0

we have a shortcut that is calling a .exe file that requires admin rights by the UAC. I would like to be able to run the application without any admin rights or give the standard user admin rights only to this .exe. What we have done and failed.

  1. Application properties >> security >> Advanced >> Permissions >> Full Control
    to local group A (which includes the user) and user by them self.

    1. Gave ownership of folder to local Group A.

    2. I looked in Regedit and I see the user, and they have full control for that application.

    3. have checked run as admin and unchecked too. We do not want to use /savecred because of security risk. What other steps can we take to find a solution.

Window 10 and on a domain

6
  • Full control on the file object won't let the program run as administrator. Also, if you allow the user to modify the program and run it as admin, they can do anything imaginable to the computer. Additionally, if the program in question can launch other programs (does it ever show an open-file dialog?), the user can launch anything as admin. You should look into Windows compatibility infrastructure rather than trying to do this.
    – Ben N
    Feb 11, 2016 at 16:13
  • You cannot run a program as an Administrator without escalating the permissions of a process by authenticating as a user with permission to escalated the permissions of a process. By default a process will only esclate the permissions of a process, if that request is made by the user ( or configured by a user to do so ), but both require authenticating as a user with the escalated permission.
    – Ramhound
    Feb 11, 2016 at 16:17
  • they are still getting a UAC message. And full contol was only given to a one folder in hopes it would work, which it didnt. @ Ben , i will look at compatibility infrastructure. Feb 11, 2016 at 16:34
  • And I thought if you use /savecred, then they can run other applications. Which I have not set, for that reason. Feb 11, 2016 at 16:37
  • @cocominion - It does. runas also does. Determine which permission that program actually needs, in other words, determine the reason it wants Administrator permissions. 99% of applications don't require it, and if they do, its not typical a feature a normal user should be using anyways.
    – Ramhound
    Feb 11, 2016 at 16:55

1 Answer 1

0

If you are trying to give them admin credentials to run a program because of a software restriction group policy. It would be best to define a trusted path to a hidden folder and put the program there.

You could consider maybe using a local admin account for /savecred too.

2
  • 1
    I was thinking about doing this, Make a local admin then make a crazy password. but I still don't like this because of the fact that they can use the /savecred to any other application. Feb 11, 2016 at 16:41
  • 1
    I was looking into an application called runaspcadmin, have you used it robotronic.de/runasspcEn.html Feb 11, 2016 at 16:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.