Proper Security Procedure for Running non-installed EXE

[Guest]

Hello all,

I have an application that was built in VB6 and I need this to run on
Windows 2003 Terminal Services, sp1. Our TS is properly configured and is
running great with the exception of this application. The program runs
perfectly fine under an 'admin' account, but receives errors under a regular
TS user account. The application is simply an executable and has no
installation (setup) or MSI file to install it. It places no registry
entries.

Are there specific steps and/or methods for configuring security for a
program like this?

I have given the user group Full Control permissons to the folder and files
where this app lives and have reduced the server to 'Relaxed Security'.
Nothing seems to work.

 

[Guest]

Note that running Regmon reveals that it cannot find registry keys. I have a
feeling that the program will not run properly for Users if there is no MSI
or setup.exe that places codes into the registry. So far the only advice I
have gotten from anyone is to run the two utilities - Regmon and FileMon...
and no real good information. Doesn't help me fix the problem.

Can anyone confirm that this might be the case?

 

[Guest]

Do a quick test with a test user and give them full control of the registry
and see if that fixex the problem. After that you can work your way down the
hives and pinpoint the one you need. Did fallow the lockdown white paper from
Microsoft? Maybe your policy is too tight

Have fun!!!

 

[Guest]

When I tried this, I corrupted the test users' account. Loading TS client
brings up a blank blue screen and fires no logon script or anything. This
server is a new server on an existing NT 4.0 domain with 2000 servers as
well. Perhaps this is a lost cause with the security.

 

[Guest]

FYI - To all those who are trying to troubleshoot this problem. When I tried
to follow the advice of creating a test account and granting this account
Full Control of the registry, it corrupted the registry on that server. I
had to rebuild my server last night... that's a few hours of my life I won't
get back.

 

[Guest]

I would NOT recommend this method. Instead I'd recommend running regmon &
filemon at the console and logon to a session as a non-admin user then look
at the regmon & filemon logs when the app is launched. This should tell you
what file/registry permissions non-admins need.