default printer & multi-users

[Guest]

Hi, we're in the process of changing all our users from 'administrators' to
'limited users'. We have some applications which are not XP certified (they
read registry keys and read / write to folders which are not accessible as a
limited user).

Therefore, we will execute them using "RunAs" so these applications will run
using an administrator account's credentials (we're actually using "RunAsP"
from MAST in order to encrypt the user id and password).

The problem we're facing is that when the user (limited user account) is
changing it's default printer, obviously it is not changing the administrator
account's default printer as well. These applications print reports directly
to the default printer without showing the print dialog box. Therefore, when
the user changes his/her default printer, the application still prints to its
own default printer.

What we'd like to do is, from the application's context (administrator
account), lookup the current limited user's default printer in the registry
and apply it to the administrator account's default printer (in the registry).

In order to do this, we're looking up the "HKEY_USERS\{current limited
user}\Software\Microsoft\Windows NT\Current Version\Windows\Device" key and
setting the "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\Current
Version\Windows\Device" key (which corresponds to the admin account).

Can someone let us know if there is a easier way to do this?

Thanks,

Marc Giguere
Consultant - Obiektum, Inc.

 

[Bruce Sanderson]

Instead of running the applications using Run As, consider applying the
compatws security template.

This template selectively changes some permissions so that non-conforming
applications can work correctly without needing Administrative rights.

To apply a Security Templates:
click Start, Run
key mmc /a
click File, Add/Remove Snap-in
click Add...
select Security Configuration and Analysis (NOT Security Templates)
click Add
click Close
click OK
right click Security Configuration and Analysis, select Open Database
either accept the default location to save your new "Security Database" or
select some convenient place
key any name for your database in the File name: field
click Open
select compatws.inf
right click Security Configuration and Analysis, select Configure Computer
Now...
chose the folder and name you want for the log file; click OK

This will allow most non-conforming (legacy? poorly designed?) applications
to run with ordinary User accounts.

There's more information about this process in Help and Support, search
for - security templates -.

 

[Guest]

Hi Bruce,

Thanks, I will give it a try. This is something I was completely unaware of.
I'll let you know my findings.

Thanks again,

Marc Giguere
Consultant - Obiektum, Inc.