Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a company internal application placed in a network shared folder on a Windows Server 2003 server. Users who need to access this folder have proper permissions in place and can list the directory contents, save files, open and modify files, etc. In essence, everything a user needs to do with this folder is accessible without a password prompt (network share is created on local workstation via logon scripts) except when attempting to run a program. Users access the program via a shortcut placed on the desktop to the application location.

Any (limited) users who are not a domain or local account admin that attempts to run the application, is prompted for an administrator password. No other actions within this netwrk share prompts the user for the admin password. I need to have this application accessible to limited account users without prompting for a password every time it is attempting to run. Windows server 2003 and Windows 7 will allow setting compatibility mode because Compability modes cannot be set on this program because it is located on a network drive.

The program changes often currently because of requests made by end users. It is then recompiled and placed back on the network drive for usage.

Without placing the program on each individual computer, or giving the limited users admin rights, how can I make Windows 7 run this program without prompting for passwords?

share|improve this question
4  
Since you are recompiling the application, I assume you have some level of control over its design. Why not fix the application so that doesn't require admin access. –  Zoredache May 10 '12 at 17:10
    
@Zoredache Good advice. Restructuring the program in a way that will stop hitting some 'Elevate this to administrator rights' trigger may induce less headaches than figuring the Windows aspect out. Although, I am unsure why a program in C++ with network capabilities on a network server would raise such a flag.... –  PenguinCoder May 10 '12 at 19:31
2  
@Zoredache Will you please post your first comment as an expanded answer so that I can accept it as the solution? –  PenguinCoder Jun 4 '12 at 20:22
    
Batch files are problematic when ran from a network share. Any command that parses paths, such as ~dp0 or CD.exe would choke. –  djangofan Sep 10 '12 at 18:56

4 Answers 4

On the local machine make a batch file that runs the app and set the compatibility mode on the batch file

share|improve this answer
    
The compatibility mode option I need is to 'Run program as administrator' for all users. Utilizing a batch file would be insecure, if I had to put the password in plaintext to run this program. Attempting to start the program from a batch file without the 'Run as admin' option, fails to initiate the application. (Never loads) –  PenguinCoder May 10 '12 at 17:01
    
The password isn't stored in plaintext, it is set in the compatibility options for the batch file the same way as you would set it for an app and gets passed on when you call start app.exe or whatever. You can set the batchfile to readonly by their user to stop them changing it to point at other apps. It isn't ideal but running an app off a network share as admin is inherently insecure already. –  JamesRyan May 11 '12 at 12:00

I administer an application that has many of the same requirements. When moving to Windows 7 there were significant hurdles. Please check out Microsoft Application Compatability Toolkit. There is a tool included Standard User Analyzer that will monitor your application and build shims to allow it to work in a UAC environment.

In addition I had to build a go between application that mounted the proper drives when elevated since an elevated process loses the mapped drives.

share|improve this answer

It may be a group policy is blocking the action, such as software restriction policies or AppLocker. You may want to run gpresult /h gpreport.html and review the settings.

It's possible to permission folders to prevent running applications. This is may be done for security, malware prevention, or even performance purposes.

Ensure that users have Execute permission, or that the Execute permission is not denied to a security group that they are a member of.

share|improve this answer
    
Thanks for the great advice. However, after getting a gpresult report and verifying it thoroughly, nothing is amiss in regards to permissions. Limited users have permission to this folder for 'Full access' as well as 'Execute'. Effective permissions show that there is no reason the user would need to elevate permissions to run the program. (And it is in attempt to run the program (UAC prompt) not a network/folder access (Network dialog) prompt ) so that is my mistake in the original question. –  PenguinCoder May 10 '12 at 19:29
    
How are you copying the file to that location? You may want to use the chml utility to view the file integrity level metadata. minasi.com/apps –  Greg Askew May 10 '12 at 20:27
    
There is no group policy, you simply can't set compatibility options on network shares as this opens all manner of cans of worms. –  JamesRyan May 11 '12 at 11:58

Creative approach: Why not create a local batch file that first checks whether the program on the network drive has been updated, if yes copies it to local disk, and then runs the program locally? Should also yield better performance since the program goes over the net only one time. I hope its possible to set the compatibility mode for the batch file, if the batch file is stored locally. (This is not tested, just a quick thought...)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.