4

On *nix, admins can use the setuid flag to allow non-admins to run certain programs that would otherwise require admin privileges. Is there any way to do something similar in Windows 7?

This question has been asked here before for Windows XP, and the answers were generally unsatisfying. I'm wondering if Windows 7 provides a better way.

One idea I can think of would be to use Microsoft's Subsystem for UNIX Applications, but I'd rather not install that on every user's system if I can avoid it.

Another idea I can think of (which would work on XP too, but I haven't seen it mentioned anywhere) would be to create a RunAsAdmin application that runs as a service, that takes a whitelist of "safe" apps and can be asked (from a command line, batch file or script) to run any program on the list as LocalSystem or whatever account the service uses. Is this possible?

Are there any solutions that aren't as clunky as those? Or, has anyone implemented either of the above techniques successfully?

2
  • 2
    There's no setuid, not even with SFU. And if you did a service like you suggested, users could just rename any executable to match what's on the white list. Also, programs run as a different user wouldn't have access to the logged-in user's network drives, network printers, or other services.
    – Chris S
    Mar 29, 2010 at 22:56
  • I got the setuid idea from this: technet.microsoft.com/en-us/library/cc770863.aspx. As for the service, I'd have to use checksums or signed code for the whitelist.
    – Josh
    Mar 31, 2010 at 18:19

4 Answers 4

7

It may be fruitful to investigate why the program needs admin priveledges. If it comes down to things like file or registry permissions, then you may be able to get the program operating under non-admin credentials by adjusting permissions to grant the user access.

4
  • This is fine for network permissions, but if I want to grant all users access to certain locations on their local machines? I suppose a startup script could do this with cacls.
    – Josh
    Mar 31, 2010 at 18:16
  • Or a batch run as part of the application installation. The difficult part is figuring out the permissions that are required. Setting them up is easy. Mar 31, 2010 at 18:37
  • So, in conclusion: there is no general solution, but workarounds can often be found on a case-by-case basis. That's good enough for me for now.
    – Josh
    Mar 31, 2010 at 18:38
  • I think what Chris says is the best workaround. The solution should be to get the application developer to fix the bug in their program -- unless you're doing some kind of local system administration task then requiring admin privs to run an app is a bug imho.
    – Rob Moir
    Aug 28, 2010 at 6:07
4

The question should not be "how do I grant admin privileges", the question should be how to I get the correct priviliges to the user to run the application. In windows, "admin privileges" refers to a collection of privileges that an admin gets by default. There are very few applications that require all of those privileges. You should audit the applications privilege use and adjust the user rights accordingly (preferably by creating a group and assigning the rights to that group). This concept is known as the Principle of Least Privilege

2
  • That is not quite the Principle of Least Privilege. With file permissions I can give a user no write access or unrestricted write access to a particular file, but nothing in between. I can't control what or how they write to it. With a setuid application I can have a file be only writable to users on my own terms. (As a contrived example, I could make the hosts file unwritable by users, but provide a validating editor for the file that runs with higher privileges.) This is actually a tighter application of the principle.
    – Josh
    Mar 31, 2010 at 18:03
  • Actually there are 676 possible file permission combinations in windows any of which can be set. In your example you are not changing file permission you are efectivly running the application as a different user (that's why it's setuid not setfilepermissionID). There is no unix file permission that controls what is written to a file, they are binary states - true/false. The principle of least privilige would avoid setuid. To put it another way why shouldn't a user be able to run an application as a normal user and only need to get admin rights for that application when the app requires it
    – Jim B
    Mar 31, 2010 at 20:39
1

http://www.technize.com/how-to-always-run-programs-as-administrator-in-windows-7/

  1. Right click the program you wish to grant administrative privileges
  2. Go to Properties –> Compatibility Tab
  3. At the end of the compatibility tab, you will find the following check box: Run this program as an administrator
  4. Just check the check box and click OK and then again OK.
  5. This will grant administrative privileges to that program permanently.

If you want to grant the program administrative privileges for all the users, then you can do so by going again to compatibility tab and clicking Change settings for all users.

Check the check box which says Run this program as an administrator.

Now the program will run in administrative mode for all the users of the system.

2
  • Hmm, this could be useful in some cases, but seems to have limitations. First, the "Run this program as an administrator" option seems to be disabled for .bat files. Second, all of the compatibility settings are disabled for files on a network drive.
    – Josh
    Sep 9, 2010 at 16:13
  • @Josh Me too same problem. Please help me Jul 23, 2013 at 10:08
1

Look into RunAsGui. It allows you to store an encrypted credentials of an admin for a given program you want to allow your users to use. It's free.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .