You can use the Application Compatibility Toolkit to white-list an application so that it does not require administrative rights to run...sometimes. The process is pretty simple, but depending on how the application handles things, it doesn't always work. Here is a rough walk through of the process:
- Install the software you want to white-list on a computer.
- Download and install the appropriate Application Compatibility Toolkit (for you, that would be Windows 8.1 ACT) on the same computer.
- Launch the appropriate Compatibility Toolkit - either x86 toolkit if you need to white-list a 32 bit application or the x64 toolkit for 64 bit.
- Create a database and add a new "Application Fix" to it.
- Follow the "Application Fix" prompts to select the application and fill out appropriate details. The important thing is to set the "Compatibility Mode" to "runAsInvoker". This effectively white-lists the application...usually.
- On the final step of creating the "Application Fix" it will show a bunch of information on the application that it will use to "Match" the rule to. If you want this to keep working on a program that regularly updates, you'll need to remove any fields that reference a version number (after all, the version will/should change after updates).
- Once finished, you save the database as an "SDB" file.
- Install the "SDB" file on each computer using the following command:
sdbinst {Local path to sdb file}
I suggest using Group Policy to create a folder on the local machine, copy the SDB file plus a script to it, and run the script during computer startup. In that case your script will need to uninstall the existing SDB file using the 'n' flag, and install quietly using the 'q' flage. The commands for this would be:
sdbinst -n "database-name"
sdbinst -q {Local path to SDB file}
That said, this process will not work when an application downloads files, unzips them, and then tries to launch another application contained in the unzipped files (after all that is a different application as far as the computer is concerned). You can work around this by getting the update files, deploying them to a particular folder on the local computer (networked folders won't work, since the application would be copied to a temporary folder on the local computer before launching), and updating your white-list to point to the appropriate update applications.
This also just won't work for some applications. Depending on how well, or poorly, the application is setup, you may have no choice but to give the required users local admin access for the computers that run those files. I have that problem with some horrible manufacturing software (from an IT management stand point) that we have no choice but to use.
I have successfully used this process for applications such as UPS World Ship that regularly pushes out updates that require admin rights. This process has not worked for software such as Sage 50 Accounting that packages individual update files that are just wrappers for additional update files that all try to run from temp folder locations...
So, bottom line is, even though this is a possible fix to white-list an application for non-admin users, your mileage will vary from application to application. Other than this, you're looking for some application management software that will also handle pushing out updates...which may be too expensive (or plain overkill) for a small business.
Reference: Removing UAC Prompts with Compatability Toolkit