Re: Allow user to run application as a power user

"Ed Murphy" <EdMurphy@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:2139A0D4-CB28-45F1-BC9C-249F2B36D74A@xxxxxxxxxxxxxxxx
> Hello,
>
> I have an application that I am distributing with SMS. The problem that I
> am having is that the application, now on the target machine, requires
power
> user or admin privledges to run. I can run the application via sms in the
> system context, but that will not help, since the app configures the
user's
> environment.
>
> So unless someone knows of an easier solution, I need to run a script, in
> the system context that makes the current logged on user a member of the
> local power users group, if they are not already a member of that group or
> the admins group and then run the application under the user's context.
> Finally, after the application is complete, the script, under the system
> context again, would then revert the user back to his former permission
> level, i.e., return user to former group memberships.
>
> I don't think that this can be done with one script, because of the
context
> issues. But, since I am using SMS, I can use three different scripts and
> chain them together.
>
> 1. Promote the current logged in user to a member of the local power
users
> group, if needed.
> 2. Run the application under the user's context.
> 3. Demote the current logged in user back to his original group
memberships.
>
> Since we don't normally allow membership in the power users group, I guess
> it would be ok to specifically remove the user from the power users, but
if,
> in the future, we did allow permanent power users, this approach could
cause
> problems.
>
> Another concern is security. I realize that during the period between the
> first and third scripts that the user could exploit the elevated
privledges.
> Worse yet, they could kill the process before the third script can run,
which
> would leave them in the elevated state.
>
> Unfortunately, I am really just learning to script, so the details are
> currently beyond me. I am not sure if these scripts should be in VB or
not.
> If anyone could offer suggestions or point me in the right direction, I
would
> be grateful.
>
> Thanks,
>
> Ed

Hi Ed,

My main concern with your proposed solution is that in order for the system
to recognize the user as a power user (ie member of the power users group),
the user would have to logoff/logon before starting the application (but
after joining the power users group).

The best solution IMO - if at all possible - would be to find out exactly
what makes the application require poweruser/admin privileges, and then
tweak the installation package to give normal users the rights needed, for
instance via secedit. If security changes are extensive, it's probably
better to just grant the user power user privileges permanently (or for as
long as he/she is using the application).

--
Björn Holmgren



.

Relevant Pages

  • Allow user to run application as a power user
    ... system context, but that will not help, since the app configures the user's ... the system context that makes the current logged on user a member of the ... Finally, after the application is complete, the script, under the system ... Promote the current logged in user to a member of the local power users ...
    (microsoft.public.scripting.vbscript)
  • Re: Allow user to run application as a power user
    ... The vendor has provided a script ... >> the system context that makes the current logged on user a member of the ... >> Since we don't normally allow membership in the power users group, ...
    (microsoft.public.scripting.vbscript)
  • Re: Restrict membership of Power users local group
    ... I've saved this script into a batch file. ... >>to Power Users group. ... >@echo off ...
    (microsoft.public.windows.group_policy)
  • Re: Add AD user to localgroup
    ... How would I use this to create someone in the Power Users group? ... command line it works, but I would like to do it from a script. ... > Use the above in vbscript, the script must be run with admin rights. ...
    (microsoft.public.scripting.vbscript)
  • Re: sharing&instaling
    ... A user needs minimum to be a member of the local power users group on the computer ...
    (microsoft.public.win2000.security)