• Welcome to Tux Reports: Where Penguins Fly. We hope you find the topics varied, interesting, and worthy of your time. Please become a member and join in the discussions.

Run a particular application with admin privilege

J

JohnSmith1

Flightless Bird
Hi,

How can I make sure that a limited user account can start a particular
application with admin prievelege without providing any admin username and
password?

Around ten users, who have limited account, need to run application for
their job but if the application is not run with admin privielege then it
does not let the user to benefit from all available options. I don't want to
elevate their account to power user or administrator and don't want to
provide them with admininstarot password either.

Any idea how to resolve this isssue?

thanks.
 
J

John John - MVP

Flightless Bird
JohnSmith1 wrote:
> Hi,
>
> How can I make sure that a limited user account can start a particular
> application with admin prievelege without providing any admin username and
> password?
>
> Around ten users, who have limited account, need to run application for
> their job but if the application is not run with admin privielege then it
> does not let the user to benefit from all available options. I don't want to
> elevate their account to power user or administrator and don't want to
> provide them with admininstarot password either.
>
> Any idea how to resolve this isssue?


You will have to use third party tools, use one that encrypts the
password or else it will be available for all to see if they take a peek
at your script or batch file. Some suggestions:

http://www.softtreetech.com/24x7/archive/53.htm
http://www.schwietz.org/runadminbat/en/

John
 
P

Pegasus [MVP]

Flightless Bird
"JohnSmith1" <JohnSmith1@discussions.microsoft.com> wrote in message
news:4F25CE72-4A6D-43EC-A1AB-88D99817841C@microsoft.com...
> Hi,
>
> How can I make sure that a limited user account can start a particular
> application with admin prievelege without providing any admin username and
> password?
>
> Around ten users, who have limited account, need to run application for
> their job but if the application is not run with admin privielege then it
> does not let the user to benefit from all available options. I don't want
> to
> elevate their account to power user or administrator and don't want to
> provide them with admininstarot password either.
>
> Any idea how to resolve this isssue?
>
> thanks.


You could use one of the many "runas" tools, e.g. CPAU from
http://www.joeware.net/win/free/tools/cpau.htm. However, you need to be
aware that a computer-savvy user can use your process to run his own stuff
with elevated privileges, e.g.
- By substituting his own program for the one that you want him to use
- By working out how you supply the password to "runas" and using it for his
own program.
 
S

spamlet

Flightless Bird
"Pegasus [MVP]" <news@microsoft.com> wrote in message
news:uw2FMfRxKHA.2644@TK2MSFTNGP04.phx.gbl...
>
>
> "JohnSmith1" <JohnSmith1@discussions.microsoft.com> wrote in message
> news:4F25CE72-4A6D-43EC-A1AB-88D99817841C@microsoft.com...
>> Hi,
>>
>> How can I make sure that a limited user account can start a particular
>> application with admin prievelege without providing any admin username
>> and
>> password?
>>
>> Around ten users, who have limited account, need to run application for
>> their job but if the application is not run with admin privielege then it
>> does not let the user to benefit from all available options. I don't want
>> to
>> elevate their account to power user or administrator and don't want to
>> provide them with admininstarot password either.
>>
>> Any idea how to resolve this isssue?
>>
>> thanks.

>
> You could use one of the many "runas" tools, e.g. CPAU from
> http://www.joeware.net/win/free/tools/cpau.htm. However, you need to be
> aware that a computer-savvy user can use your process to run his own stuff
> with elevated privileges, e.g.
> - By substituting his own program for the one that you want him to use
> - By working out how you supply the password to "runas" and using it for
> his own program.


Couldn't he just add all 'users' to the permissions tab of the prog in
question - which would require turning off simple file sharing in XP, and if
using XPHome, getting access to the tabs in safe mode.

I say this because we had a similar problem with an HP all in one, that only
administrators could use. This was because HP had set the permissions at
the factory, but because we were using 'simple' file sharing we could not
see the permissions tabs and so did not understand why 'users' were being
denied access. Once we had access to the tabs, we could give the necessary
permissions. (That said I find the whole subject fiddly and am often
refused access to things that I have set up as network shares!)

S
 
B

Bruce Chambers

Flightless Bird
JohnSmith1 wrote:
> Hi,
>
> How can I make sure that a limited user account can start a particular
> application with admin prievelege without providing any admin username and
> password?
>
> Around ten users, who have limited account, need to run application for
> their job but if the application is not run with admin privielege then it
> does not let the user to benefit from all available options. I don't want to
> elevate their account to power user or administrator and don't want to
> provide them with admininstarot password either.
>
> Any idea how to resolve this isssue?
>
> thanks.



The best way to resolve the problem would be to replace the application
with a version that is actually WinXP-compatible. Then you won't need
to compromise security for the sake of using yhis legacy application.


--

Bruce Chambers

Help us help you:
http://www.catb.org/~esr/faqs/smart-questions.html

http://support.microsoft.com/default.aspx/kb/555375

They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. ~Benjamin Franklin

Many people would rather die than think; in fact, most do. ~Bertrand Russell

The philosopher has never killed any priests, whereas the priest has
killed a great many philosophers.
~ Denis Diderot
 
L

LD55ZRA

Flightless Bird
Have you tried installing to a folder that is "Shared" over the network? I
used to do this when using Netscape version 4.80 (very old program), and
some DOS compilers and some DOS applications.

If you want it I can post step by instructions to implement this but I
suspect you know what I mean by Shared over the network. The Shared folder
has to be Read/Write Access by all. So only this folder is prone to attack
nothing else.

hth

"JohnSmith1" <JohnSmith1@discussions.microsoft.com> wrote in message
news:4F25CE72-4A6D-43EC-A1AB-88D99817841C@microsoft.com...
> Hi,
>
> How can I make sure that a limited user account can start a particular
> application with admin prievelege without providing any admin username and
> password?
>
> Around ten users, who have limited account, need to run application for
> their job but if the application is not run with admin privielege then it
> does not let the user to benefit from all available options. I don't want
> to
> elevate their account to power user or administrator and don't want to
> provide them with admininstarot password either.
>
> Any idea how to resolve this isssue?
>
> thanks.
 
Top