Running programs with Admin-Rights

[Guest]

Hello all,

I have a Synchronization Software to synchronize with Outlook from Motorola
Mobile Phones.
Unfortunately, this software is running only with administative rights on
the client. Of course, I cannot give Admin rights to all users, so I'm
searching for a possiblity to run this software under XP automatically with
administrative rights without giving admin-rights to the user.
Is there any possibility to do this and how can I do this?
We're using XP Prof. SP2 in an AD-Environment.
Thanks in advance!

 

[Shenan Stanley]

I have a Synchronization Software to synchronize with Outlook from
Motorola Mobile Phones.
Unfortunately, this software is running only with administative
rights on the client. Of course, I cannot give Admin rights to all
users, so I'm searching for a possiblity to run this software under
XP automatically with administrative rights without giving
admin-rights to the user.
Is there any possibility to do this and how can I do this?
We're using XP Prof. SP2 in an AD-Environment.

Have you just went in and changed the file/folder permissions as well as
possibly the registry permissions for the specific areas the software needs?
CACLS, XCACLS or SetACL could be used to script it once you discovered what
few things needed to be changed - could be run as part of an install script
for the application or later on all machines, etc.

It's got to be better than running as administrator and/or trying to run one
application as an administrator.

 

[Guest]

The problem seems not to be related to access to folders or files, because
for this folder the user has write access.
I thought there is maybe a script existing to solve this.

 

[Bruce Chambers]

Hello all,

I have a Synchronization Software to synchronize with Outlook from Motorola
Mobile Phones.
Unfortunately, this software is running only with administative rights on
the client. Of course, I cannot give Admin rights to all users, so I'm
searching for a possiblity to run this software under XP automatically with
administrative rights without giving admin-rights to the user.
Is there any possibility to do this and how can I do this?
We're using XP Prof. SP2 in an AD-Environment.
Thanks in advance!

You may experience some problems if the software was designed for
Win9x/Me, or if it was intended for WinNT/2K/XP, but was improperly
designed. Quite simply, the application doesn't "know" how to handle
individual user profiles with differing security permissions levels, or
the application is designed to make to make changes to "off-limits"
sections of the Windows registry or protected Windows system folders.

For example, saved data are often stored in a sub-folder under the
application's folder within C:\Program Files - a place where no
inexperienced or limited user should ever have write permissions. (Games
are particularly likely to follow this horrible practice.)

It may even be that the software requires "write" access to parts
of the registry or protected systems folders/files that are not normally
accessible to regular users. (This *won't* occur if the application is
properly written.) If this does prove to be the case, however, you're
often left with three options: Either grant the necessary users
appropriate higher access privileges (either as Power Users or local
administrators), explicitly grant normal users elevated privileges to
the affected folders and/or part(s) or the registry, or replace the
application with one that was properly designed specifically for
WinNT/2K/XP.

Some Programs Do Not Work If You Log On from Limited Account
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q307091

Additionally, here are a couple of tips suggested, in a reply to a
different post, by MS-MVP Kent W. England:

"If your game or application works with admin accounts, but not with
limited accounts, you can fix it to allow limited users to access the
program files folder with "change" capability rather than "read" which
is the default.

C:\>cacls "Program Files\appfolder" /e /t /p users:c

where "appfolder" is the folder where the application is installed.

If you wish to undo these changes, then run

C:\>cacls "Program Files\appfolder" /e /t /p users:r

If you still have a problem with running the program or saving settings
on limited accounts, you may need to change permissions on the registry
keys. Run regedit.exe and go to HKLM\Software\vendor\app, where
"vendor\app" is the key that the software vendor used for your specific
program. Change the permissions on this key to allow Users full control."


--

Bruce Chambers

Help us help you:



They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. -Benjamin Franklin

Many people would rather die than think; in fact, most do. -Bertrand Russell

 

[Guest]

Bruce, I know and I already told Motorola that this shows really poor
programming. The problem is how to find out where the software needs access.
To the folder down under C:\Program Files the normal user has already write
permission.
The easiest for me would be simple script or tool to start this software
with an admin-account.

 

[Shenan Stanley]

Bruce, I know and I already told Motorola that this shows really
poor programming. The problem is how to find out where the software
needs access. To the folder down under C:\Program Files the normal
user has already write permission.
The easiest for me would be simple script or tool to start this
software with an admin-account.

 

[Shenan Stanley]

I have a Synchronization Software to synchronize with Outlook from
Motorola Mobile Phones.
Unfortunately, this software is running only with administative
rights on the client. Of course, I cannot give Admin rights to all
users, so I'm searching for a possiblity to run this software
under XP automatically with administrative rights without giving
admin-rights to the user.
Is there any possibility to do this and how can I do this?
We're using XP Prof. SP2 in an AD-Environment.

Have you just went in and changed the file/folder permissions as
well as possibly the registry permissions for the specific areas
the software needs? CACLS, XCACLS or SetACL could be used to
script it once you discovered what few things needed to be changed
- could be run as part of an install script for the application or
later on all machines, etc.

It's got to be better than running as administrator and/or trying
to run one application as an administrator.

The problem seems not to be related to access to folders or files,
because for this folder the user has write access.
I thought there is maybe a script existing to solve this.

Nope. This is something many system administrators have to go through
everywhere. Badly written sofdtware they must make run without jeapordizing
their security/maintenace - but without hurting productivity either.

Use Sysinternal Tools like RegMon and FileMon to figure out what it needs.

Again - it is usually a combination of file and registry settings it needs -
nothing more. Sometimes it needs modify (not just write) to a certain
directory - sometimes even a certain file in a location (like
c:\windows\something.ini or c:\documents and settings\all users\...) that
you might not have even known was there or would have suspected it needing.
Other times it is some place in the registry - for nothing more than
one-time writing (first time someone uses it.)

Running it as an administrator may seem like an easy-out. It usually is
not.