Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a program installed on my W2k8 R2 server which needs admin rights to start.

I have 5 users using remote desktop to remote into the server to use that program. I don't want to give those users admin rights, but I do want them to be able to run the program properly.

Is this possible?

share|improve this question
add comment

5 Answers 5

Your best bet is to figure out which registry keys and directory locations that the program needs access to, and give your users access to just those areas.

You can use a tool, like Process Monitor from Sysinternals for that. Simply log in as the user, start Process Monitor, and run the program and make note of the areas denying access.

I would probably use a Security Group in AD, and then give that Security Group access to those system locations. All you would have to do then is add users to that Security Group and they will be able to use that program on that system with their own credentials.

share|improve this answer
add comment
up vote 2 down vote accepted

Thanks for the answers, this is how I ended up solving it:

  1. Create a Scheduled Task in the task scheduler. The scheduled task launches the application. Set the task to run at highest privilege level.
  2. Create a shortcut on the desktop of all the users needing to run the application. The shortcut ended up looking like this: C:\Windows\System32\schtasks.exe /run /tn "Name of task"

The only downside of this is that i need to create a separate task for every user, but I think it works just fine.

Thanks everyone.

share|improve this answer
    
Hi, how are you having the scheduled tasks show up when running as a different user? Eg. run iis.msc as a different user via this method doesn't show up the mmc console for it, but the process is running (can see via taskmanager). –  Kvad Sep 7 '10 at 1:07
    
That's a very creative solution. You can also use the runas command through a batch file as well: technet.microsoft.com/en-us/library/cc771525%28WS.10%29.aspx –  Cypher Sep 12 '10 at 8:53
add comment

Definitely use Cypher's suggestion. I've solved many pesky application issues by granting a user modify rights to specific install directories via security groups (and if needed reg keys). Unfortunately this assumes a half way competent programmer wrote the app and there aren't one or two files in c:\windows or c:\windows\system32 that needs the same access.

share|improve this answer
    
Yeah, that happens sometimes, but you can set security on a single file; you don't need to give read access to the entire directory... unless it needs to write there. Haven't run into that yet... :) –  Cypher Sep 12 '10 at 8:47
    
I have. There was a time clock application I supported which referenced a config file in C:\windows, and every time the app would read the file it deleted the file, recreated it from the app prefs configured else where on the computer than read the file. Can't open security to a file in that case. –  edusysadmin Sep 13 '10 at 22:52
add comment

The only downside of this is that i need to create a separate task for every user, but I think it works just fine.

Why not create an "applicative user" - used only for the task and that only you know the PW for.

This way you dont need to create a separate task per user and at the same time grant this user admin rights to the app.

share|improve this answer
add comment

Windows doesn't have the "setuid" concept from UNIX. There's really only two ways to get to where you're after:

The first option is to do a "run as" type scenario, where the logged-in user needs to have the appropriate password for the elevated user. The other is to write a "helper" service that runs with administrator privileges (as services generally do) which will then grant elevated privileges to the user for that one process.

I'm a bit fuzzy on the details of this second option, but I've seen it done before at a company where I used to work.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.