Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a shared system, running Windows7 X64, restricted to a 'standard user' with no password. Not everyone who has access to the system has the administrator password.

This works rather well, except for some applications - specially the unlock-applications for encrypted hard drives/USB flash drives. The specific ones either require Administrator access (eg. Seagate Blackarmor) or simply fail without it -- since these programs are sending raw commands to a device, this is to be expected.

I would like to be able to add the hashes of these particular programs to a whitelist, and have them run as administrator without needing any prompts. Since these are by definition on removable media, I can't simply use a filename or even a path. One of the users who shares the system can be considered 'crafty', so anything which temporarily grants administrator rights to an user account is certain to cause problems.

What i'd like to be able to do: 1) Create an admin account that can only run programs from a whitelist (or, failing that, from a directory) I can't find a good way to do this: As far as I can tell, SRP applies equally to ALL users? Even if I put a "Deny" token on all directories on the system, such that new directories would inherit it, it could still potentially run things from the mounted USB devices. I also don't know whether it's possible to create a new directory that DOESN'T inherit from the parent, that would lake the deny token, and provide admin access.

2) Find a lightweight service that will run these programs in its local context Windows7 seems to block cross-privilege level communication by default, and I haven't found such for windows 7. One example seems to be "sudo" (http://pages.cpsc.ucalgary.ca/~nfriess/sudo/) but because it uses a WLNOTIFY hook, it won't work under Vista nor Windows7

Non-Solutions:
- RunAs: Requires administrator password! (but everyone calls it "sudo" anyway)
- RunAs /savecred: Nice idea, but appears to be completely insecure.
- RUNASSPC - Same concept as RunAs, uses "encrypted" files with credentials, but checks in user-space.
- Scheduled Tasks - "Fixed" permissions make this difficult, and doesn't support interactive processes even if it did.
- SuRun: From Google: "Surun uses its own Windows service that adds the user to the group of administrators during program start and removes him automatically from that group again"

share|improve this question

migrated from superuser.com Jan 3 '11 at 11:50

This question came from our site for computer enthusiasts and power users.

    
Can probably be done using group policy, must be Pro or Ultimate to do this. –  Moab Jan 3 '11 at 1:30
    
@moab, I had thought it was possible, but I can't find any way to restrict a secondary admin account). –  frLich Jan 3 '11 at 1:45
    
Found this, not sure if it will help....4sysops.com/archives/… –  Moab Jan 3 '11 at 1:48
    
this is why i use truecrypt...it works without admin rights: geekknowhow.com/page_1264859152229.html –  aking1012 Jan 3 '11 at 5:47
    
Truecrypt only works without admin rights if you use the "/savecred" option. Those saved credentials aren't just restricted to truecrypt... –  frLich Jan 3 '11 at 7:57
show 1 more comment

2 Answers 2

There is the ability to use a manifest file located in the same directory as the admin requiring app, if app is app.exe the manifest would be app.exe.manifest

Some info on msdn.

share|improve this answer
add comment

Maybe it could do the trick: In Local GPO or through domain ones, give users the "load and unload device drivers" to standard users.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.