Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm in the process off migrating a legacy application that has been running under Windows XP to Windows 7. This app pulls updates and setup installers for child components. These are run under the user's non-admin account. This of course works fine in XP but without admin rights in Windows 7 the app cannot run the installers (unfortunately this architecture is a requirement for the immediate term).

My question is how can I allow the users to run the installers? As this is a corporate environment giving these users admin rights is out of the question. They are however a very specific set of custom applications so a broad allow any installer is not needed (and probably wouldn't be allowed). It's my understanding that I can allow rights for specific directories and/or applications but I've had trouble finding out exactly how to do this. Another option I've been looking at is changing the code to run the setup under elevated permissions but that would require me to have login credentials stored somewhere for the admin account. I've been leaning to the first but would appreciate any thoughts on the matter someone might have.

share|improve this question
Presumably this legacy application itself would require admin privs to be installed. If so, then why can't it also install these additional items while the process is already elevated? – HairOfTheDog Feb 13 '13 at 20:02
The current process re-installs the applications as updates are pushed out to production. Also if the user doesn't have rights to 'see' the application it never shows up as an option. A manager (whom still is a standard user) logs in the morning and the app pulls any updates and reruns the installers. Long story short they still need to exec the installers after the initial setup. – Siegmund Nagel Feb 13 '13 at 20:12
Sounds like something Microsoft's Server Update Services could take care of. – HairOfTheDog Feb 13 '13 at 20:14
@SiegmundNagel - Do these applications actually need to be installed to work? Many applications once installed once don't need to be installed. It sounds like you need to think about how this system works because as you have found it WILL NOT work going forward. Honestly what you used was a poor idea even when it did work. – Ramhound Feb 13 '13 at 20:16
@Ramhound - I agree but it wasn't my design. It's well over 10 years old. Unfortunately it's huge and while a complete rewrite is in discussion it is not on the table at the moment. I have to work within the current bounds with some leverage to make coding changes in the legacy code. To answer your question yes the apps must be installed to work. The legacy code has heavy usage of COM components that need registration. – Siegmund Nagel Feb 13 '13 at 20:25

I'm assuming you are configured with a domain.

You might consider creating a scheduled task using Group Policy to allow secure deployment of elevated credentials that can be used to give admin rights to your software. At the very least that should work until you can get the code updated.

Take a look at this

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .