is 0, which means that account does not use Admin Approval Mode: it runs every program with full admin rights and no prompts. It’s disabled on normal installs for good reason. If a tutorial tells you to enable it and use it as your daily account, don’t.

File and registry virtualisation

Some older programs assume they could write to protected folders such as C:\Program Files or C:\Windows. Under UAC those writes would fail. To keep such apps working, Windows can quietly redirect the failed writes to per-user locations instead. Microsoft lists the protected locations as %ProgramFiles%, %Windir%, %Windir%\system32 and HKLM\Software.

This is the Virtualize file and registry write failures to per-user locations policy, and it’s on by default. If you’ve ever “saved” a settings file into Program Files and then couldn’t find it later, virtualisation is a likely reason. If those %Windir% style names look unfamiliar, they’re environment variables, a topic I’ll cover separately.

Should you turn UAC off?

No. It’s tempting when an old game or tool keeps prompting, but the trade-off is poor:

• With EnableLUA disabled, every program you start from an admin account runs with full admin rights, which is exactly the situation UAC was built to prevent.
• Microsoft notes that if you disable Admin Approval Mode, Windows Security warns you that the overall security of the operating system is reduced.
• Microsoft also warns that some Universal Windows Platform apps might not work when UAC is fully disabled.

Better fixes for annoying prompts:

1. Right-click › Run as administrator only for the specific tool that needs it.
2. Update or replace old software that writes to protected folders.
3. Use a standard account day to day and keep a separate admin account for installs. The extra password step makes you think before granting power.
4. If you’re a developer, install tools per-user (many installers offer a “just for me” option) so they don’t need elevation.

The same least-privilege thinking applies when you build software: give each part only the access it needs, and handle credentials carefully, for example by hashing passwords properly in PHP rather than storing them as plain text.

UAC is not a security boundary (and why that matters)

If you start reading about Windows security, you’ll come across the term UAC bypass: a technique that gets elevated rights without showing a prompt. In Microsoft’s Windows Security Servicing Criteria, UAC is listed as a security feature, not a security boundary, and Microsoft doesn’t commit to fixing UAC bypasses as security vulnerabilities by default. That’s another strong argument for running as a standard user: there’s nothing to bypass from a standard account if the attacker doesn’t know an admin password.

For a beginner, the practical lesson is simple. UAC reduces risk a lot, but it relies on you. If you click Yes to everything, it can’t help. Read the program name and publisher, and if you didn’t start the action, say no.

How to check UAC is working on your PC

A quick health check you can do in under a minute:

1. Open Change User Account Control settings and confirm the slider is on the default level or higher.
2. Right-click Command Prompt or Terminal and choose Run as administrator. You should see a prompt on a dimmed screen.
3. Run whoami /groups in a normal (non-elevated) window and look for a line containing Mandatory Label\Medium Mandatory Level. In the elevated window, the same command shows High Mandatory Level. That difference is UAC’s split token in action.
4. Open Settings › Accounts › Your info and check whether your everyday account says Administrator. If it does, consider creating a standard account for daily use.

FAQ

What does UAC stand for in Windows?

UAC stands for User Account Control. It’s the Windows feature that runs programs with standard user rights and asks for consent or an administrator password before a program gets full admin privileges.

Why does Windows ask for permission when I’m an administrator?

Because an administrator account gets two access tokens at sign-in. Windows runs your programs with the restricted standard token and only uses the full admin token after you approve a UAC prompt. This is called Admin Approval Mode.

Why does my screen go dark when a UAC prompt appears?

Windows switches to the secure desktop, which only Windows processes can access. Other programs can’t click or draw over the prompt, so malware can’t approve the request for you.

Is it safe to set UAC to Never notify?

No. Microsoft says this level isn’t recommended because of security concerns. Programs started by administrators get elevated automatically without asking, and standard users’ elevation requests are silently denied.

What is the difference between a yellow and a grey UAC prompt?

A grey prompt means the program is a Windows administrative app or is signed by a verified publisher. A yellow prompt means the program is unsigned or its signature isn’t trusted, so take extra care before clicking Yes.

How do I fully disable UAC?

The slider can’t do it; you’d have to disable the “Run all administrators in Admin Approval Mode” policy (the EnableLUA registry value). It isn’t recommended: it removes a key protection and can stop some Windows apps working.

Does UAC protect a standard user account?

Yes. A standard user sees a credential prompt and needs an administrator’s user name and password to elevate. Microsoft recommends using a standard account as your main account for this reason.

Originally published on mfaysal.com.

I'm learning cybersecurity on TryHackMe — follow my progress at tryhackme.com/p/mfaysal.dev.

When I started learning Python, comprehensions looked like a puzzle. Once I learned to read them out loud, they became one of my favourite parts of the language. Every example here was run with Python 3.13, and the output in the comments at the bottom of each block is the real output.

The basic syntax: from a for loop to one line

Here is the same list of squares built two ways:

# The classic loop way
squares = []
for n in range(1, 6):
    squares.append(n * n)
print(squares)

# The same thing as a list comprehension
squares = [n * n for n in range(1, 6)]
print(squares)

# Output:
# [1, 4, 9, 16, 25]
# [1, 4, 9, 16, 25]

The comprehension has three parts inside square brackets:

• The expression (n * n): what goes into the new list.
• The for clause (for n in range(1, 6)): where the items come from.
• An optional condition (if ...): which items to keep.

The trick that helped me is to read it in plain English: "give me n * n for every n in 1 to 5." The result is always a brand new list. The original iterable is not changed.

Filtering with if

Put an if after the for clause and only the items that pass the test make it into the new list. This is the comprehension I write most often, usually to clean data before using it.

marks = [72, 45, 88, 39, 91, 60, 33]

# Keep only the passing marks (40 or more)
passed = [m for m in marks if m >= 40]
print(passed)

# Clean up messy user input: strip spaces, drop empty strings
raw_tags = ["  python ", "", "html", "   ", " css"]
tags = [t.strip().lower() for t in raw_tags if t.strip()]
print(tags)

# Output:
# [72, 45, 88, 91, 60]
# ['python', 'html', 'css']

The second example does two jobs at once. The condition if t.strip() drops strings that are empty or only spaces, because an empty string counts as false. The expression t.strip().lower() then tidies up the ones that are left.

Using if/else in a list comprehension

This is the part that confused me the most. There are two different places a condition can go, and they do different things:

marks = [72, 45, 88, 39, 91]

# if/else goes BEFORE the for, because it decides the value
results = ["pass" if m >= 40 else "fail" for m in marks]
print(results)

# A filter goes AFTER the for, because it decides whether to keep the item
high = [m for m in marks if m >= 80]
print(high)

# Output:
# ['pass', 'pass', 'pass', 'fail', 'pass']
# [88, 91]

• x if condition else y before the for is a conditional expression. It runs for every item and decides what value goes in. The new list is always the same length as the original.
• if condition after the for is a filter. It decides whether an item goes in at all, so the new list can be shorter.

If you write [m for m in marks if m >= 40 else 0], Python raises a SyntaxError, because a filter can't have an else. Move the whole if/else to the front instead.

List comprehension examples with real data

Practice lists of numbers are fine, but most of the time I'm working with a list of dictionaries, such as rows from a CSV file or a JSON response from an API. Comprehensions are great for pulling out exactly the fields you need.

students = [
    {"name": "Rafi", "mark": 72},
    {"name": "Nusrat", "mark": 88},
    {"name": "Tanvir", "mark": 39},
]

names = [s["name"] for s in students]
print(names)

toppers = [s["name"] for s in students if s["mark"] >= 70]
print(toppers)

# Pair two lists together with zip()
subjects = ["Math", "Physics", "Chemistry"]
scores = [81, 67, 74]
report = [f"{sub}: {score}" for sub, score in zip(subjects, scores)]
print(report)

# Output:
# ['Rafi', 'Nusrat', 'Tanvir']
# ['Rafi', 'Nusrat']
# ['Math: 81', 'Physics: 67', 'Chemistry: 74']

The zip() example shows that the for clause can unpack values, just like a normal loop. for sub, score in zip(subjects, scores) walks through both lists side by side. Mixing in an f-string in the expression is a common way to build labels or lines of a report.

Nested list comprehensions

You can use more than one for in a comprehension, and you can put a comprehension inside another one. These are powerful, but they are also where readability goes downhill fast.

grid = [[1, 2, 3], [4, 5, 6], [7, 8, 9]]

# Flatten: read the for clauses left to right, like nested loops
flat = [n for row in grid for n in row]
print(flat)

# Build a 3x4 table of zeros (a list of lists)
table = [[0 for col in range(4)] for row in range(3)]
print(table)

# Transpose rows into columns
columns = [[row[i] for row in grid] for i in range(3)]
print(columns)

# Output:
# [1, 2, 3, 4, 5, 6, 7, 8, 9]
# [[0, 0, 0, 0], [0, 0, 0, 0], [0, 0, 0, 0]]
# [[1, 4, 7], [2, 5, 8], [3, 6, 9]]

For the flatten example, read the for clauses in the same order you would write nested loops: first for row in grid, then for n in row. The table and columns examples are different: there the inner comprehension is the expression, so each item of the outer list is itself a new list.

My rule: if I need more than two for clauses, or a nested comprehension plus a condition, I write a normal loop. Code is read more often than it is written.

Dict comprehensions, set comprehensions and generator expressions

The same syntax works with other brackets. Curly braces with a key: value pair give you a dictionary, and curly braces with a single value give you a set. Round brackets give you a generator expression, which produces values one at a time instead of building a whole list in memory.

words = ["apple", "banana", "avocado", "cherry", "apple"]

# Dict comprehension: word -> length
lengths = {w: len(w) for w in words}
print(lengths)

# Set comprehension: unique first letters
first_letters = {w[0] for w in words}
print(sorted(first_letters))

# Generator expression: no list is built, sum() pulls values one by one
total_chars = sum(len(w) for w in words)
print(total_chars)

# Output:
# {'apple': 5, 'banana': 6, 'avocado': 7, 'cherry': 6}
# ['a', 'b', 'c']
# 29

Notice that "apple" appears twice in the input but only once in the dictionary, because a later key overwrites an earlier one. I sorted the set before printing, since sets have no guaranteed order. When you only need to pass the values into a function like sum(), max(), any() or "".join(), a generator expression is enough, and you can drop the extra brackets.

Bonus: the walrus operator inside a comprehension

Sometimes the filter and the expression need the same calculated value. Since Python 3.8, the assignment expression := lets you compute it once and reuse it:

readings = ["12", "x", "7", "", "30"]

def to_int(text):
    try:
        return int(text)
    except ValueError:
        return None

# := stores the converted value so to_int() runs only once per item
numbers = [n for r in readings if (n := to_int(r)) is not None]
print(numbers)

# Output:
# [12, 7, 30]

Without :=, you would call to_int() twice per item, once in the filter and once in the expression. It's a handy tool, but use it lightly, because it makes the line harder to read for beginners.

Common mistakes with list comprehensions

1. Putting else in the wrong place

As covered above, if alone goes at the end, while if ... else ... goes at the front. When you get a SyntaxError in a comprehension, check this first.

2. Using a comprehension only for its side effects

A comprehension is for building a list. If you only want to do something for each item, like printing or saving to a file, use a normal loop:

names = ["rafi", "nusrat"]

# Don't do this: a list of None values built only for the side effect
result = [print(n.title()) for n in names]
print(result)

# Do this instead
for n in names:
    print(n.title())

# Output:
# Rafi
# Nusrat
# [None, None]
# Rafi
# Nusrat

The first version works, but it also builds a useless list of None values, because print() returns None. Anyone reading it will wonder what result is for.

3. Expecting the loop variable to exist afterwards

In Python 3, a comprehension has its own scope, so its loop variable does not overwrite a variable with the same name outside it:

x = "outer"
values = [x for x in range(3)]
print(values)
print(x)  # the loop variable does not leak out in Python 3

# Output:
# [0, 1, 2]
# outer

This is a good thing, but it means you can't use the loop variable after the comprehension ends, the way you can after a normal for loop.

4. Cramming too much into one line

A comprehension that runs past the edge of the screen, with function calls, conditions and nested loops, is not clever. It's just hard to debug. Split long comprehensions over several lines inside the brackets, or switch to a loop.

5. Building a big list you don't need

sum([x * x for x in range(1_000_000)]) creates a million-item list first. sum(x * x for x in range(1_000_000)) gives the same answer without storing the list.

FAQ

Are list comprehensions faster than for loops?

For simple cases they are usually a bit faster than a loop that calls append(), because there is less work per item. The difference is rarely what matters, though. Choose a comprehension because it's clearer for building a list, not to save microseconds.

Can I use elif in a list comprehension?

There is no elif keyword inside a comprehension, but you can chain conditional expressions: ["A" if m >= 80 else "B" if m >= 60 else "C" for m in marks]. It works, but past two conditions I move the logic into a small function and call that function in the expression.

What's the difference between a list comprehension and map()?

map(func, items) applies a function to every item and returns a lazy iterator. A list comprehension does the same job and can filter at the same time, and many Python developers find it easier to read. Both are fine. I mostly use comprehensions.

Do list comprehensions work with strings and files?

Yes. Any iterable works: strings give you characters, range() gives you numbers, and an open file gives you lines, so [line.strip() for line in f] is a common way to read a file into a clean list.

Conclusion

A list comprehension is a short way to say "build a new list from this iterable, transform each item, and optionally skip some". Start with the basic form, add a filter at the end when you need one, and remember that if/else goes at the front. When a comprehension gets hard to read, a plain loop is always allowed.

The official Python tutorial has a good section on list comprehensions with more examples if you want to go deeper. I'm still learning too, and you can see what I've been building on my projects page.

Originally published at mfaysal.com.

More tutorials: https://mfaysal.com