6

I have a company internal application placed in a network shared folder on a Windows Server 2003 server. Users who need to access this folder have proper permissions in place and can list the directory contents, save files, open and modify files, etc. In essence, everything a user needs to do with this folder is accessible without a password prompt (network share is created on local workstation via logon scripts) except when attempting to run a program. Users access the program via a shortcut placed on the desktop to the application location.

Any (limited) users who are not a domain or local account admin that attempts to run the application, is prompted for an administrator password. No other actions within this netwrk share prompts the user for the admin password. I need to have this application accessible to limited account users without prompting for a password every time it is attempting to run. Windows server 2003 and Windows 7 will allow setting compatibility mode because Compability modes cannot be set on this program because it is located on a network drive.

The program changes often currently because of requests made by end users. It is then recompiled and placed back on the network drive for usage.

Without placing the program on each individual computer, or giving the limited users admin rights, how can I make Windows 7 run this program without prompting for passwords?

Improve this question
4
  • 4
    Since you are recompiling the application, I assume you have some level of control over its design. Why not fix the application so that doesn't require admin access.
    – Zoredache
    Commented May 10, 2012 at 17:10
  • @Zoredache Good advice. Restructuring the program in a way that will stop hitting some 'Elevate this to administrator rights' trigger may induce less headaches than figuring the Windows aspect out. Although, I am unsure why a program in C++ with network capabilities on a network server would raise such a flag....
    – PenguinCoder
    Commented May 10, 2012 at 19:31
  • 2
    @Zoredache Will you please post your first comment as an expanded answer so that I can accept it as the solution?
    – PenguinCoder
    Commented Jun 4, 2012 at 20:22
  • Batch files are problematic when ran from a network share. Any command that parses paths, such as ~dp0 or CD.exe would choke.
    – djangofan
    Commented Sep 10, 2012 at 18:56

4 Answers 4

Reset to default
1

On the local machine make a batch file that runs the app and set the compatibility mode on the batch file

Improve this answer
2
  • The compatibility mode option I need is to 'Run program as administrator' for all users. Utilizing a batch file would be insecure, if I had to put the password in plaintext to run this program. Attempting to start the program from a batch file without the 'Run as admin' option, fails to initiate the application. (Never loads)
    – PenguinCoder
    Commented May 10, 2012 at 17:01
  • The password isn't stored in plaintext, it is set in the compatibility options for the batch file the same way as you would set it for an app and gets passed on when you call start app.exe or whatever. You can set the batchfile to readonly by their user to stop them changing it to point at other apps. It isn't ideal but running an app off a network share as admin is inherently insecure already.
    – JamesRyan
    Commented May 11, 2012 at 12:00
1

I administer an application that has many of the same requirements. When moving to Windows 7 there were significant hurdles. Please check out Microsoft Application Compatability Toolkit. There is a tool included Standard User Analyzer that will monitor your application and build shims to allow it to work in a UAC environment.

In addition I had to build a go between application that mounted the proper drives when elevated since an elevated process loses the mapped drives.

Improve this answer
0

It may be a group policy is blocking the action, such as software restriction policies or AppLocker. You may want to run gpresult /h gpreport.html and review the settings.

It's possible to permission folders to prevent running applications. This is may be done for security, malware prevention, or even performance purposes.

Ensure that users have Execute permission, or that the Execute permission is not denied to a security group that they are a member of.

Improve this answer
3
  • Thanks for the great advice. However, after getting a gpresult report and verifying it thoroughly, nothing is amiss in regards to permissions. Limited users have permission to this folder for 'Full access' as well as 'Execute'. Effective permissions show that there is no reason the user would need to elevate permissions to run the program. (And it is in attempt to run the program (UAC prompt) not a network/folder access (Network dialog) prompt ) so that is my mistake in the original question.
    – PenguinCoder
    Commented May 10, 2012 at 19:29
  • How are you copying the file to that location? You may want to use the chml utility to view the file integrity level metadata. minasi.com/apps
    – Greg Askew
    Commented May 10, 2012 at 20:27
  • There is no group policy, you simply can't set compatibility options on network shares as this opens all manner of cans of worms.
    – JamesRyan
    Commented May 11, 2012 at 11:58
0

Creative approach: Why not create a local batch file that first checks whether the program on the network drive has been updated, if yes copies it to local disk, and then runs the program locally? Should also yield better performance since the program goes over the net only one time. I hope its possible to set the compatibility mode for the batch file, if the batch file is stored locally. (This is not tested, just a quick thought...)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .