How to run in standard account a program requiring admin cedentials ?

aschwarzie · Jul 20, 2011

How to run in a Standard Account a program requiring Admin credentials ?

Hello All,
Despite this forum looks like a x64bits place, I hope you will be able to assist me in solving an access authorisation issue on a Vista Premium 32 bits system.

As admin on my computer I installed a game (named Mythos), installed in
C:\Program Files\Frogster\Mythos
I would like my kids (who have a Standard account) to play this game but each time they try to run it they are requested Admin privileges, which I do of course NOT want to provide them with.

I tried to provide the most open possible sharing capabilities to this folder (Frogster) without any success. I tried to increase the privileges level to the max (full control), still to no avail. Looking into the help for sharing files in windows help didn't help me... and googling not more, unfortunately.

There *must* be somewhere some guide to allow a Standard user to use/access resources installed by the Admin account, without providing the Admin pwd, right ?

Thanks for your precious advice !

tom982 · Jul 20, 2011

Hello aschwarzie and welcome to the forums :party:

Despite the name, we help people with both x86 and x64

Anyone is welcome here

Have you seen this: http://www.vistax64.com/tutorials/95147-parental-controls-specific-programs.html

Tom

aschwarzie · Jul 20, 2011

Hi Tom,

Thanks a lot for this very quick reply. I went "OMG how did I overlook this obvious path !?" and explored this, but unfortunately without the desired outcome.
Curiously, now that Parental Control is set to the standard "Games" account, not only is this game (Mythos) STILL requiring Adm credentials, but some OTHER games now also (Call of Duty, and 3 others) while other can still be played (Age of Myhtology, Spore, and many others)! And this despite that I even elevated the Parental Control authorisation to run ALL programs. :-(
This starts to drive me nuts...

Curiously enough, when I return to my admin account, the shortcut on the desktop for Mythos ALSO displays a tiny four-colour shield/security icon. When launching the game it requires me to "approve" starting the game as a window pops-up saying:
"An unidentified program wants to access your computer"... and I need to click on "Allow" tu trust the program. Is there something I am doing wrong somewhere ?

Best regards,
aSchwarzie

Edit: I googled for the "An unidentified..." msg and tried to understand it a bit better. It appears that I can "globally" change how my computer reacts when a pgm requires adm privileges/approval to run, by editing a "security policy". The instructions were to edit secpol.msc, which I appear not to have (not to be found). Another quite technical person explained how to use the mmc to create a policy, modify the behaviour for the UAC rule specific to handle the credential request for Admin users and for Standard users but, still... the behaviour doesn't change. The Admin account is being requested to "confirm" while the standard account is being requested to provide Admin credentials (incl pwd). Sigh.
See more about this here, especially the feed-back of 'Adrian'.

tom982 · Jul 21, 2011

Hmm, that's odd. I don't know if the following will work but its worth a shot

Disable UAC with this (option one): http://www.vistax64.com/tutorials/48893-user-account-control-uac.html

My only hesitation with this is that it may disable the parental controls, I can't find anything on it on google so you'll just have to give it a shot

Tom

aschwarzie · Jul 23, 2011

Thanks Tom !

I disabled UAC (Parental Control appeared grayed out i.e. meaning they were than out of effect too) and indeed it allowed the start of the game by the Standard account. I'm annoyed by the consequences of this workaround as it reduces the security for this account and I'm not sure of the risks I'm actually taking here (so I restored it in the meantime).

Ideally I would like to put in place a security policy to only deactivate the approval (Allow/Cancel) under admin accounts and the provision of Admin credentials under standard accounts (meaning that I TRUST the program launched under those accounts). I found an setting for the former, but nothing yet for the latter.

Thanks to more help I found on google, I started mmc, loaded two security snap-ins and have changed the default Template and Configured my system so that: LocalPolicies > SecurityOptions> UAC:Behavior of the elevation prompt for administrators in Admin Approval Mode is now set to "Elevate without Prompt" (instead of "Prompt for Consent", which at least reduces the number of times I need to Confirm-or-Cancel).
But the just following option in LocalPolicies > SecurityOptions> UAC:Behavior of the elevation prompt for standard users only allows to set its value to "Prompt for credentials" (default on Vista Home, and indeed this is what nags me now!) or "Automatically deny elevation requests" (default for Vista Enterprise), which would indicate that I want to do doesn't seem possible !?
I.e. still no real solution to my need / complaint !

Any other hint, please ? :-)

tom982 · Jul 24, 2011

Okay, it was a long shot anyway!

I was reading this tutorial from one of our admins here and it says:

To Have UAC Progam Exceptions to not have UAC ask for your permission on certain programs in Vista only, then you can use the Norton UAC Tool for this. This program will not work in Window 7.

This is the link for the Norton UAC Tool: http://us.norton.com/theme.jsp?themeid=labs_uac&header=0&depthpath=0

Try it out, I'm pretty sure its what you're after as you're able to whitelist (allow) certain programs - something which windows UAC cannot do

Tom

t-4-2 · Jul 24, 2011

aschwarzie said:
Hello All,
Despite this forum looks like a x64bits place, I hope you will be able to assist me in solving an access authorisation issue on a Vista Premium 32 bits system.

As admin on my computer I installed a game (named Mythos), installed in
C:\Program Files\Frogster\Mythos
I would like my kids (who have a Standard account) to play this game but each time they try to run it they are requested Admin privileges, which I do of course NOT want to provide them with.

I tried to provide the most open possible sharing capabilities to this folder (Frogster) without any success. I tried to increase the privileges level to the max (full control), still to no avail. Looking into the help for sharing files in windows help didn't help me... and googling not more, unfortunately.

There *must* be somewhere some guide to allow a Standard user to use/access resources installed by the Admin account, without providing the Admin pwd, right ?

Thanks for your precious advice !

Wonder if this will work ?

Right click at the game file or its desktop shortcut > Properties > Compatibility > under Privilege Level heading > check Run this program as an administrator > OK

aschwarzie · Jul 24, 2011

t-4-2 said:
Right click at the game file or its desktop shortcut > Properties > Compatibility > under Privilege Level heading > check Run this program as an administrator > OK

Thanks for the suggestion t-4-2 (nice nick' btw ;-) but nope that doesn't work, which, let's be honest, leaves this question open: what the h*ll is this feature aimed for, right ? :-o

Actually, this seems to have no concrete effect : at the time of checking this box I'm not requested the admin (pwd) credentials and when the game is started (under the standard account) those are still requested... Sigh !

aschwarzie · Jul 24, 2011

tom982 said:
Norton UAC Tool: http://us.norton.com/theme.jsp?themeid=labs_uac&header=0&depthpath=0
Try it out, I'm pretty sure its what you're after as you're able to whitelist (allow) certain programs - something which windows UAC cannot do.
Tom

Thanks again tom for your support Tom !

Yes I've read this reference too, though on another place, and that seems indeed to work around it -- I however wonder how. But having had poor experiences with the Norton Security Suite (I finally had to reformat the HD, even Symantec support couldn't help me out) I was reluctant to install anything else from them :-(

Actually, I'm considering now examining if Windows 7 would provide the necessary security features to allow what I request (actually the feature pointed by t-4-2 seems to be *exactly* what is needed) ?

Though times...

In the meantime I've disabled UAC (without letting my kids know) to let them play with this game (and 2 others I no more need to manually grant credentials manually each time they want to play).

PS/ I think I'll give Norton UAC a try : it seems a quite independent product and not dependent of their Security Suite.

tom982 · Jul 24, 2011

Yes I'm also not a massive fan of Norton, it doesn't have the best detection rates and it really slows your computer down.

Okay, give Norton UAC a go and if you don't like it then we'll clean your computer up afterwards. Let us know what you think!

Tom

aschwarzie · Jul 24, 2011

So, I gave it a try, downloaded the NUAC Tool, installed it and... nada.
No icon, no shortcut, nothing in the Start menu, nothing in the Program Files directory (with the exception of the same code file expectedly in a Symantec folder which now proposes to uninstall it), nothing in the list of running services, nothing in the Registry (apart from a flag recording that I gave my consent to share my usage hereof, premusably with Symantec folks but unsure as the msg was pretty laconic)... and all this despite the tool was announce to add a "layer of user-friendliness to Windows' UAC. What's in a name.
Ask me again why Norton isn't making me brag about them... Sigh.

I'll look into their forum tomorrow (which requires registration etc).
More thrilling news in the next episode folks... till then, sleep tight ;-)

PS: I of course gave them the minimal credit of doing things right but things didn't change for a single iota in the behaviour both under my admin account and under the standard user account.

tom982 · Jul 25, 2011

I'm sorry to hear that it didn't work for you, okay that's probably a good idea, I've never come across the NUAC tool since yesterday so my experience is very limited.

Have you considered using a third party parental control program?

Tom

aschwarzie · Jul 25, 2011

tom982 said:
I'm sorry to hear that it didn't work for you, okay that's probably a good idea, I've never come across the NUAC tool since yesterday so my experience is very limited.

Don't be sorry Tom, it was an excellent advice and as I said I also was considering it -- as the whitelisting principle is a pretty clean approach that would fit the need.
I was rather p*ss*d off by a tool so nicely failing to do something it was supposedly designed for... without even a notice (did the install actually succeed despite the jolly message ?) or any instructions for use.

tom982 said:
Have you considered using a third party parental control program?

Nope, not yet, but worth considering, especially if open-source which I support. Any product coming to your mind ?

Interestingly enough, I found on a french forum some instruction steps to assist a person in a similar situation (to allow his kids to run Sims2, seemingly also requiring admin privileges). A crucial step involved creating a shortcut with a CMD line, embedding a runas instruction, with the /savecred switch, helping in storing somewhere the admin password, which would be requested only at first run via the shortcut. I liked the idea a lot (pretty similar to what we seek, isn't it ?), until I discovered in the inline help that this feature is not supported in Vista Home Family nor Premium editions (nor on XP Home I've found out)!! Lolll. Isn't this flabbergasting ??

PS: Just posted on Norton's forum... the UAC tool has been discontinued since 2009 :-(
But the tech folks are willing to help, if possible, and get back to me later.

tom982 · Jul 25, 2011

aschwarzie said:
tom982 said:

I'm sorry to hear that it didn't work for you, okay that's probably a good idea, I've never come across the NUAC tool since yesterday so my experience is very limited.

Click to expand...

Don't be sorry Tom, it was an excellent advice and as I said I also was considering it -- as the whitelisting principle is a pretty clean approach that would fit the need.
I was rather p*ss*d off by a tool so nicely failing to do something it was supposedly designed for... without even a notice (did the install actually succeed despite the jolly message ?) or any instructions for use.

tom982 said:

Have you considered using a third party parental control program?

Click to expand...

Nope, not yet, but worth considering, especially if open-source which I support. Any product coming to your mind ?

Interestingly enough, I found on a french forum some instruction steps to assist a person in a similar situation (to allow his kids to run Sims2, seemingly also requiring admin privileges). A crucial step involved creating a shortcut with a CMD line, embedding a runas instruction, with the /savecred switch, helping in storing somewhere the admin password, which would be requested only at first run via the shortcut. I liked the idea a lot (pretty similar to what we seek, isn't it ?), until I discovered in the inline help that this feature is not supported in Vista Home Family nor Premium editions (nor on XP Home I've found out)!! Lolll. Isn't this flabbergasting ??

PS: Just posted on Norton's forum... the UAC tool has been discontinued since 2009 :-(
But the tech folks are willing to help, if possible, and get back to me later.

Well I don't know of any free open source parental control programs but I'll ask around here - someone is bound to know something.

I just came across this: Run UAC restricted programs without the UAC prompt | TechRepublic

Might be worth a try as well. I'd love to test these out for you first to save you some time but I've got UAC disabled so I can't.

Tom

aschwarzie · Jul 25, 2011

tom982 said:
I just came across this: Run UAC restricted programs without the UAC prompt | TechRepublic
Might be worth a try as well.
Tom

Thanks Tom, I tried that in detail. To summarise : it all works fine... for an Admin account. Indeed, the UAC is bypassed and I don't get prompted whether or not I'm sure I want to start this program (Allow/Cancel). But once the shortcut is copied to the desktop of my kids account it doesn't work anymore (neither if I create the shortcut from there) : when I start the shortcut there is a very quick CMD box flashing on screen and after a dozen of attempts I could see it displays "Error: Access denied".

Just to make sure this wasn't bound to the game, I created (as Admin) another task just to launch Calc.exe and tried to create a shortcut to the task scheduler to invoke it. Same issue. Tried it also on Windows 7, same behaviour.

And actually, it makes sense : otherwise it would mean that every task from the scheduler's library which name is known by a "standard user account" could be fired off without precaution. And I never was even asked to type the Admin password ! What would make sens is something like "ask the credentials ONCE and record these for THIS task/shortcut HERE"

So, to summarise, it looks like the only benefit I could see isto spare the Admin the consent effort. This can actually also be achieved by applying a security policy where "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" is set to "Elevate without prompting" (instead of default value "Prompt for consent"). See screenshot.
This can also be achived by creating in the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\
a DWORD named "ConsentPromptBehaviorAdmin" and its data set to value "0".

Unfortunately, the similar DWORD "ConsentPromptBehaviorUser" would only trigger between "Prompt for credentials" (value 1, default behaviour for Vista Home) and "Automatically deny elevation requests" (value 0) behaviours.

Sigh. This is sooooo crazy !

tom982 · Jul 27, 2011

I'm stuck for ideas, so I've asked for some help

Hopefully someone here will know what to do!

Tom

tom982 · Jul 27, 2011

I asked and I have been advised that you should upgrade to Windows 7 as it has "more lenient admin rights" and "won't ask for admin privileges".

Whilst you consider that, can you upload the .exe file of the program please? Attach it with your next post. I'll have a go at changing the manifest inside it to force it to run under a standard account. I've never done this before - or anything like this in fact - but its worth a shot

Tom

niemiro · Jul 27, 2011

tom982 said:
I asked and I have been advised that you should upgrade to Windows 7 as it has "more lenient admin rights" and "won't ask for admin privileges".

Whilst you consider that, can you upload the .exe file of the program please? Attach it with your next post. I'll have a go at changing the manifest inside it to force it to run under a standard account. I've never done this before - or anything like this in fact - but its worth a shot

Tom

Just be careful of copyright laws

(redistributing the binary...modifying the binary...derivative works...etc.) That is dangerous legal territory!

However, the manifest sets whether or the program required elevation (asInvoker|highestAvailable|requireAdministrator)

Upgrading to Windows 7 will not change that fact.

The programmer would not have gone above what he needed to. I guarantee that to you now.

If you modify that manifest, the program will Stop Working with Security Exceptions or Access is Denied return codes.

I know, because I have been there, done that, without the correct manifest before, forgetting that I was doing something which required admin elevation (in a production environment

) and I had my users complaining that the program stopped working on startup. Worked fine on my machine. About a week later, after many log files and a dump file, it clicked! Updated the manifest, and all was well!

Richard

aschwarzie · Jul 27, 2011

tom982 said:
I asked and I have been advised that you should upgrade to Windows 7 as it has "more lenient admin rights" and "won't ask for admin privileges".

Whilst you consider that, can you upload the .exe file of the program please? Attach it with your next post. I'll have a go at changing the manifest inside it to force it to run under a standard account. I've never done this before - or anything like this in fact - but its worth a shot
Tom

I have a Win 7 installation on this system too but all the games are still on Vista and I wasn't considering taking the leap before at least how it works was more clear to me (e.g. to avoid repeating the same scheme in Win 7). As my Win 7 ca, "see" Vista's disks, I tried to launch the game from there and it worked but it also requests me to confirm if I allow to "run this unknown code" (the famous UAC for consent under Amdin accounts).

As far as modifying the exe is concerned, after reading the post following yours, are you sure you still want to do that ? Besides, it appears that 4 .exe are in the "/bin" folder of the game with some .dll's and more. here is what this folder looks like:

Code:

 Directory of C:\Program Files\Frogster\Mythos\bin

21/07/2011  04:47    <DIR>          .
21/07/2011  04:47    <DIR>          ..
29/12/2010  03:25           167.936 binkw32.dll
24/12/2010  02:39         3.497.832 d3dx9_34.dll
27/07/2011  23:49                82 FileVersion.xml
21/07/2011  04:39           798.720 fmodex.dll
29/12/2010  03:25           492.032 granny2.dll
29/12/2010  03:25         1.568.768 libmysql.dll
21/07/2011  04:47         7.196.672 [COLOR=Blue][B]Myth.exe[/B][/COLOR]
23/03/2011  15:33           258.048 MythosGDF.dll
21/07/2011  04:39                82 NetworkInfo.ini
21/07/2011  04:36         6.238.208 [COLOR=Blue][B]PakTool.exe
[/B][/COLOR]21/07/2011  04:34    <DIR>          StringMsg
06/01/2011  13:36             2.025 StringMsg.txt
21/07/2011  04:47    <DIR>          Update
21/07/2011  04:36                70 UpdateInfo.ini
21/07/2011  04:36         3.293.184 [COLOR=Blue][B]Updater.exe[/B][/COLOR]
23/03/2011  15:10           409.600 [COLOR=Red][B]UpdaterRun.exe[/B][/COLOR]
06/01/2011  07:40            98.304 XPva03.dll
              15 File(s)     24.021.563 bytes

The setup process creates a shortcut pointing to UpdaterRun.exe.
The game also can be dowloaded and installed from Mythos Website.
Considering the above warnings, do you need some specific file from my installation ? I can pack it in a 7z archive and attach it.
Thanks again for your support. :-)

niemiro · Jul 28, 2011

Hello again!

This question has actually been discussed at great length before, and in fact there *is* one solution. However, that solution is not perfect, and you need to decide whether or not you want to use this solution. But to make an informed decision, you must first fully understand all of your options, and their implications.

This discussion is going to include the following topics:

encryption
encoding
passwords
security
layers of security
authentication
mathematics (only if I get carried away in explaining how encryption algorithms work - a fascinating subject - for a simple introduction to the simple RSA: RSA Algorithm Explained Using a Simple "Pencil And Paper" Method and for the proofs: RSA - Wikipedia, the free encyclopedia)
polymorphism and encapsulation (only joking about those last two! They are programming terms, and not relevant to this discussion)

Unfortunately, I do not have time to write this now, because I am going to the cinema with my new family :party:

I will be back later today,

Richard

How to run in standard account a program requiring admin cedentials ?

My Computer

٩(͡๏̯͡๏)۶

My Computer

My Computer

٩(͡๏̯͡๏)۶

My Computer

My Computer

٩(͡๏̯͡๏)۶

My Computer

Banned

My Computer

My Computer

My Computer

٩(͡๏̯͡๏)۶

My Computer

My Computer

٩(͡๏̯͡๏)۶

My Computer

My Computer

٩(͡๏̯͡๏)۶

My Computer

My Computer

٩(͡๏̯͡๏)۶

My Computer

٩(͡๏̯͡๏)۶

My Computer

Banned

My Computer

My Computer

Banned

My Computer