• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 220
  • Last Modified:

Windows 7 user permissions

I have setup some laptops (x 3) for a local club and have set each of them to use a normal “User” account, rather than an “Administrator” account. Mainly to stop extra “stuff” being installed ;-)

The problem is, Firefox wants to update (to v7?) but needs the admin password – obviously, I don’t want to give that out. Is there a way to solve this, for Firefox and other installed software, but still maintain some control over what can be done to the laptops?
0
ascendinternet
Asked:
ascendinternet
  • 4
  • 4
  • 2
  • +1
2 Solutions
 
d_nedelchevCommented:
Set a remote desktop connection using the Administrator account and update the software manualy would be the easyest way.

In one way or another these machines will require some manual maintenance so if there is only 3 of them it wouldn't be too much trouble.
0
 
LazarusCommented:
Have you tried just giving the Apps that you want Admin rights, by giving the folder they are contained in Admin rights?
0
 
LazarusCommented:
You can also do:
1. Set to run as AN administrator (Right click > Properties > Compability tab > Mark "Run this program as an administrator). It will then not be ran as the specific user "Administrator", but with admin Privilegies.

2. Set the security settings to Full Control on the application. (Right click > Properties > Security tab)

Should solve your issues.
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
ascendinternetAuthor Commented:
OK, does the permissions have to be set per application then?

Is there such a thing as a "super user" in Windows 7? I don't want the users installing all sorts of other software, making changes to the setup, etc but I do want them to be able to update currently installed software. What is the best way to achieve that?
0
 
LazarusCommented:
Well, the only super user account on an stand alone Win 7 is the Admin account. So you dont want to give them all Admin. By changing a particular shortcut to runas, that will make only that program run as as admin and not affect any others. But you'll have to test to see if thats enough. You may still have to change teh Folder permissions of the particular app to give it Admin rights as well.
0
 
ascendinternetAuthor Commented:
Umm, OK ... slightly crazy though! It's a shame Windows doesn't allow you to assign specific permissions to users.

I will try the suggestions given and see how it goes!
0
 
Run5kCommented:
For starters, I would recommend against granting full admin privileges to the Firefox program folder, and I definitely wouldn't run a web browser program as an administrator.  That's essentially a security/malware problem waiting to happen.

Additionally, while I know that Firefox is somewhat trendy, have you considered recommending that your end-users stick with IE9?  It updates automatically, it's more secure, and if those machine are still utilizing Firefox 6.x or earlier the browser is plagued by memory leaks.  Just something to consider, since it would essentially eliminate your problem at no additional cost.

That being said, if using Firefox is really a deal-breaker, the only way to gracefully implement what you are proposing is with a third-party application like Privilege Authority or WINSelect...

http://www.scriptlogic.com/products/privilegeauthority/

http://www.faronics.com/standard/winselect-2/

http://www.faronics.com/assets/WSS_Manual.pdf
0
 
ascendinternetAuthor Commented:
The laptops have IE9, Firefox 6 (I seem to remember!) and Chrome.

At the moment there is a problem with using IE9 with the club's website - that will be sorted out soon, but in the meantime they need to use Firefox or Chrome.

The laptops are by Samsumg and there is one of their programs (something to do with battery management I think?) which keeps popping up at startup too - it also requires Admin rights! Hence me hoping for a more general solution.
0
 
Run5kCommented:
Tricky situation.

Again, applications like Privilege Authority or WINSelect will allow you to grant a specific level of additional privileges to end-users, but there is a bit of cost involved.  On the other hand, it's probably wiser to make a small investment instead of granting the end-users full admin privileges (or elevating a web browser to run as an administrator).

Pros & cons on both sides of the house.
0
 
LazarusCommented:
ascendinternet, the issue of why they dont is pretty simple as Run5k sates, it's not wise to allow a web broswer Admin rights. It's a LARGE RISK.
You can get software like ScriptLogics Desktop Aauthority, that will let you do exactly what you want to do, but for only a small set of computers its perhaps a bit pricy. You might check thet out.
0
 
ascendinternetAuthor Commented:
I have not tried the suggestions put forward but I now appreciate what the options are.
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 4
  • 4
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now