runas and registry/profile access problem ...

[urba]

Can anyone help me with the problem I am having with runas?
I have a software that needs admin right, but my school does not allow
add my staff into administrator group. Runas will not work since I have
to create a seperate account (admin) and give it to my staff.

Thanks in advance.

 

[gonz]

Why don't you create a script that calls runas using encrypted
password?
I think a product like runas professional will do it. I don't remember
the site, but I am sure you can google it.

 

[gonz]

thanks. I think encrypting password will prevent my staff from logging
in using admin account. but I have a problem with runas itself.
I hope my explanation makes sense . Once launched by runas, the
application stores registry settings and data in admin's profile
instead of each user's profile. Users cannot access stored files (under
admin account profile) using windows explorer. Also, multiple users
share one PC in my school and in this case, all of them share the same
account (admin account) to runas application. I think one person may
overwrite other person's data or change preferences that may create a
confusion. The security issue is another concern. I cannot track who
did what since all users share the same account.

Is there a way to solve this problem?

 

[urba]

thanks. but it still won't solve my problem.
my staff share one PC. If the application is launched by runas using
same admin account w/ encrypted password, it will use the same registry
and profile. In this scenario, all users will share the same account's
profile (registry and documents folder, etc). I think it may cause a
problem since one can overwrite other person's document. also,
preference settings can be changed by other users. In addition, they
cannot copy or move files saved by application (launched using runas -
admin account) using windows explorer.

Is there a solution (for windows) that can elevate regular user
privilege for one application (maybe like unix sudo command - not 100%
sure)? I needs my staff to be able to execute one application with
their account (not other admin account) so that they can access their
files or something like that.

 

[gonz]

I think you can use sudoers which can be downloaded from
www.download.com
(http://www.download.com/Sudoers/3000-2094_4-10498499.html?tag=lst-0-1).
You may need to search for sudoers if this link does not work.

Sudoers works like runas although it does not require admin account.
One thing I noticed is that regular users must be in a local group
called "Sudoers Group", and they need to authenticate everything they
launch applications through sudoers.