"DropMyRights" slows IE browsing to a crawl

[Gregg Hill]

Hello!

I came across this file
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dncode/html/secure11152004.asp
that reduces an administrator's rights when running applications so that the
normal user rights apply instead of the less secure admin rights. It is
supposed to provide more secure web browsing for users logged in under admin
accounts.

It is recommended to use it while browsing or using email. I gave it a try
and found that it slows web browsing DRASTICALLY. Instead of pages opening
in less than one second, some pages take 15 seconds to load. All browsing is
VERY slow when IE is started using this application. If I start IE from an
un-modified icon, it runs as fast as usual.

Anyone out there have experience running this thing without slowdowns?

My system is XP Pro SP2 with all Critical Updates, P4 2.0GHz, 512MB RAM,
cable modem at 2000/384 speeds.

Thanks!

Gregg Hill

 

[Vanguard]

Hello!

I came across this file
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dncode/html/secure11152004.asp
that reduces an administrator's rights when running applications so
that the normal user rights apply instead of the less secure admin
rights. It is supposed to provide more secure web browsing for users
logged in under admin accounts.

It is recommended to use it while browsing or using email. I gave it a
try and found that it slows web browsing DRASTICALLY. Instead of pages
opening in less than one second, some pages take 15 seconds to load.
All browsing is VERY slow when IE is started using this application.
If I start IE from an un-modified icon, it runs as fast as usual.

Anyone out there have experience running this thing without slowdowns?

My system is XP Pro SP2 with all Critical Updates, P4 2.0GHz, 512MB
RAM, cable modem at 2000/384 speeds.

Thanks!

Gregg Hill

I'm not sure why using RunAs wouldn't work just as well. The idea is
that you run the application under a reduced set of permissions. I
would think the RunAs command could do that, too.

runas /user:<account> program

Just pick an account that exists that has the reduced permissions that
you want, like Guest or one you create that is in the restricted Users
group. I just did this. I created a new account called "baseuser" in
the restricted Users group (because I have the Guest account disabled)
and ran:

runas /user:baseuser "C:\Program Files\Internet
Explorer\iexplore.exe"

The full path is needed (so enclose it in quotes due to the embedded
spaces). The nuisance is using RunAs is that you get prompted for a
password (and RunAs won't work if the password is blank). Once I
executed this and IE showed up, I looked in Task Manager and
iexplore.exe was running under the baseuser account.

Maybe the DropMyRights programs provides additional security but nothing
popped out to me from its code that indicated it was doing much more
than executing the program under a different user group to change what
permissions the program would have when running under that group. The
only advantage is that you don't have to define an actual account so you
can use it to define what permissions the application will have.

 

[Gregg Hill]

Vanguard,

Thank you for you response. I had told someone else about this program
yesterday and when I went to demonstrate it today, it flew just as fast as
opening IE normally. That was from my laptop and not my desktop, which is
where I initially tested it (from the desktop).

The only difference I can see is that my desktop is on my SBS 2003 domain,
while the laptop is only in a workgroup. I'll test it on a few more stations
to see if it slows down on anything else. It actually pegs the CPU on my
desktop at about 98% usage every time I load a web page, then it drops to
near zero. Load another page, peg the CPU.

Gregg Hill