S
Scott
Flightless Bird
Hi all
Our users have restricted domain user accounts (i.e. no admin rights). So
we use the Run As command from time-to-time for admin tasks, such as running
a defrag. However, since we upgraded from Windows XP SP2 to Windows XP SP3
with all critical hotfixes upto 25-March-2010, logon as a standard domain
user & execute the Run As command, we get the error "windows cannot access
the specified device, path, or file. You may not have the appropriate
permissions to access the item". We can logon as an admin, right-click any
EXE file & Run As fine but this defeats the object & is unnecessary, although
it suggests it's a permissions issue.
We have uninstalled IE8 and Run As works fine for standard domain users but
it's not a practical solution because our company needs IE8 for various
reasons. It seems the Run As command is reliant on Internet Explorer. Is it
anything to do with the "enable memory protection to mitigate online attacks"
option in IE8's Advanced settings? We've searched but cannot find any
related Group Policy setting(s) to disable this option.
We then looked at the Data Execution Protection (DEP) settings in 'Control
Panel > System > Advanced > Performance Settings'. We changed the DEP
setting from "Turn on DEP for essential Windows programs and services only"
to "Turn on DEP for all programs and services except those I select:",
rebooted when prompted and Run As now works fine for standard domain users.
But we are concerned this will cause problems down the line so want to avoid
changing the default DEP setting and even if we did we would need to find a
way to automate this change on 1500+ machines (reg key or GPO?).
Has anyone else encountered this Run As problem and overcome it, if so, how
please?
Thanks
Scott
Our users have restricted domain user accounts (i.e. no admin rights). So
we use the Run As command from time-to-time for admin tasks, such as running
a defrag. However, since we upgraded from Windows XP SP2 to Windows XP SP3
with all critical hotfixes upto 25-March-2010, logon as a standard domain
user & execute the Run As command, we get the error "windows cannot access
the specified device, path, or file. You may not have the appropriate
permissions to access the item". We can logon as an admin, right-click any
EXE file & Run As fine but this defeats the object & is unnecessary, although
it suggests it's a permissions issue.
We have uninstalled IE8 and Run As works fine for standard domain users but
it's not a practical solution because our company needs IE8 for various
reasons. It seems the Run As command is reliant on Internet Explorer. Is it
anything to do with the "enable memory protection to mitigate online attacks"
option in IE8's Advanced settings? We've searched but cannot find any
related Group Policy setting(s) to disable this option.
We then looked at the Data Execution Protection (DEP) settings in 'Control
Panel > System > Advanced > Performance Settings'. We changed the DEP
setting from "Turn on DEP for essential Windows programs and services only"
to "Turn on DEP for all programs and services except those I select:",
rebooted when prompted and Run As now works fine for standard domain users.
But we are concerned this will cause problems down the line so want to avoid
changing the default DEP setting and even if we did we would need to find a
way to automate this change on 1500+ machines (reg key or GPO?).
Has anyone else encountered this Run As problem and overcome it, if so, how
please?
Thanks
Scott