Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Here are my two questions:

  • How can I start any application with Guest permissions by default?

  • How can I set certain applications not to launch with Guest permissions?

For the first bullet, any non-Microsoft signed application I launch should run as the Guest account.

For the second bullet, I'm imagining adding menu entries like this would be a nice approach:

  • Set to run as Guest (= default selected entry)
  • Set to run as User
  • Set to run as Admin

But how do I do this?

share|improve this question
    
So this is for Windows? Which version(s)? What have you tried already? :) –  techie007 Jun 16 '12 at 15:08
    
Tags adjusted. Dunno what to try, I don't know how to do the "by default" part. –  Tom Wijsman Jun 16 '12 at 15:11
    
To get things to run as Guest by default would be probably be easiest to accomplished by logging in as a guest user. Then perhaps you could wire in batch files with RunAs for running certain programs and processes with higher credentials? Not sure how you would base it on certificate signing though. VBS or PowerShell instead of Batch files perhaps? To make the checking and running seamless you might be getting into the territory of building a custom launcher by then, replacing Explorer. Plus perhaps some kind of metadata DB to hold references to the flags you want in your menu? :) –  techie007 Jun 16 '12 at 16:47
    
Just curious, what're you trying to achieve here? If your user account isn't running as guest, then it would be trivial for somebody trying to exploit the system to run something as the non-guest user. If you're just doing it for your own protection, why not just run the guest account with UAC on? Is there a particular quality of the guest account specifically that you need? Just curious what you're trying to accomplish here. –  nhinkle Jun 19 '12 at 5:43
    
@nhinkle: Disallowing any application from doing anything with my personal files by default, such that I can choose which applications are eligible to change them. I'm not trying to protect against someone who knows my system, but rather against a random event where some of my files would be uploaded / overwritten / corrupted / injected / removed. For this, I'm wondering if there is an existing approach to it rather than directly starting with low-level and accidentally reinventing the wheel. So, I'm looking for someone who had prior experience; unless nobody cares to protect their data. –  Tom Wijsman Jun 19 '12 at 13:23
show 3 more comments

1 Answer

Assumption is that this is a Windows 7 System.

If you have UAC (User Access Control) turned on atleast on the recommended level (Control Panel->User Accounts -> Change UAC settings... Default level) then what is happening is that you by default when you log into Windows, you aren't running as "Full" Administrator. That is why you get prompted from time to time about whether you want to run something as Administrator.

So if you are running some program and then it asks for confirmation then only afterwards is the program running with Full Security privileges.

In order to force a program to run as a specific user or have special privilages, check out The Microsoft Application Compatibility Toolkit. You can select what application and what 'Fix' to apply. This will get you away from messing with shortcuts and runas in the target.

Here are a couple of other ideas actually: neowin.net. Noticed that one about scheduled tasks, pretty nifty idea.

But if your main worry is about security, then increase the UAC to the Always Notify. You can also look at Application Sandboxes like Sandboxie.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.