The easiest way to run as non-admin

re: The easiest way to run as non-admin

Lars Olofsson — Fri, 18 Jun 2004 05:40:00 GMT

This is going to be GREAT! As a developer I run as Admin all the time. And I don't like it. I've been looking around for best practises on running LUA without going nuts after 30 minutes. I will follow your post with the utmost interest!

/Lars.

re: The easiest way to run as non-admin

Eric Newton — Fri, 18 Jun 2004 08:00:00 GMT

intuit's software products are becoming infamous for requiring admin priviledges for normal use... imagine MY dilemma setting up a terminal server where everybody who needs Quickbooks has to have local admin priviledges!

re: The easiest way to run as non-admin

Eric Newton — Fri, 18 Jun 2004 08:04:00 GMT

btw: how do we get intuit to change their act? casual users who want Quicken and Quickbooks dont understand "least priviledge" and their support guys [in India] have a blanket answer for all unknown questions: Administrator priviledges...

I'm not sure it'll get fixed in Longhorn either, they'll just say "run as Longhorn Admin" or whatever its called

re: The easiest way to run as non-admin

Stephane Rodriguez — Fri, 18 Jun 2004 08:09:00 GMT

RunAs doesn't work well in all scenarios. The ability to install MSI packages using a RunAs command typically fails. There is a bug in the windows installer run-time, it keeps thinking the original profile is logged in when querying some special shell folders.

re: The easiest way to run as non-admin

Aaron Margosis — Fri, 18 Jun 2004 08:22:00 GMT

Stephane - do you find this is true for *all* MSIs, or just certain ones? If so, which ones?

Eric - how do we get Intuit to change their act? I don't think anything short of economic persuasion is likely to work. Until the cost of keeping it as it is exceeds the cost of fixing it, they don't have a lot of incentive to fix it, do they? I don't imagine they're getting much pressure along these lines - yet. A new Windows logo requirement might help. (What *are* the logo requirements for Limited User compatibility, anyway? Are there any?)

re: The easiest way to run as non-admin

Robert Hurlbut — Fri, 18 Jun 2004 17:34:00 GMT

Aaron -- Yes, there are requirements within the Windows Logo program that applications support Limited User compatability.

http://www.microsoft.com/winlogo/software/swoverview.mspx

Notice:
3.4 Support running as a Limited User

I have pointed to this product from Intuit specifically with Microsoft Research regarding these issues: "Principle of Least Privilege" (http://weblogs.asp.net/rhurlbut/archive/2004/05/27/142875.aspx)

re: The easiest way to run as non-admin

Peter Torr — Fri, 18 Jun 2004 19:08:00 GMT

Great to see this info getting out to the public! :-)

Using RegMon and FileMon from sysinternals.com can help you figure out what ACLs you need to tweak to get a particular piece of software to run. (Or you could just temporarily turn on object auditing).

re: The easiest way to run as non-admin

Stephane Rodriguez — Fri, 18 Jun 2004 20:38:00 GMT

It's true of all MSI packages downloaded from MSDN. I haven't tested MSI packages from anywhere else but unless all MSDN MSI packages are all created with a bugged tool, it might well apply to any MSI package. Try runas xxx, then msiexec -i yyy, and see for yourself how it fails (both when showing a default profile-based installation path by showing a wrong path, and also in the actual installation phase where a blocking error ends it abruptedly).

Run as Non-Admin..

SecureCoder by Anil John — Mon, 21 Jun 2004 04:22:00 GMT

re: The easiest way to run as non-admin

Aaron Margosis — Mon, 21 Jun 2004 07:37:00 GMT

Stephane, I failed to repro. I installed WMI Tools, as listed here:
http://msdn.microsoft.com/library/default.asp?url=/downloads/list/wmi.asp
I chose install for all users. Installed fine. Can you point me to a specific MSI that fails?
The way I installed it was to get a local admin cmd.exe shell, cd to the folder containing the msi, and just ran the msi directly on the command line:
WMITools.msi

re: The easiest way to run as non-admin

Stephane Rodriguez — Mon, 21 Jun 2004 09:48:00 GMT

http://download.microsoft.com/download/d/4/0/d401e5cd-04c7-4b72-b644-a00ae3fd5681/msbuildqs.msi

re: The easiest way to run as non-admin

Aaron Margosis — Mon, 21 Jun 2004 10:30:00 GMT

Stephane, thanks. Yes, I see what you're talking about. I'll report it. But based on my own testing, I don't think it's as serious as you think.

1) you don't need runas to install this for a single user - it doesn't require admin privs to install, if you're installing it in your own profile (i.e., for "just me"). The default folder is correct for the default "just me" setting, regardless of whether you're using runas or not. However, you do have to pick another folder for "everyone" if you really want other users of the computer to access it.

2) I don't think the error message you saw is a "blocking" error. The content did get installed to the specified folder. The only problem was that at the end of the install, the install program tells the shell to open an Explorer window in that folder. The shell, running as a normal user, doesn't have access to the specified folder and displays the error message.

Aaron Margosis's WebLog — Wed, 07 Jul 2004 22:45:00 GMT

re: Why you shouldn't run as admin...

Aaron Margosis' WebLog — Mon, 26 Jul 2004 04:18:00 GMT

Windows and the Least-Privilege Principal

Mohammad.Abdulfatah — Fri, 17 Sep 2004 06:22:00 GMT

Unix users have always understood the Least-Privilege principal, which basically states that programs should be given under the least possible security permissions required for them to run. By doing so, the chances of a buggy or malicious program being able...

I'm Not Running As Administrator

mike lorengo — Sat, 18 Sep 2004 02:08:00 GMT

I'm Not Running As Administrator

Full Trust can't be trusted

Coding Horror — Mon, 01 Nov 2004 07:42:00 GMT

Microsoft gets blamed for a lot of security problems, and for the most part, they deserve it. There's no excuse for the irresponsible "on by default" policy that resulted in so many vulnerable Windows 2000 IIS installations. That's why...

Non-Admin Development in VS.NET 2003

Geek Noise — Tue, 02 Nov 2004 02:12:00 GMT

Making life as a LUser more livable

blog://brycem@microsoft.com — Mon, 28 Feb 2005 22:30:00 GMT

Making life as a LUser more livable

blog://brycem@microsoft.com — Mon, 28 Feb 2005 22:31:00 GMT

To Be Or Not To Be (An Administrator)

Nazul's Weblog — Mon, 28 Mar 2005 05:59:00 GMT

En Windows tenemos el síndrome de ejecutar las aplicaciones como Administrator. ¿Podremos quitarnos ese vicio?

Table of contents, Aaron Margosis' non-admin blog

Aaron Margosis' WebLog — Tue, 19 Apr 2005 03:22:37 GMT

Complete list of Aaron Margosis' non-admin / least privilege posts, for easy lookup.

re: The easiest way to run as non-admin

James Hebben — Thu, 21 Apr 2005 15:16:31 GMT

I tried RunAsAdmin for a while but I found that the setup of machines at my current client mean that many operations fail when using this tool. Can't remember exectly - I gave up quite a while ago.

Instead, I have been running RunAsAdmin (http://www.harper.no/valery/PermaLink,guid,99b85fa3-104f-4a41-a28f-4786c68e77e4.aspx). This downgrades an admin user to a standard user and adds a task-tray icon to allow selective programs to be run as admin using the same standard user account.

Rudimentary interface. Opensource. I generally run cmd.exe as admin and launch the actual exe/msi/mmc from the command shell.

Works like a dream for me.

re: The easiest way to run as non-admin

Aaron Margosis — Thu, 21 Apr 2005 16:20:23 GMT

James Hebben -- Thanks for posting that. I don't recall seeing RunAsAdmin before. It looks very interesting - certainly an interesting way to use the SAFER APIs. That said, though, there are some pretty serious risks with that approach:
1) I don't know how supportable it is to replace the Winlogon Shell value. There could be some interesting/subtle things going on in there...
2) But more importantly: although exploitation of the shell, browser, etc. is mitigated, you have one or more programs running that are subject to luring and/or shatter-style attacks. If an attacker knows to look for more privileged apps on the desktop, particularly GUI apps that have a window message pump, they could be used by the attack to (re)gain admin privileges. It's the same essential issue as having LocalSystem services displaying UI on the desktop. If the app is running all the time, it is always targetable.

Nonetheless, certainly an interesting program, and thanks again for posting.

re: The easiest way to run as non-admin

Hofi — Wed, 27 Apr 2005 13:40:17 GMT

1) I think there is no problem with substituting the shell itself (the first step in RunAsAdmin is starting the original explorer.exe) The main problem could be that some auto starting program require more privileg to run than the newly (on a reduced run level) started explorer has. But see point 2.

2) Valery already planing to add a policy system to RunAsAdmin which will reduce the risk of attacks you'we mentioned and will add a well configurable rights management for the program. (But you are right, there is now easy way to protect an already running GUI program from that tricks).

re: The easiest way to run as non-admin

Scott — Sat, 28 May 2005 13:31:21 GMT

If an MSI fails to install using msiexec /i file.msi and RunAs but will run normally with just msiexec, you can try using a command more like:

runas /profile /env /user:administrator "msiexec /i file.msi"

The /profile and /env switches will setup the necessary environment for the Windows Installer.

Spread the LUA joy

tonyso — Fri, 10 Jun 2005 19:12:39 GMT

Get your friends and family, all those folks that come to you for computer help once their machines have...

re: The easiest way to run as non-admin

Alex Mondale — Sun, 19 Jun 2005 17:11:07 GMT

"FUS and RunAs don't play well together": Could this be why I get "access denied (5)" every time I try to run e.g. IE as an admin from a restricted account?

re: The easiest way to run as non-admin

Aaron Margosis — Mon, 20 Jun 2005 06:27:50 GMT

Alex Mondale --
No. See the comment just added (FUS/RunAs work fine together on XPSP2). The problem you were running into is that you can't use RunAs with a local account with a blank password.

re: The easiest way to run as non-admin

Karnov — Wed, 29 Jun 2005 20:11:48 GMT

<i>"Microsoft gets blamed for a lot of security problems, and for the most part, they deserve it. There's no excuse for the irresponsible "on by default" policy that resulted in so many vulnerable Windows 2000 IIS installations. That's why..."</i>

Ah... the old philosophy of "blame everyone but themselves". Hey, if the user is too stupid to take precautions to safeguard their own system then they deserve it.

Automated Backups on Windows XP Pro

Yesterday's Thoughts — Sun, 21 Aug 2005 09:20:51 GMT

Windows Backup is very poorly designed and implemented for automated use. I had to jump through hoops backwards to accomplish automated backups. In the interest of preserving your sanity,...

re: The easiest way to run as non-admin

white_H_A_T — Tue, 23 Aug 2005 16:45:17 GMT

The easiest way to install a .msi (that I've figured out anyway), is a two step process. First I runas /user:domain\user "cmd /k", then I run the .msi from the command prompt. Yes I am part of a domain, and yes I think it will work the same way remotely (I just never needed to try it yet). If you can't connect to / launch a remote command prompt google for PSTools and use psexec.exe

re: The easiest way to run as non-admin

Mister-T — Mon, 14 Nov 2005 01:17:17 GMT

I have try to make my computer runing with LUA, but but most of my software (nero, and games) are whimsical.

With BF2 when runing as LUA and launched with run as, the game launch then crash to desktop.
If I run the game without admin right, it work but i'm unable to play on punkbuster servers (99 % of servers are runing with it).

If a play with administrator account, it work, after playing few minutes. I can logoff from administrator then run game in LUA+ run-as and this time the game may launch.
That's BS, but it's my fault that was written on the box "Win xp + administrator"

re: The easiest way to run as non-admin

Rizwan — Mon, 14 Nov 2005 03:11:21 GMT

Hi Aaron,

I have uploaded XP Pro yesterday and up until this morning everything worked okay. This afternoon, I lost my profile and together with it I lost files and contacts relating to my Outlook, MS Word, Excel, Access & Powerpoint. I have been informed that my profile is somewhere in my desktop but I am not sure where.

Can you guide please? I have important information in the other profile. Currently, I have created another profile as well to get me going.

Thanking you.

re: The easiest way to run as non-admin

Jeremy — Wed, 23 Nov 2005 05:32:08 GMT

I am able to run Battlefield 2, Halo, Half Life 2, World of Warcraft easily in a limited user account on XP Pro. Make sure you give the limited user full control of the folders that contain the games.

re: The easiest way to run as non-admin

Steve F — Sun, 05 Feb 2006 19:41:02 GMT

Hi, Aaron et al.

In setting up a LUA, how does one import things like access to your main email account, favorites, access to data folders if you've built them all as an admin?

Thanks for your help.

re: The easiest way to run as non-admin

Aaron Margosis — Mon, 06 Feb 2006 07:25:57 GMT

Steve F -- That should generally not be a problem on Windows XP because of the default setting of the "Default Owner" security option, which I discussed here: http://blogs.msdn.com/aaron_margosis/archive/2005/03/11/394244.aspx . If you've run as admin with the default setting, then switch the account to Limited User, everything you've created should still be owned by your account and grant your account Full Control.

Unable to run concurrent IE sessions from 2 accounts in XP home

dhakna — Fri, 17 Feb 2006 00:27:56 GMT

I have windows XP home with 3 users( guest permissions) and an admin user. If I am running IE in a user session and FUS to another user, I get an iexplorer.exe error everytime I want to bring up IE or just windows explorer.

I have uninstall all tool bars (goggle, yahoo) from my machine, but the result is same.

Any help is appreciated.

Can't access internet as Limited User

vegemiteMan — Mon, 06 Mar 2006 05:20:40 GMT

I don't get it at all.
When I created a Limited User in WindowsXP Professional, that user couldn't even access the internet. Is this due to some other configuration? The whole idea of less-than-admin seems pointless if users can't even access the internet on current privileges. I might as well tie them up, put them in a straight jacket and chain their chair to the wall.

re: The easiest way to run as non-admin

Aaron Margosis — Mon, 06 Mar 2006 06:57:28 GMT

vegemiteMan - there must be something else going on there. Is this a domain or a workgroup? Are there any internet-related GPOs applying to this system? What kind of proxy and anti-virus software do you have? (LOTS of AV stuff doesn't work correctly as non-admin.)

re: The easiest way to run as non-admin

Aaron Margosis — Tue, 28 Mar 2006 18:33:06 GMT

dhakna - (sorry for the delay in replying) - that really sounds like a 3rd party tool/product that doesn't handle FUS/disconnection correctly, or perhaps believes that there will only be one instance of itself running on a computer at a time.

geek.is.chic » Blog Archive » Thursday, April 13, 2006

geek.is.chic » Blog Archive » Thursday, April 13, 2006 — Thu, 13 Apr 2006 08:34:27 GMT

PingBack from http://kalwynah.com/wordpress/2006/04/13/thursday-april-13-2006/

Simple File Sharing throws away user passwords

Sjoerd Visser — Fri, 23 Jun 2006 01:23:18 GMT

<< Starting with Windows XP, a blank password is actually more secure for certain scenarios than a weak password. By default, an account with a blank password can be used only for logging on at the console. It cannot be used for network access, and it cannot be used with RunAs. >>

It's good to warn XP Home users (and XP Prof workgroup users with Simple File Sharing enabled) that the only way to secure their shares is to give the guest account a password. With SFS anybody can have network access - with or without valid password.

But when I log on as Administrator without password I only can access the SFS (Anybody permitted) shares.

Windows Vista Secret #4: Disabling UAC

Tim Sneath — Wed, 20 Sep 2006 10:29:34 GMT

If you're a reader of this blog, I'm going to take a low-risk gamble and assert that you probably consider...

Windows Vista Secret #4: Disabling UAC

Tim Sneath — Fri, 03 Nov 2006 09:37:09 GMT

If you're a reader of this blog, I'm going to take a low-risk gamble and assert that you probably consider

re: The easiest way to run as non-admin

Raymond Brunet (P.C. Fix) Tech. — Thu, 07 Dec 2006 00:23:09 GMT

Since 2001 i'm not running system as Administrator, never forget when u RunAS Administrator Setup File, WinXP put all security for Administrator only. ( making tons of probleme doing that )

if you wan install something, go to Computer Management and put back Administrator groups on your account name, and then logout/login to make change take effect, and then install the Software you wan on your account.

on that way Windows put your Account as Program Owner ( Special Access ).

many time i did RunAS Administrator to install software, not fun find all REGKEY program ADD and set manualy your account to get access.

Raymond, these sound like problems specific to particular programs with bad installers, not all programs. That said, see the following posts for ways to mitigate this pain:

MakeMeAdmin -- temporary admin for your Limited User account

How to quickly and temporarily give your non-admin account administrator privileges, without having to log out.
http://blogs.msdn.com/aaron_margosis/archive/2004/07/24/193721.aspx

MakeMeAdmin follow-up

MakeMeAdmin script updates, and a security setting you should change
http://blogs.msdn.com/aaron_margosis/archive/2005/03/11/394244.aspx

Hope this helps.

-- Aaron

re: Fast user swicthing does not work

Alex — Thu, 04 Jan 2007 23:20:42 GMT

I have fast user switching on, but it does not work. I can't login with another user unless I log out before. The same for admin and for user accounts.

When I click on a user's icon, Windows makes a sound and returns to the login screen with account icons. The only account I can get into is the one which I already signed into before. So, I cannot run more than one account at the same time.

Any suggestions?

Alex:

Does this happen regardless of which account is logged in?

Do you have Offline Files enabled? (see this KB article)

It may be that something that is auto-starting when you log on is doing something bad. The best tool to view auto-start stuff is AutoRuns. If you run it as admin, you can inspect the auto-start entries of other accounts.

HTH

-- Aaron

re: The easiest way to run as non-admin

joan — Fri, 05 Jan 2007 01:54:56 GMT

Have you used "Microsoft_Shared_Computer" it's free. Create a limited account, lock it, use runas, and shared documents open to save files and info. IF a nasty loads in, reboot and nasty is gone. I use program without creating 1024 MB partition.

Joan, yes, that's the Microsoft Shared Computer Toolkit for Windows XP, and it is really cool. Thanks for pointing it out!

-- Aaron

re: The easiest way to run as non-admin

Alex — Fri, 05 Jan 2007 02:08:43 GMT

Aaron:

Yes, it happens regardless of what account I use initially.

I checked offline files tab and it is disabled. In fact, it says because fast user switching is on, offline file access is disabled or something like that.

Anyway, I do not get any error message when I try to switch user - I just return back to logon screen.

AutoRuns is a bit above my technical expertise, but I will try to play with it.

Thank you for your suggestions.

[Jan. 24 2007] Alex, a colleague just informed me that he triggered the same scenario you described when he disabled the "Shell Hardware Detection" service. Apparently Fast User Switching has some kind of dependency on this service running. Is that service enabled and running on your system?

Hope this helps!

-- Aaron

Living without antivirus software

Exodus Development — Fri, 12 Jan 2007 08:31:35 GMT

Ok, I'll admit it. I've been living dangerously for the last several years.

Simply put, I refuse to install any kind of antivirus or personal firewall software on any of my systems. This includes a Windows XP Home system that was used by my children as

can't connect/disconnect with Limited user

John — Fri, 11 May 2007 20:38:48 GMT

I want to change to using Limited, but when I do the ability to connect/disconnect to my dsl is lost (in Network Connections > LAN, the Disable/Enable option is grayed out). This effectively means I have to leave the connection enabled all the time, and I feel it should be disabled when I am away from the desk for a long time, for security. Is there any way around this with XP Home (sp2)? Thanks, John

John: On XP Pro I would suggest adding your non-admin account to the "Network Configuration Operators" group, but I do not know whether that group is functional in XP Home. From an admin cmd prompt, do this:

NET LOCALGROUP "Network Configuration Operators" nonadmin /ADD

... replacing nonadmin with the non-admin account name you're using.

HTH

-- Aaron

re: The easiest way to run as non-admin

Nate — Fri, 25 May 2007 16:49:27 GMT

Ok, this kinda helped me. I am a limited accont on my computer(my mom wont change me to admin) and i like to play games. but everytime i load the game in her world or accont, i cant get it to run in mine. plz help me in this ive been looking for months. no matter what we do we cant find a game that will ether work period, or will work on a limited user accont.

re: Automatic Updates when non-admin

Zeyn — Sun, 17 Jun 2007 23:35:31 GMT

Thanks to the information on this blog, I've now been happily running as a limited user for a few weeks. However, I have some concerns about the way automatic updates work with LUAs. It seems an unnecessary hassle to have to log on as admin and run updates manually, and more importantly I'd forget to do it often enough. It's an especially bad option when setting up a PC for non-IT-literate friends and relations.

I know the automatic updates service runs with enough privileges to install updates even when logged on as an LUA, as it did on my XP Home machine last week. However, I had automatic updates set to install at 03:00, and this was the first time my PC had been switched on at 03:00 since I've been logging on as LUA. So, if your machine is off at the scheduled time, does automatic updates just install the updates next time you log on? Or does it wait until the PC is next on at the scheduled time before doing the install? If the latter, it's a bit inconvenient, as I don't use my home PC at the same times every day, and even if I did, I wouldn't really want it rebooting on me while I was using it.

Ideally, what I'd like is: automatic updates downloads the updates, and notifies me (even though I'm logged in as an LUA) that they are ready. Then when I next shutdown the computer, it installs the updates. All the technical components for this are there, but I have a feeling it isn't actually possible - does anyone know any way of setting this up?

re: The easiest way to run as non-admin

Nate — Mon, 23 Jul 2007 14:34:34 GMT

Im sorry I do not belive this is possible. You are right about the next time you logg on, it doesnt matter about the time. If there's new software it needs to download, the next time you logg on it will alert you and ask if you want to start downloading <b>IF</b> you are on a admin acount, or non-LUA. This is how it had been for my computers atleast, Ive also been trying to figure out a way it will let you do these things as a LUA account, but it just doesnt seem possilble for the mounths ive been looking.

Safer Windows 2000/XP Accounts - Limited User « Free Lance Computer Guru

Safer Windows 2000/XP Accounts - Limited User « Free Lance Computer Guru — Tue, 28 Aug 2007 03:40:34 GMT

PingBack from http://freelancecomputerguru.wordpress.com/2007/06/22/safer-windows-2000xp-accounts-limited-user/

re: The easiest way to run as non-admin

qquake — Wed, 31 Oct 2007 12:44:42 GMT

make batch file

put this command your batch file

cd\

runas /user:computername\administrator "explorer.exe /separate"

save it your desktop

click batch file. It will ask your administrators password. type it.

This start explorer.exe with administrator priviliges and you can access also control panel

Voila!!!

[Aaron Margosis] Or see this post and this post. Oh, and note that any use of RunAs requires that the account have a non-blank password.

Vista UAC niggles...

YahBlog - Explore with new eyes — Wed, 14 Nov 2007 03:32:27 GMT

I did it... I took the plunge...,  installed Vista on my development laptop... (I feel almost like

re: The easiest way to run as non-admin

Koca Kelle — Fri, 27 Jun 2008 09:16:27 GMT

I will assume what seems to be evident : there is yet to be an integral and relatively well defined computer language. So what is an administrator? How many are there?

As a user in the most simple sense, that is home user with no interest in anything but minimising the risks of navigating Internet, I was interested to know how to setup "The easiest way to run as non-admin", only to find out, once again, it creates as many problems as viruses, trojans, keyloggers, malwares, spywares, maliciouswares, ad infinatum.

Example: in this page somebody had the problem of not being able to navigate after setting up "The easiest way to run as non-admin" The response was a string of acronyms, that is "keep navigating"

I am sorry to be harsh.

Cordially

re: The easiest way to run as non-admin

Singh — Wed, 17 Sep 2008 10:21:23 GMT

i dont know the password of administrator. so in the runas wat should i do?log in my user id and password ?or admin and no password..sorry i dont get you...

re: The easiest way to run as non-admin

hoortbri — Fri, 13 Mar 2009 18:18:36 GMT

Quickbooks runs as non-admin if you change permissions on the HKLM:\...software\intuit registry key so the user (or Users group) has read/write permission. Then it works fine, and is much safer than logging in as admin. It is unacceptable that Intuit doesn't fix their software...

re: The easiest way to run as non-admin

betty cadotte — Thu, 03 Dec 2009 18:44:06 GMT

how can anyone learn how to get an email address if you don't know how to do it.you need an email address to answer but they refuse you when you don't have an email address. how how how can i get one. what is a url