Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

How do you run a program which needs a higher permissions level when you dont wish to raise the overall permissions level for the user?

Posted on 2003-11-13
5
Medium Priority
?
199 Views
Last Modified: 2010-04-13
This machine is not on a 2000 domain
using local security on a 2000 workstation,
I have a user who belongs to the "user" group
I dont wish to raise their permission level to "power user"
i have a program which needs to be run on the "power user" level.
how can i assign permissions to that program to run at a higher level level?
or
can i run the program as another user without having a password prompt?
or
is there a way i can enable registry changes in the local policy editor snap in in the mmc?
or
can i create a custom group with the permissions i need?
0
Comment
Question by:oweesta
2 Comments
 
LVL 4

Expert Comment

by:darth_wannabe
ID: 9741688
psexec might help you out http://www.sysinternals.com/ntw2k/freeware/pstools.shtml

also maybe RUNAS, although I think you get prompted for the password

RUNAS USAGE:

RUNAS [/profile] [/env] [/netonly] /user:<UserName> program

   /profile        if the user's profile needs to be loaded
   /env            to use current environment instead of user's.
   /netonly        use if the credentials specified are for remote access only.
   /user           <UserName> should be in form USER@DOMAIN or DOMAIN\USER
   program         command line for EXE.  See below for examples

Examples:
> runas /profile /user:mymachine\administrator cmd
> runas /profile /env /user:mydomain\admin "mmc %windir%\system32\dsa.msc"
> runas /env /user:user@domain.microsoft.com "notepad \"my file.txt\""

NOTE:  Enter user's password only when prompted.
NOTE:  USER@DOMAIN is not compatible with /netonly.
0
 
LVL 86

Accepted Solution

by:
oBdA earned 500 total points
ID: 9741959
Find out which permissions are missing.
Turn on auditing on your machine (local security policy -- auditing policy: turn on auditing for rights usage and object access).
Then enable auditing on the usual suspicious folders (using Windows Explorer, folder properties/Security/Advanced/Auditing): The program folder of the program, %AllUsersProfile%, and %CommonProgramFiles%.
Turn on auditing as well for HKLM\Software (using regedt32).
(Do I need to mention that you only need to audit failures?)
Log on as the user you're auditing; use runas.exe to start the event log (runas /user:administrator "mmc eventvwr.msc"), then start the program.
Look in the security event log for access violations and adjust the necessary rights until the program can be run by the user. (Note: some of the violations there are "normal" and can be ignored. Look especially at the ones related somehow to the program in question.)
It's sort of a tedious job, but you'll soon gt the hang of it ...
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
This blog will spread awareness about Dropbox. We have given the statements based upon our experience. Along with this, there is a section of some new plans that should be added in Dropbox this year. This will make the storage service enhanced from …
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an anti-spam), the admin…
In a question here at Experts Exchange (https://www.experts-exchange.com/questions/29062564/Adobe-acrobat-reader-DC.html), a member asked how to create a signature in Adobe Acrobat Reader DC (the free Reader product, not the paid, full Acrobat produ…

569 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question