Run as Administrator on a limited account

[Guest]

Hi

I have a couple of limited accounts besides my administrator account on my PC with XP Pro

I have a program that requires administrator privileges to run, but I dont want to give the other users my admin passwords so then can use the run as... command

Is there any way to let this users run this program with administrator privileges without even knowing they are doing it (so their accounts behave as the admin account just while they are running this program)

Thanks for your hel

 

[Bruce Chambers]

Greetings --

This is quite common if the software was designed for Win9x/Me, or
if it was intended for WinNT/2K/XP, but was improperly designed. Quite
simply, the installation routine for this application doesn't "know"
how to handle individual user profiles, or the application tries to
make changes to "off-limits" sections of the registry. Quite often,
you can make this software available to other users by _copying_ the
Start Menu folder and Desktop folder shortcuts from the user profile
from which the software was installed in the corresponding folders in
the user profile(s) in which you'd like the software to be accessible.
If the application is something that can/should be made available to
all current and future users, copying the shortcuts into the
corresponding locations of the All Users profile will do the trick.

NOTE: This may not work if the software requires access to parts
of the hard drive and/or registry that are not normally accessible to
regular users. (This won't occur if the application was properly
written.) If this does prove to be the case, however, you're left
with two options: Either grant the necessary users appropriate higher
access privileges (either as Power Users or local administrators), or
replace the application with one that was properly designed
specifically for WinNT/2K/XP.

Some Programs Do Not Work If You Log On from Limited Account
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q307091

Additionally, here are a couple of tips suggested, in a reply to a
different post, by MS-MVP Kent W. England:

"If your game or application works with admin accounts, but not with
limited accounts, you can fix it to allow limited users to access the
program files folder with "change" capability rather than "read" which
is the default.

C:\>cacls "Program Files\appfolder" /e /t /p users:c

where "appfolder" is the folder where the application is installed.

If you wish to undo these changes, then run

C:\>cacls "Program Files\appfolder" /e /t /p users:r

If you still have a problem with running the program or saving
settings on limited accounts, you may need to change permissions on
the registry keys. Run regedit.exe and go to HKLM\Software\vendor\app,
where "vendor\app" is the key that the software vendor used for your
specific program. Change the permissions on this key to allow Users
full control."


Bruce Chambers

--
Help us help you:




You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[*Vanguard*]

Matador said in news:[email protected]:

Hi,

I have a couple of limited accounts besides my administrator account
on my PC with XP Pro.

I have a program that requires administrator privileges to run, but I
dont want to give the other users my admin passwords so then can use
the run as... command.

Is there any way to let this users run this program with
administrator privileges without even knowing they are doing it (so
their accounts behave as the admin account just while they are
running this program)?

Thanks for your help

I haven't tried this but did some probing in the Group Policy Editor
(gpedit.msc); the local security policy editor (secpol.msc) would have
worked, too, since I'm not on a domain for the host I was checking at the
time. Under the tree node:

Computer Configuration
Security Settings
Software Restriction Policies

I don't think anything was listed under that node so it looked like a
useless definition. I right-clicked on that node, was told there were no
policies were in place, and opted to create them. Kerplunk, a whole bunch
of subkeys appeared one of which is titled "Additional Rules". Looking in
there is where it seems you define paths (to applications) that you can let
users run while disregarding security policies (based on account type). A
little bit of research at http://support.microsoft.com/ for Windows XP on
"software restriction policies additional rules" yielded:

Description of the Software Restriction Policies in Windows XP
http://support.microsoft.com/?kbid=310791

Sounds like a huge hole in security. Since this must-run-as-administrator
program - and which accessible to limited users - probably lets them delete,
move, rename, or edit files using its File menu, you will end up giving
limited users the same rights as administrator.