What is a "LUA Bug"? (And what isn't a LUA bug?)

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

larso — Mon, 06 Feb 2006 12:05:21 GMT

I agree that it should not be up to a unprivileged user to change the system time, but it should be possible to change the time zone. Changing time zone should not change the system time (which should be in UTC), but should change the local time presented to the user, based on UTC, time zone and summer time changes.

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

Keith Pawson — Mon, 06 Feb 2006 13:51:35 GMT

That's a good point Aaron - System time is probably one of the features that has turned people off with running as LUA. They usually don't understand Kerberos and why this has been restricted. I'm sure a better pop-up message box and read-only display would be very welcomed by all.

Perhaps Vista will also have other more user friendly message boxes :)

Interesting Finds

Jason Haley — Mon, 06 Feb 2006 16:21:24 GMT

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

Aidan Corey — Mon, 06 Feb 2006 17:50:44 GMT

I don't think that changing the time (or timezone) is the primary use case for the Date/Time applet.

It's a pop-up calendar, for working out what day of the week the 17th will be, or what the time is in another timezone. It should be capable of doing this without requiring rights to change the clock (or timezone).

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

Aaron Margosis — Mon, 06 Feb 2006 18:21:31 GMT

Aidan: actually, its original purpose was explicitly to set the date, time and time zone. (See http://blogs.msdn.com/oldnewthing/archive/2005/06/21/431054.aspx) People started using it for reference, or to watch the cool time zone map (remember when it used to draw a highlight over the selected zone? http://blogs.msdn.com/oldnewthing/archive/2003/08/22/54679.aspx).

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

LUAcrazy — Mon, 06 Feb 2006 21:40:02 GMT

Great stuff Aaron!!

I have been wrestling with LUA issues for some time now. Mostly, trying to help admin an SBS2003 domain while trying to keep all the WinXP desktop users running with LUA.

As was stated, Quickbooks was a big pain (why do they need full access to the HKCR registry?), although Intuit has a list of privileges required, so I was at least able to get the LUA users running with Quickbooks by setting elevated privilege workarounds for users of that app.

My latest pain seems to be finding work-arounds so the LUA users can use camera and printing software (i.e Kodak Easyshare, HP, Epson, etc.). There are users that need to use these apps for capturing and printing photos.

Also, please provide some pointers for XP Home LUA (trying to get home computers locked down). In WinXp Pro, it is relatively easy to elevate user privileges to specific folders, files, and registry keys as workarounds for LUA users. However, in XP Home I can't find a way to do this.

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

Aaron Margosis — Thu, 09 Feb 2006 10:09:54 GMT

LUACrazy:

I'm not familiar with the specific issues that Kodak, HP, Epson, etc. cause. Have you contacted the vendors?

[No help there - but a helpful tip coming in the next paragraph...]

Re the last issue you raise: Windows Explorer offers splendid ACL editors in the Properties dialogs for folders and files - the "Security" tab, which is normally not shown in Home Edition. The "Security" tab does appear if you boot in SAFE MODE.

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

Mike Stoltzfus — Fri, 10 Feb 2006 00:41:14 GMT

Aaron - I was convinced about use LUA during your session at TechEd this past year. Thanks for preaching this - it helps me sleep a little easier at night.

One issue I've had is that various warning messages displayed in Internet Explorer 6 do not disappear even if a LUA user checks the box that says "In the future, do not show this message". I've been searching for a solution for this, but have come up empty. Any thoughts?

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

Aaron Margosis — Fri, 10 Feb 2006 00:57:28 GMT

Mike Stoltzfus - I haven't seen that problem. There is at least one dialog I know of that doesn't offer the "in future" checkbox, but the ones that do always obey, as far as I can tell. If you're running IE using the "Protect my computer" option, then they probably won't stick. Which dialogs are disobeying you?

Fixing "LUA bugs", Part I

Aaron Margosis' WebLog — Thu, 16 Feb 2006 11:49:46 GMT

A systematic approach for working around LUA bugs that avoids unnecessary exposure

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

Mike Stoltzfus — Fri, 17 Feb 2006 05:40:58 GMT

Aaron - It must be the "Protect my Computer" option, because when I run as a limited user, they don't obey the checkbox. (Showing a little ignorance here:) What exactly is the "Protect my Computer" option? Is that something set through group policy?

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

Aaron Margosis — Fri, 17 Feb 2006 05:45:37 GMT

Mike Stoltzfus - Setting "Protect my computer" will prevent the program from writing to HKEY_CURRENT_USER in the registry, and will prevent even *reading* from your Docs&Settings folder in the file system. Some more info here:
http://blogs.msdn.com/aaron_margosis/archive/2004/09/10/227727.aspx

Table of contents, Aaron Margosis' non-admin blog

Aaron Margosis' WebLog — Fri, 17 Feb 2006 06:31:53 GMT

Complete list of Aaron Margosis' non-admin / least privilege posts, for easy lookup.

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

ML — Sat, 18 Mar 2006 04:15:02 GMT

I'm having trouble accessing Works 8 calendar as under LUA. Any work around for this?

lua internet problems

trebor — Sat, 25 Mar 2006 02:16:56 GMT

i have a friend who's internet doesn't work when on a lua..but it does for the admin account. as far as i know, they have changed no other settings for this to happen, but it does. any ideas would be great! thanks!

Fixing "LUA Bugs", Part II

Aaron Margosis' WebLog — Mon, 27 Mar 2006 19:34:28 GMT

A systematic approach for working around LUA bugs that avoids unnecessary exposure - "the rest of the story"

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

Aaron Margosis — Tue, 28 Mar 2006 18:30:36 GMT

ML - was the calendar created by a different account from your LUA account? If so, permissions need to be changed on the calendar file.

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

D Robinson — Tue, 25 Apr 2006 02:05:14 GMT

I am having a LUA problem - mine is when i log into a LUA, i get a "fAIL" error message, yet it still loads. I changed this account to an Admin and it loads without the fAIL message.

It seems to be just an annoyance - but i would like to get rid of it.

I was told by others to take the system back to the factory defaults, but was hoping someone here had a "better" suggestion....

any suggestions? oh, I am familiar with the registry and also periodically back up my system

thanks, in advance...

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

Aaron Margosis — Tue, 25 Apr 2006 04:53:05 GMT

D Robinson - from what you're describing, it sounds as though there is a program that automatically starts when you log on that has a LUA bug. The best tool for identifying "autostart" programs is Autoruns from sysinternals.com - that will help you narrow down the cause: http://www.sysinternals.com/Utilities/Autoruns.html

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

James Cannon — Wed, 26 Apr 2006 18:13:46 GMT

The whole date and time issue can be resolved with DesktopStandard Tools (www.desktopstandard.com) , I have been using them for over a year now, they are the easiest and simple solution to all the LUA problems I have had. Sounds like a plug, but I have really been impressed with them so thought I would share my experiences

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

Aaron Margosis — Wed, 26 Apr 2006 18:27:52 GMT

James Cannon - I talk about DesktopStandard in "Fixing LUA Bugs, Part II" - you should read that. I also published a simpler solution to the date/time issue.

Fixing LUA Bugs, Part II:
http://blogs.msdn.com/aaron_margosis/archive/2006/03/27/562091.aspx

Changing the system date, time and/or time zone:
http://blogs.msdn.com/aaron_margosis/archive/2005/02/11/371474.aspx

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

Anthony C — Tue, 02 May 2006 14:06:43 GMT

trebor: I had the same problem a while ago. Pre Service Pack 2 I think. If I remember correctly it affected me on LAN provided 'net access, and dial-up seemed fine. I discovered that non-IE based programs worked under LUA.

Anthony

Changing access control on folders vs. files

Aaron Margosis' WebLog — Tue, 20 Jun 2006 05:16:39 GMT

More info on the risks of changing access control lists to fix LUA bugs.

JEDI » Blog Archive » links for 2006-07-26

JEDI » Blog Archive » links for 2006-07-26 — Wed, 26 Jul 2006 13:19:04 GMT

PingBack from http://www.jedi.be/blog/2006/07/26/links-for-2006-07-26/

LUA Buglight public [pre]-release

Aaron Margosis' WebLog — Tue, 08 Aug 2006 00:00:59 GMT

"Why does Application XYZ need to run as admin?"

Changing permissions on your %windir%

The things that are better left unspoken — Tue, 05 Sep 2006 23:14:47 GMT

One way of coping with the challenges corresponding with "the principle of least administrative privilege"

Changed permissions on your %windir%

The things that are better left unspoken — Wed, 06 Sep 2006 08:39:39 GMT

On the second Tuesday of the month Microsoft introduces updates for it&#39;s products. As a system administrator

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

John Bokma — Sun, 17 Dec 2006 19:03:22 GMT

An upgrade to the well known vector drawing program Xara Xtreme (which has minor issues with limited user rights) has been released which just doesn't run with limited user rights, see: http://johnbokma.com/mexit/2006/12/11/xara-xtreme-pro-crippled.html

A drawing program that requires Administrator rights for making a simple drawing.

I contacted Xara, but other things have higher priorities, and it's unsure when this will be fixed. Since the minor issues with Xara Xtreme regarding limited user rights have been reported over a year ago I am not going to hold my breath.

It's a sad day when software companies release "Pro" software that just assumes that everybody is running with Administrator rights, and hence promote unsafe Windows XP usage this way.

Common_AppData is Readonly

Mike O'Grady — Wed, 03 Jan 2007 18:16:09 GMT

I suppose, like many developers, I haven't been aware of all of the issues with LUAs. However, I have recently been forced to face up to the issue by a customer who insisted that my accounts and payroll software be capable of running in a LUA. and accessible to all users.

So, I revamped my code, moved the database from the Program Files directory to C:\Documents and Settings\All Users\Application Data\Company\Application. I also set the private directory for the database (for SQL results) to the same path and put the application's ini file (Yes, an ini file!!) and some temporary database tables in the same place.

Ran the app from a LUA and yippee - it worked. Except... it didn't work on my customer's PC. Apparently, it gets an access error when it tries to write to the ini file. You might say that I should put the ini stuff in the Registry but, if it cannot write to the ini file it is hardly going to be able to write to the database!!

I have asked the customer to try editing the ini file from the LUA and he cannot save any changes. I thought he might have inadvertently made some of the folders/files read-only, but he says that this is not the case.

Any ideas on why he cannot write to the "All Users\Application Data " sub-folders would be greatly appreciated. This is the Common AppData folder. Surely all users should be able to write to it??

Mike O'Grady

Aquila Technology

Mike -- I think what's happening is because the common data folder has some interesting ACLs. Any user can create a file or subfolder under there, but only the user who created a particular object gets Full Control over it -- all other users get Read&Execute only. (This is the effect of the inherited CREATOR OWNER entry in the ACL.) If the data files are to be shared by multiple users (I assume they are or you would just put them in the user's private folders), then I would recommend that you create the folder in which to put the data and change the ACL on it so that all authorized users are granted all necessary access to the files within. (You should review this post regarding the risks of shared data areas.)

You mentioned "databases" and "SQL". I assume you're referring to something other than SQL Server or related technologies like MSDE. If you are referring to a database technology that uses a service, then you don't need to put those data files in the common app folder, since users do not interact directly with the data file(s) but instead with the service.

HTH

-- Aaron

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

David Williams — Tue, 30 Jan 2007 18:02:30 GMT

I did the same thing as Mike O'Grady with the same results. Upon calling Microsoft support, I was told to put any fully shared data into C:\Public (also known as C:\Users\Public). This works without any need for changing ACL or any user administration. However, there is no CSIDL lookup for Public. This makes me concerned that using this folder is not officially supported. Any comment on using C:\Public over C:\ProgramData (which apparently is an alias for C:\Documents and Settings\All Users\Application Data and can be looked up using CSIDL_COMMON_APPDATA)?

David: There isn't a C:\Public, but there is a C:\Users\Public. That will get you the default ACL you want, but those folders are really for items that users can browse/discover/interact with directly, rather than ProgramData which is intended for programs to manage. I would expect the better recommendation would still be to create a custom folder in the app-data folder and set its ACL appropriately.

For the CSIDL, see this post and follow its links. The relevant ID is FOLDERID_Public.

HTH

-- Aaron

Changing access control on folders vs. files

Aaron Margosis' WebLog — Fri, 16 Feb 2007 05:14:32 GMT

More info on the risks of changing access control lists to fix LUA bugs.

nbtstat: LUA Bug?

Henning Plumeyer — Wed, 07 Nov 2007 20:24:06 GMT

nbtstat does not work for a limited user, only for admins.

Is this a LUA bug? I think the option -n for example does no change to the system and does not read non-public information -- so it is a LUA bug.

How can I work around this? I have tried LUA buglight (starting cmd.exe, then nbtstat -n ) but got no helpful result.

With the option -a you can ask a remote system's NetBIOS name table. You need local admin rights but not on the remote machine!

[Aaron Margosis] I just tried nbtstat using (separately) -c, -r and -n. All of them seem to work on my Vista machine.

nbtstat: LUA Bug?

Henning Plumeyer — Thu, 08 Nov 2007 21:59:45 GMT

I have tried on Windows XP and Server 2003 only.

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

Henning Plumeyer — Fri, 22 Feb 2008 16:37:28 GMT

Problem occurs on Windows XP and Windows Server 2003:

nbtstat -n

Failed to access NetBT driver -- NetBT may not be loaded

[Aaron Margosis] Seems to be a LUA bug in XP and 2003:

http://support.microsoft.com/kb/888373

Probably inadvertent -- those operations should work for members of the Network Configuration Operators group, but they don't.

Registry Keys ownership...

Richard Jenniss — Sun, 21 Sep 2008 06:53:27 GMT

Why not install software under a user dedicated to that software? I know in some cases this is a bit much, however this could apply that when you install software all files and registry keys created are owned by that user. Rolling back system changes can be done similarly to removing a user and all their associated files & keys.

Can I get a copy of version 1.0 of LUA bug tool

Deepu Cherian — Thu, 21 May 2009 20:57:50 GMT

Hi,

Can I get a copy of your tool. When I try to download, it is giving page cannot be found.

Thanks

Deepu

E-mail: dcherian@dlbassociates.com

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

Deepu Cherian — Thu, 21 May 2009 20:58:18 GMT

please send me the link to download LUA tool

[Aaron Margosis] Link to the currently published version:

http://blogs.msdn.com/aaron_margosis/archive/2008/11/06/lua-buglight-2-0-second-preview.aspx

What is a "LUA Bug"? (And what isn't a LUA bug?)

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

Interesting Finds

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

Fixing &quot;LUA bugs&quot;, Part I

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

Table of contents, Aaron Margosis' non-admin blog

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

lua internet problems

Fixing &quot;LUA Bugs&quot;, Part II

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

Changing access control on folders vs. files

JEDI » Blog Archive » links for 2006-07-26

LUA Buglight public [pre]-release

Changing permissions on your %windir%

Changed permissions on your %windir%

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

Common_AppData is Readonly

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

Changing access control on folders vs. files

nbtstat: LUA Bug?

nbtstat: LUA Bug?

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

Registry Keys ownership...

Can I get a copy of version 1.0 of LUA bug tool

re: What is a "LUA Bug"? (And what isn't a LUA bug?)

Fixing "LUA bugs", Part I

Fixing "LUA Bugs", Part II