Re: Question regarding microsoft security policy

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 04/20/04 

Date: Tue, 20 Apr 2004 16:53:46 GMT

Microsoft does not consider an application certified for Windows 2000 [or whatever
the term is they use] unless it will function while a user is only a member of the
users group. Of course older applications created before that new standard came out
may not work as you experienced. Your options are to elevate user power, upgrade your
software, lean on the application publisher for how to modify the file
system/registry, or try it yourself with free tools such as filemon and regmon from
SysInternals.

Often elevating a user to power user will solve the problem which is very similar to
what a regular user was in NT4.0. The compatws.inf template will loosen file/registry
permissions to give regular users the same permissions as power users. The best
approach if possible is to loosen only those permissions necessary. If the publisher
will not help, then you can logon to a computer as a regular user and then use runas
with admin credentials to invoke filemon/regmon just before trying to run the
application. Then you can review the log at the point where the application fails due
to "access denied" to a file/folder at which point you will have to modify
permissions and try again. Sometimes it is fairly easy and other times very tedious
but at least worth a try. --- Steve

http://www.sysinternals.com/ntw2k/source/filemon.shtml -- free tools from
SysInternals.

"luc wastiaux" <dustpuppy@airpost.net> wrote in message
news:c62u7e022hh@news1.newsguy.com...
> There are a lot of legacy application for windows that need write access
> in Program Files, forcing you to promote local users to administrators
> or these applications won't work. I'm not pleased at all with this since
> this makes all the binaries in \program files and \winnt virus-writable.
> What is being done in this regard by microsoft ? I wish more application
> developpers became aware that machines are being used by more than one
> user, and writing in \program files is not appropriate.
>
> --
> luc wastiaux

Relevant Pages

  • RE: Error 1402
    ... >Microsoft Corporation ... >>This is a permissions issue that must be fixed through ... >>the Windows operating system. ... >>Do not use the registry key given in the Microsoft ...
    (microsoft.public.windowsxp.security_admin)
  • RE: Computer & Local Profile Migration Trouble
    ... We can adjust registry permissions by using GPO in AD-based domains. ... the Windows 2000 Resource Kit Tools document or run the following command: ... |Subject: RE: Computer & Local Profile Migration Trouble ... Produced By Microsoft MimeOLE V5.50.4910.0300 ...
    (microsoft.public.windows.server.migration)
  • RE: Very, very, very limited security options in SharePoint document l
    ... The mindset of Windows SharePoint Services is that of *team* Web Sites. ... the same permissions" or "everyone has the same except a few administrators". ... Microsoft FrontPage MVP ...
    (microsoft.public.sharepoint.windowsservices)
  • RE: Access 97 runtime on XP
    ... permissions on the following registry keys: ... inherit parent permissions). ... Microsoft Access Support ... Running the SCAN program from the Windows Update site will help ...
    (microsoft.public.access.setupconfig)
  • Re: Norton Antivirus 2005 cannot load on WinXP/Pro for restricted user.
    ... I expected there is properties windows ... Can we change folder permission by command ... > permissions for the installation folder. ... If I used the regular user to login, ...
    (microsoft.public.windowsxp.general)