Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A university tries to run our software, but their users don't have admin rights.

However our software requires admin rights to run.

Is there a way to have their system admin create a privilege, just for our software or would this cause a (major) security loophole for their system?

Any other (reasonable) workarounds are welcome too, but changing our software is (sadly) out of the question. This problem occurs in both Windows XP and Vista.

share|improve this question
What is it that your app is doing that requires admin? – Simon P Stevens Aug 5 '09 at 9:20
up vote 4 down vote accepted

Yes, this causes a major security hole. If you have any bugs that allow arbitrary code execution or spawning of new processes then you have basically given the user full admin rights to the system.

I know you've said you can't change your software but if it's between that and a lost sale I'd strongly consider it, it's really not that hard to not require administrator rights.

What in particular requires the rights? Do you need to write to certain parts of the disk? Do you need raw access to a device? This would help clarify.

share|improve this answer
I agree. Your application shouldn't require admin unless it is very very specialised. – Simon P Stevens Aug 5 '09 at 9:19
The problem only surfaced recently, while the changes causing the need for admin rights were made over a year ago. You're right that it's not hard, however we hope to release a new version in a couple of months, so having to change our "old" software is "unwanted". – Ivo Flipse Aug 5 '09 at 9:22
What changes and what admin rights do you have? Sure it's unwanted but you've asked if it's a security hole and it is so it would be irresponsible to introduce an attack vector to the university without letting them know. – Mike McQuaid Aug 5 '09 at 9:25
Also, you didn't say what it was that demanded the rights. You can work around individual issues but giving the application full admin rights is just plain stupid and terrible software development. You'd be getting lynched if you posted this on stackoverflow (which you should have done) – Mike McQuaid Aug 5 '09 at 9:26
They changed our software to get it working under Vista, where they ran into trouble with the registry and the way Vista would create local databases for each user. However you should understand we have quite a specialized software (< 3000 users) and development is being done in Labview, which doesn't improve things. But I didn't write the software, I'm just trying to find a workaround. If this was asked on SO, the question would be about the reasons why we need admin rights, not a possible solution – Ivo Flipse Aug 5 '09 at 9:45

The best way I could thing of would be to use a runas replacement that saves passwords encrypted .. something like supercrypt.

share|improve this answer
This seems to be going in the right direction, curious if people have other suggestions like this. – Ivo Flipse Aug 5 '09 at 9:10

If the users are part of a domain, you can use a GPO to define a software restriction policy which allows only your application to run. Create accounts for the users and give them local administrator rights to the machines (preferably with this same GPO).

share|improve this answer
+1 - Customized GPO with administrative permissions is the best balance between security and usability in a large network. – EvilChookie Aug 5 '09 at 15:16

Take a look at Sudo for windows. It allows you to elevate normal users to admins for the scope of a single application.

I'm not sure if it will entirely work for you though as if you give the user sudo permission I don't think you will be able to stop them elevating other apps of their choice. Might be worth looking at though.

share|improve this answer

Couldn't your software be run inside of a virtual machine or sandbox, e.g. Virtualbox or Sandboxie or ICore Virtual Accounts?

Either on the user's machines or hosted on a server.

This will not make it any easier to install or to use, but will buy you some time until your software is modified.

share|improve this answer
I wonder how sandboxing would handle the database. I'll just give it a try ;-) – Ivo Flipse Aug 5 '09 at 13:32

I think that PrivilegeGuard from Avecto should do exactly what you are looking allows you to elevate the rights for a particular windows app, without giving full admin rights to the users. This all can be done for XP, Vista and Win 7.

share|improve this answer

This is absolutely possible, PowerBroker Desktop: Windows Edition allows you to elevate the rights of specific applications without elevating the user, you can define what additional elevation is given down to the SID(s) involved.

share|improve this answer

I assume you are searching a low cost solution, but if you can't find anything that fits, you could try Universal Shield. It works by restricting access per application and not per user. In terms of security, it's exactly what you need.

share|improve this answer

i just found this..

I am not sure how suitable it is for a work/school environment. but at home this works for me fine for a small number of admin utilities i use regularly.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .