Re: Letting a program run with administrator rights

From: Bruce Chambers (bchambers_at_cable0ne.n3t)
Date: 11/24/05 

Date: Thu, 24 Nov 2005 10:48:34 -0700

Quayle wrote:
> I've worked around the problem in my previous post, but can't solve this one.
>
> Meedio just will not run under the restricted user. The thing is, I can
> choose to run the app as, and type the admin password, but this is not a
> solution I'm happy with. The point is, that one could turn the PC on, and it
> boots and logs on as user:public but runs the app with administrative rights.
> I don't want to type in the admin password every time the comp boots, to be
> able to run that app. I actually have better things to do.

     You may experience some problems if the software was designed for
Win9x/Me, or if it was intended for WinNT/2K/XP, but was improperly
designed. Quite simply, the application doesn't "know" how to handle
individual user profiles with differing security permissions levels, or
the application is designed to make to make changes to "off-limits"
sections of the Windows registry or protected Windows system folders.

     For example, saved data are often stored in a sub-folder under the
application's folder within C:\Program Files - a place where no
inexperienced or limited user should ever have write permissions.

     It may even be that the software requires "write" access to parts
of the registry or protected systems folders/files that are not normally
accessible to regular users. (This *won't* occur if the application is
properly written.) If this does prove to be the case, however, you're
often left with three options: Either grant the necessary users
appropriate higher access privileges (either as Power Users or local
administrators), explicitly grant normal users elevated privileges to
the affected folders and/or part(s) or the registry, or replace the
application with one that was properly designed specifically for
WinNT/2K/XP.

Some Programs Do Not Work If You Log On from Limited Account
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q307091

     Additionally, here are a couple of tips suggested, in a reply to a
different post, by MS-MVP Kent W. England:

"If your game or application works with admin accounts, but not with
limited accounts, you can fix it to allow limited users to access the
program files folder with "change" capability rather than "read" which
is the default.

C:\>cacls "Program Files\appfolder" /e /t /p users:c

where "appfolder" is the folder where the application is installed.

If you wish to undo these changes, then run

C:\>cacls "Program Files\appfolder" /e /t /p users:r

If you still have a problem with running the program or saving
settings on limited accounts, you may need to change permissions on
the registry keys. Run regedit.exe and go to HKLM\Software\vendor\app,
where "vendor\app" is the key that the software vendor used for your
specific program. Change the permissions on this key to allow Users
full control." 

-- 
Bruce Chambers
Help us help you:
http://dts-l.org/goodpost.htm
http://www.catb.org/~esr/faqs/smart-questions.html
You can have peace. Or you can have freedom. Don't ever count on having 
both at once. - RAH

Relevant Pages

  • Re: Sharing Programs between users
    ... Quite simply, the application doesn't "know" how to handle individual user profiles with differing security permissions levels, or the application is designed to make to make changes to "off-limits" sections of the Windows registry or protected Windows system folders. ... "If your game or application works with admin accounts, but not with limited accounts, you can fix it to allow limited users to access the program files folder with "change" capability rather than "read" which is the default. ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Adding a program for a limited user
    ... Quite simply, the application doesn't "know" how to handle individual user profiles with differing security permissions levels, or the application is designed to make to make changes to "off-limits" sections of the Windows registry or protected Windows system folders. ... "If your game or application works with admin accounts, but not with limited accounts, you can fix it to allow limited users to access the program files folder with "change" capability rather than "read" which is the default. ...
    (microsoft.public.windowsxp.newusers)
  • Re: cant run pgms as Lowly User
    ... sections of the Windows registry or protected Windows system folders. ... application's folder within C:\Program Files - a place where no ... inexperienced or limited user should ever have write permissions. ... limited accounts, you can fix it to allow limited users to access the ...
    (microsoft.public.windowsxp.security_admin)
  • Re: How to allow user permissions over system folders
    ... make changes to "off-limits" sections of the registry. ... Start Menu folder and Desktop folder shortcuts from the user profile ... inexperienced or limited user should have write permissions. ... limited accounts, you can fix it to allow limited users to access the ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Admin right for station
    ... unfortunate that we sometimes get responses from people who have nothing ... the registry, maybe you need to hire someone to teach you a few things. ... > inexperienced or limited user should ever have write permissions. ... > limited accounts, you can fix it to allow limited users to access the ...
    (microsoft.public.windowsxp.security_admin)