Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 2 down vote favorite
2

How can I enable non-admin users to run a certain application (in my case, a script) with admin permissions on Windows XP?

This would be similar to the setuid bit on *nix.

share|improve this question
Remember though that yous script likely runs through an interpreter. And Said interpreter needs the access. So the user is free to do anything the scripting language would allow him. I'm not aware of restricting access to only a certain command-line; that's only program-level restriction, afaik. – Joey Feb 17 '10 at 11:00

1 Answer

up vote 5 down vote

There may be a better way to do this, but:

  1. Create an administrator account dedicated for this purpose
    -> Users can now right click and do "Run As"
  2. Apply group policy for that administrator account so they can only run the processes required

You may also want to add the administrator account to "Deny Login Locally" and "Deny Login Remotely", so they can't log in. However I do not know if this prevents them from using "Run As" command.

share|improve this answer
1  
Couldn't they just alter the group policy as well if they're administrator? I mean, “Administrator” means “You're free to do as you please”—is it even possible or feasible to lock-in such a user? – Joey Feb 17 '10 at 10:54
If the process that they are granted access to run in Group Policy allows modifying the registry, yes. However, if they are only allowed to run notepad.exe then they are severely limited to what they can do. Conceivably they could use notepad to write a batch file that parses the registry.pol files for Group Policy and change what processes they are allowed to run, save the batch file into another administrator's startup folder and wait for the other administrator to log in. If these are public terminals with software like DeepFreeze installed and nightly reboots this is less of a problem. – ta.speot.is Feb 17 '10 at 12:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.