Selective privilege escalation on XP Home Edition

Thanks for replying, pspglb.

Can you expand on this? I'm aware of the Power User Account, but if you're suggesting I permanently elevate the Limited User to one of these for full-time usage, I'm not too comfortable with that.  Can you point me to any details about what permissions a Power User has?

This link will expalin it:

http://blogs.technet.com/markrussinovich/archive/2006/05/01/the-power-in-power-users.aspx

Mm, as I thought: this is too much power to be giving to the day-to-day users.

OK, if that is too much power.... let me tell you something about your unsderstanding of "selective". Whenever you let a user start an application with admin rights that is interactive (visible), you turn over full control to the user. He can do anything now, for example use the open dialoque as a filebrowser with admin rights and launch anything from there - there is no limiting him to just one task. So the only real way to use elevated rights is the noninteractive one - everything else is plain nonsense from a security point of view.

If you would like your tasks to be interactive, create them using the at command and use the /interactive switch.

I take the point about the potential for abuse, but the main application I want to run in this way does not use a filepicker; it's a control applet for a spamassassin frontend, and what interaction it allows consists of stopping/starting the proxy server and adding addresses to a whitelist.  I could possibly add the Apache Monitor tool to this, but that's optional as the ability for the Limited User to run "net restart Apache2" on-demand will probably suffice. Most of the other on-demand things required are similar net and netsh commands.

I've had a look at the at scheduler, but I'm not sure how it's appropriate here as the apps in question are to run at startup, not at a given time.

Then Havin its better to give them power user rights if you are not comfortable with Admin rights. And dont let them know that they have those rights.

Most of the users aren't even aware of the privilege separation they now operate under; for example, one has already tried to reinstall one of the crap apps I'd had to clean off when I restored and reconfigured the PCs (I know because he complained to me that he couldn't do so, and I had to patiently explain that iTunes was not a business-critical application).

However had he been a Power User, the attempt would have been successful, and it might have been something rather more malevolent he installed.

In honesty I think it's quite unlikely that any of them would think of exploring a .vbe file and learning how to decode it to gain the Admin password, but I just hoped that there might be a more elegant and secure solution out there.

Okay: more things to be aware of:
First decision to make is if you need the security or the functionality most and what could happen if the escalated privileges are abused.
-Although your app does not offer a file browser, it runs elevated and on the same desktop (visible), which makes it at least vulnerable to shatter attacks (see http://en.wikipedia.org/wiki/Shatter_attack). But I bet, that would not be needed, even. Most programs, if they don't offer a file - open, they have some other whole (mostly the rightclick options of the window) to easily break out and use high privileges everywhere. For example a defrag when scheduled and running interactive from the command line and closing afterwards can be easily overcome although no file - open.
-power users are strong and - as Mark Russionovich of Microsoft proved once - can turn their account into an admin account with a little trick. The trick starts with writing into a service in the registry.
-the scheduler and the at command: you can modify the task afterwards to your need at the GUI. It still runs interactive,

I don't want you to think I am wilfully louche when it comes to security, but c'mon: there's not a thing in the article you linked to that's anywhere close to as trivial to get root through as decoding a .vbe file.

I appreciate your tenacity on this issue, but I think it should be obvious from the original question that functionality is what I need most, but I am looking to reduce the opportunity (albeit already very small) for my (non-leet cracker) users to get root due to my provisioning root-level services on the basis I've outlined.  These people are not looking to install keyloggers on our PCs, but they'd "view" angelina-jolie-naked-jpg.exe given the chance.  I entertain the faint paranoiac twinge that when they see a cmd window with a password prompt which disappears a moment later, they might eventually put 2+2 together and deduce that the password is embedded somewhere in that process, and the really Machiavellian amongst them might then go on to figure out how to retrieve that password - but I honestly doubt it.

Perhaps I should simply have asked: Is there a Windows equivalent of sudo?

Sorry I went off-radar for a bit.  I've been having a look at sudowin and runasspc. Both have a mix of pros and cons:

Runasspc: I like the no-install implementation, and the one-cryptfile-per-command layout. It's a very simple UI which I think my boss (who is trusted with the Admin password) could use it if necessary if I was away. Alternatively I could create a cryptfile at home and send it to the office.
However, given that it relies on symmetric encryption with no passphrase, I guess it has the same weakness as my VBE method (only this time I imagine you'd need to take ResHacker to the binary to retrieve the key). There's also the fact it costs money, but 20euro isn't much.

Sudowin: does exactly what it says on the tin, though it took quite a bit of reading (after tracking-down the "lost documentation" on the SANS website, then some more googling to work out the Home Edition method of adding a user to the "Sudoers" group) to get it configured. I'm used to this sort of thing with open-source software, but this was a particularly bad example.
The GUI password prompt is a problem, as like other .NET apps it doesn't respond well to systems where the DPI of Windows elements has been altered: the result is that the buttons disappear out of the bottom of the dialog. Not a big problem as I'm more likely to be using it from the commandline.
Having a service using ~18MB at all times is not ideal (these are quite old machines), but I appreciate that it's probably the only sensible way to implement this.
However, it won't be any good for the spamassassin applet I mentioned earlier. This is because it is elevating the Limited User's rights, rather than running as the Administrator.  I didn't mention this before, but this app can actually be run without Admin rights; but the problem is that ZoneAlarm goes nuts and uses 100% CPU when this happens, and this can only be avoided by running the app as Admin.

Given the choice, I would probably shell out the small cost for runasspc as it seems to fit our needs best. The AT trick sounds like it might do what I need for the spamassassin app, I haven't tried this yet but will do so.

If you don't mind I'd like to just keep this open for another day or so, in case anyone else has any other software to suggest.

McKnife, I tried what you suggested using AT, but the created job is owned by/runs as SYSTEM, and can't be edited via the Scheduled Tasks GUI (everything is greyed-out). I issued the AT command while logged-in as Limited User using a RunAs'd command prompt, would that be a factor?

Hi, I just returned home from vacation.
It's greyed out because you missed to run the scheduler as administrator as well, I suppose.

Ì did the whole operation as Admin this time, but the result is the same. Is this a Home vs. Pro issue here, perhaps?

Hi Havin_it, I am experiencing the same on both home and pro. I don't know why. I am used to using the schtasks.exe, try that one.

...instead of at

Another Home limitation there - it doesn't come with schtasks.exe...

Well, take it from pro.