Run as In Windows 2003

[Guest todd]

Is there away that i can make a program always run in administrator With out

asking. I have one program that can only run under administrator. The

people that need to get it, i do not want to have administrator rights. And

i

do not want to give them the password to the administrator account.

[Guest Andrew Meador]

Re: Run as In Windows 2003

 

Re: Run as In Windows 2003

 

On Jan 14, 10:26 am, todd <t...@discussions.microsoft.com> wrote:

> Is there away that i can make a program always run in administrator With out

> asking.  I have one program that can only run under administrator.  The

> people that need to get it, i do not want to have administrator rights.  And

> i

> do not want to give them the password to the administrator account.

 

I do not know the security risk of doing this (as I don't know how

how or where the password is stored) but, you can create a .bat file.

Setup that .bat file to call the runas command with these

parameters:

 

/savecred /user:<a username here that has local admin permissions>

AppPathAndName

 

I would setup an account with local administrative access that is

not the actual administrator account. Anyway, use runas /? to see

exact structure for username format, etc.... Then, setup a link for

the app that calls this .bat file. It will ask for the password when

they run the app the first time, so you enter it for them that first

time, but after that the password is cached somewhere (thus the

potential security risk) so they will not need to have the password

themselves to run the app.

 

Hope this helps!

 

Andrew

[Guest Meinolf Weber]

Re: Run as In Windows 2003

 

Hello Todd,

 

I would check with filemon and regmon from sysinternals/microsoft and only

configure the files/folders and registry keys you are needing.

 

Best regards

 

Meinolf Weber

Disclaimer: This posting is provided "AS IS" with no warranties, and confers

no rights.

** Please do NOT email, only reply to Newsgroups

** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

> Is there away that i can make a program always run in administrator

> With out asking. I have one program that can only run under

> administrator. The people that need to get it, i do not want to have

> administrator rights. And i do not want to give them the password to

> the administrator account.

>

[Guest Andrew Meador]

Re: Run as In Windows 2003

 

Re: Run as In Windows 2003

 

On Jan 14, 10:45 am, Andrew Meador <amead...@hotmail.com> wrote:

> On Jan 14, 10:26 am, todd <t...@discussions.microsoft.com> wrote:

>

> > Is there away that i can make a program always run in administrator With out

> > asking.  I have one program that can only run under administrator.  The

> > people that need to get it, i do not want to have administrator rights.  And

> > i

> > do not want to give them the password to the administrator account.

>

>    I do not know the security risk of doing this (as I don't know how

> how or where the password is stored) but, you can create a .bat file.

>    Setup that .bat file to call the runas command with these

> parameters:

>

>    /savecred /user:<a username here that has local admin permissions>

> AppPathAndName

>

>    I would setup an account with local administrative access that is

> not the actual administrator account. Anyway, use runas /? to see

> exact structure for username format, etc.... Then, setup a link for

> the app that calls this .bat file. It will ask for the password when

> they run the app the first time, so you enter it for them that first

> time, but after that the password is cached somewhere (thus the

> potential security risk) so they will not need to have the password

> themselves to run the app.

>

>    Hope this helps!

>

> Andrew

 

Oh yeah, you might want to tweak the permissions on this .bat file

so they can read/execute, but not modify, so they can't change which

app the .bat file runs, otherwise they could find the .bat file, and

modify the app to run with admin permissions. That could be bad. ;)

Maybe modify the permissions on the app shortcut to the .bat so they

can only execute, so they don't know what is going as far as that it

is running the .bat file. Use echo off in the .bat to hide the text

from showing on screen when it runs, make the .bat file hidden, etc...

You get my point, make it hard for them to get to the .bat file and

modify it.

 

Andrew

[Guest Andrew Meador]

Re: Run as In Windows 2003

 

Re: Run as In Windows 2003

 

On Jan 14, 10:48 am, Meinolf Weber <meiweb(nospam)@gmx.de> wrote:

> Hello Todd,

>

> I would check with filemon and regmon from sysinternals/microsoft and only

> configure the files/folders and registry keys you are needing.

>

> Best regards

>

> Meinolf Weber

> Disclaimer: This posting is provided "AS IS" with no warranties, and confers

> no rights.

> ** Please do NOT email, only reply to Newsgroups

> ** HELP us help YOU!!!http://www.blakjak.demon.co.uk/mul_crss.htm

>

>

>

> > Is there away that i can make a program always run in administrator

> > With out asking.  I have one program that can only run under

> > administrator.  The people that need to get it, i do not want to have

> > administrator rights.  And i do not want to give them the password to

> > the administrator account.- Hide quoted text -

>

> - Show quoted text -

 

That's true... I prefer this method, sometimes it is pretty simple,

other times a bit more involved, but it's cleaner. Basically just

modifying the permissions on files/folders/registry keys to allow the

regular users to have more/full control so the app will run. But if

for some reason you can't, the .bat file method works. I have had to

use the .bat method a few times, but mostly I use this method

(changing file/foler/reg permissions).

 

Andrew

[Guest Ryan Hanisco]

Re: Run as In Windows 2003

 

This is the right solution. There are too many security issues with

scripting the credentials and the registry permissions and all can be

scripted which makes it deployable to many workstations.

--

Ryan Hanisco

MCSE, MCTS: SQL 2005, Project+

http://www.techsterity.com

Chicago, IL

 

Remember: Marking helpful answers helps everyone find the info they need

quickly.

 

 

"Meinolf Weber" wrote:

> Hello Todd,

>

> I would check with filemon and regmon from sysinternals/microsoft and only

> configure the files/folders and registry keys you are needing.

>

> Best regards

>

> Meinolf Weber

> Disclaimer: This posting is provided "AS IS" with no warranties, and confers

> no rights.

> ** Please do NOT email, only reply to Newsgroups

> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

>

> > Is there away that i can make a program always run in administrator

> > With out asking. I have one program that can only run under

> > administrator. The people that need to get it, i do not want to have

> > administrator rights. And i do not want to give them the password to

> > the administrator account.

> >

>

>

>

[Guest Andrew Morton]

Re: Run as In Windows 2003

 

Re: Run as In Windows 2003

 

Andrew Meador wrote:

> Oh yeah, you might want to tweak the permissions on this .bat file

<snip>

> You get my point, make it hard for them to get to the .bat file and

> modify it.

 

You should check:

Unir lbh purpxrq gung va gur ncc gur hfre pnaabg hfr, fnl, gur svyr bcra

qvnybt gb nygre svyr crezvffvbaf? V jbhyq rkcrpg gur qvnybt gb eha jvgu gur

fnzr crezvffvbaf nf gur hfre, fb whfg evtug-pyvpx ba fbzrguvat naq lbh pna

trg gb Cebcregvrf.

 

Although, if they're that determined, they'll probably have thought of that.

 

Andrew

[Guest Andrew Meador]

Re: Run as In Windows 2003

 

Re: Run as In Windows 2003

 

On Jan 15, 10:07 am, "Andrew Morton" <a...@in-press.co.uk.invalid>

wrote:

> Andrew Meador wrote:

> >    Oh yeah, you might want to tweak the permissions on this .bat file

> <snip>

> > You get my point, make it hard for them to get to the .bat file and

> > modify it.

>

> You should check:

> Unir lbh purpxrq gung va gur ncc gur hfre pnaabg hfr, fnl, gur svyr bcra

> qvnybt gb nygre svyr crezvffvbaf? V jbhyq rkcrpg gur qvnybt gb eha jvgu gur

> fnzr crezvffvbaf nf gur hfre, fb whfg evtug-pyvpx ba fbzrguvat naq lbh pna

> trg gb Cebcregvrf.

>

> Although, if they're that determined, they'll probably have thought of that.

>

> Andrew

 

At least I'm trying to help.

I had someone elses post on my mind. They were trying to do this

with the runas command specifically, so sue me, or better yet with

your sarcastic attitude... Byte me! :)

 

Andrew Meador