Re: computer account and application management strategy

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: ILiya (iliya00_at_yandex.ru)
Date: 01/26/05 

Date: Wed, 26 Jan 2005 10:15:50 +0300

Thank you for you kind feedback Shukla,
Would you please shed some more light on the GPO issue. I'm interested.

"Bhargav Shukla" <bhargavs@news.postalias> wrote in message
news:OLhybOvAFHA.3492@TK2MSFTNGP12.phx.gbl...
> I have found most Windows Certified programs work around this problems. If
> you intend to run all programs as users but install applications as
> administrator, you can run same install again after it is already
installed
> as administrator. This way it will see that the program is already
installed
> by administrator and it will make necessary registry changes for the user
> that is trying to install the application now. I have done this couple of
> times and it works. It may not work all the time with all the applications
> but I believe most Windows aware applications should be able to do what I
> described.
>
> Another way (if the question relates to larges userbase and you are an
> admin) is to use GPO and publish the application. That way the application
> will be available in add/remove programs and users can install the
> applications that they need without administrator intervention.
>
> Hope this helps.
>
> Thanks,
> Bhargav
>
>
>
>
> "ILiya" <iliya@arh.ru> wrote in message
> news:eKkkywsAFHA.1404@TK2MSFTNGP11.phx.gbl...
> > As a best practice, it is often recommended to run workstation as a
> > regular
> > user for security reasons.
> > The problem I see is however with application installation process. Most
> > of
> > applications keep their settings in the registry, which can be grouped
> > into
> > per-computer and per-user settings. They are stored in HKCU and HKLM
> > registry branches respectively.
> > In order to install an application the setup program must be run with
> > Administrator account privileges, probably using runas command prompt
> > utility to impersonate the user without having to completely log-off.
> > The setup program will write HKLM registry settings correctly however
the
> > user part HKCU will be screwed up because registry has its own HKCU zone
> > for
> > each defined user, so when the setup program will write the current user
> > registry settings, it will only see Administrator HKCU and not the one I
> > use
> > when running workstation. This will lead to an odd application behavior
or
> > even cause application malfunctioning.
> >
> > For example, when I decided to add a new newsgroup server to Outlook
> > Express, I forgot to run it as Administrator and made the operation as a
> > regular user (no warnings or low access messages were displayed), this
> > resulted to all the newsgroups folders were showing absolutely nothing
> > despite the fact they were full of postings. I could only view the
> > newsgroup
> > folders in OE under Administrator account.
> > So, I had to runas Administrator the OE, configure all the settings,
runas
> > Administrator regedit applet, export all the OE settings from HKCU and
> > then,
> > manually import them as a user into my HKCU to reflect OE configuration
in
> > my domain.
> >
> > So the reason I wrote this post is I see neither runas nor logging in as
> > Administrator to be not a very good way to install applications. As far
as
> > I
> > see temporary for application installation period raising user
privileges
> > to be the best installation approach. Maybe there is the uility like
runas
> > which can temporary raise the privileges living all the user
associations
> > alone.
> >
> > I'd like to see the other views and opinions on the subject.
> >
> > Thanks
> >
> >
>
>

Relevant Pages

  • Re: Adding Terminal Server
    ... as an administrator logging on as a user doing the testing this does not ... and a few other applications. ... >> How do I grant users access to the terminal server using the list of users ... >> Do I install apps the way I would as if I was installing to a desktop ...
    (microsoft.public.windows.terminal_services)
  • Re: MAKING YOUR COMPUTER SYSTEM SECURE AFTER ITS BEEN COMPROMISED
    ... > I decided to install X Software Application on a computer, ... > Virus check all floppy disks because hackers DO install a Backdoor, ... > There will always be evil code applications (to knock your system into ... > smart to make a backup copy of your registry. ...
    (microsoft.public.security.virus)
  • MAKING YOUR COMPUTER SYSTEM SECURE AFTER IT’S BEEN COMPROMISED
    ... The proper method is to re-format your hard drive, and install from ... Virus check all floppy disks because hackers DO install a Backdoor, ... There will always be evil code applications (to knock your system into ... Then Select Registry, Export Registry File ...
    (comp.security.misc)
  • MAKING YOUR COMPUTER SYSTEM SECURE AFTER ITS BEEN COMPROMISED
    ... I decided to install X Software Application on a computer, ... Virus check all floppy disks because hackers DO install a Backdoor, ... There will always be evil code applications (to knock your system into ... Then Select Registry, Export Registry File ...
    (comp.security.firewalls)
  • Re: MAKING YOUR COMPUTER SYSTEM SECURE AFTER ITS BEEN COMPROMISED
    ... > I decided to install X Software Application on a computer, ... > Virus check all floppy disks because hackers DO install a Backdoor, ... > There will always be evil code applications (to knock your system into ... > smart to make a backup copy of your registry. ...
    (comp.security.firewalls)