kbryant2
asked on
XP Home SP2 Security Issues and Concerns
I am a dad now supporting 2 laptops and 2 desktops in my home all sharing a DSL connection via a Netgear WGT624 router. I was a WIN98 holdout until 2 months ago upgrading all units to XP HOME SP2. After reading all the security concerns about running computers in administrative mode I made all users(including myself) limited users and created one administrator account for software installs and maintenance – this system seems to work well – until my users tried using their applications(even office 2000!) many do not work properly or not at all. Now some programs are old, some are newer, some are games, some are apps. Yet some do work with limited user accounts like internet explorer, MSN messenger, Norton Ghost, Computer Associates EZTrust. What is the difference? Do I need to be this secure? Should I just have all users run in administrative mode? Is that the intent of the HOME version? I know that HOME does not have the sophisticated security features of PRO.
My goal is to minimize risk, support issues, and at the same time maximize functionality.
Is there a way I can make all the programs work with limited users accounts? I have read about cacls and booting in safe mode and logging in with a administrative account to get the security tab. But that seems to be a support nightmare having to do this everytime a app needs to be installed.
My goal is to minimize risk, support issues, and at the same time maximize functionality.
Is there a way I can make all the programs work with limited users accounts? I have read about cacls and booting in safe mode and logging in with a administrative account to get the security tab. But that seems to be a support nightmare having to do this everytime a app needs to be installed.
Applications should work for users if they have been installed by an Admin account - are you saying you are insatlling them in this way and they are not working?
ASKER
gidds99, yes that is correct. Here are a few examples; Sims 2 built in 2004 after installing and rebooting any user without admin rights gets a error when starting(even though the app put a icon on every account's desktop) if I give a user admin rights program works ok, take away rights error comes back. Office 2000 - after installing and a limited users first open of let's say outlook it trys to set default and install something else well the application works but every time the app is opened the same scenario repeats - until I give them admin rights and take them away after app has completed it's setup. So I wonder if everytime a new feature is used will I run into the same problem? CD Organizer 4 - without admin rights I get a ODBC error.
KB
KB
Have you tried to determine if it's an NTFS or Registry security issue? Meaning, do the users have the right's to read/execute all files that these programs require. Typically all you need to do in this case is be sure that they can just my computer to browse to the program folder that the app is in, and if they can, then they will need execute rights on just about all of the files in there. You can somtimes use the "unwise" uninstaller files to your advatage, as they list in plain-text the places that the uninstaller will go to remove the programs. There can also be an install.txt file that will be written in the program folder (typically) that recorded where all the files and registry entries were written to, so that they can be reversed to uninstall the program.
I've got an automated process to using RunAs listed on my website here: http://xinn.org/RunasVBS.html
RunAs allows you to enter a username and pass with higher privledges (or lower if you wanted..?) so you can execute a program or process without having to logoff and log back on to a PC.
With the VBE file (a vbs file, encoded) you can make a shortcut that automatically fills in the username and pass, so the users never have to know what the pass is. Again it's encoded, and not encrypted, the encoding can be undone easily, but most users, and even IT admins don't know how to go about it. I do not suggest using THE administrator account, but an account with elevated priv's.
Regardless of method...You may try a user in the POWERUSERS group as opposed to the Admin's group- this may be all you need to get the functions working. If it does, then try my VBE files with a user you create in the powerusers group.
-rich
I've got an automated process to using RunAs listed on my website here: http://xinn.org/RunasVBS.html
RunAs allows you to enter a username and pass with higher privledges (or lower if you wanted..?) so you can execute a program or process without having to logoff and log back on to a PC.
With the VBE file (a vbs file, encoded) you can make a shortcut that automatically fills in the username and pass, so the users never have to know what the pass is. Again it's encoded, and not encrypted, the encoding can be undone easily, but most users, and even IT admins don't know how to go about it. I do not suggest using THE administrator account, but an account with elevated priv's.
Regardless of method...You may try a user in the POWERUSERS group as opposed to the Admin's group- this may be all you need to get the functions working. If it does, then try my VBE files with a user you create in the powerusers group.
-rich
this really is an application problem rather than an OS proplem. Many poorly written apps have to be run while logged in as an administrator. Even if you call the app vendor they will confirm this. These are usually apps that were originally written for 98 and not properly upgraded to run on 2000 or XP machines. Unfortunately the only option is to run them while logged in as an admin.
ASKER
I like your thoughts richrumble. I will try browsing the program folder with each user. The runas looks like a possible fix except that it appears I would need to do this for every program with a problem - and thus increasing my support burden. Now about the POWERUSERS group I thought these various groups were only available with the PRO version - I am using HOME. Or are these groups available when booting in safe mode and logging in to local machine as admin?
KB
KB
ASKER
mikeleebrla how can you determine BEFORE buying software that I will run properly with limited users accounts? You would think that Office 2000 or SIMS 2 would be new enough and designed properly. These are not cheap programs.
KB
KB
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
http://secureconditions.com/articles/NetworkSecurityGuidelinesNSA.pdf
Regards,
Good luck and stay secure.
CJ