11

I'm want to grant a user administrative rights to one application on Windows 7. I don't want them to be able to have full admin rights, but admin rights are required for one of the applications they need to use.

Is there a way to set up a batch script or something where the user won't know it's being run as admin?

Or is there another way?

How can I accomplish this?

Frantumn
  • 966

5 Answers5

7

I have used RUNASSPC with great success. It allows you to create a short cut to the program with encrypted administrator credentials.

So the program is run with administrative privileges even if started from a normal user account, but the normal user can't (easily) access the administrator credentials.

Many examples are available here.

Ajasja
  • 736
  • 1
    Free for private use??? That's means I cannot use it at work!!! – MUY Belgium Oct 13 '14 at 09:20
  • Yes, that would appear to be the case. 4€/computer is not that much. I Guess you could ask them if you can only buy one license. Or of course use something else eg., http://jc.bellamy.free.fr/en/superexec.html – Ajasja Oct 13 '14 at 09:29
2

CPAU:

Summary

Command line tool for starting process in alternate security context. Basically this is a runas replacement. Also allows you to create job files and encode the id, password, and command line in a file so it can be used by normal users.

You can save "jobs" for later. It encrypts the password.

cpau -u joehome\joe -p logon -ex "perl cleanup.pl" -enc -file cleanup.job

Creates job file called cleanup.job to run perl script cleanup.pl as joehomejoe

cpau -dec -file cleanup.job -lwp

Execute job file cleanup.job

:)

Community
  • 1
Luiz Angelo
  • 1,407
1

so are you saying you have this program exe1.exe and this program launches another program (e.g. exe2.exe) and you want to have it run exe1 without admin privileges but run exe2 with admin privileges?

if so setting exe2's compatibility mode to require admin privileges should work.

find the exe you want run as admin, open its properties dialog, go to the compatability tab and check run this program as administrator (as highlighted in this image google found for me:

run as administrator

if they are not separate executables I don't think it is possible.

Devid
  • 6,357
  • 13
  • 56
  • 75
chipgw
  • 21
  • 1
    What? Where did you get the second program from? They want to allow a user to run *a* program that requires admin privileges without giving them universal admin rights. – Synetech Nov 30 '12 at 17:33
  • @Synetech he said "I don't want them to be able to have full admin rights, but admin rights are required for one of the applications they need to use." that sounded like one program launching another to me... – chipgw Nov 30 '12 at 17:42
  • 1
    Strange that you got that from the line. It seems obvious to me, perhaps because it’s not exactly a unique situation; it’s come up plenty of times before. – Synetech Nov 30 '12 at 18:05
  • Sorry Chip, Syntech is right. Thanks for the answer tho. – Frantumn Nov 30 '12 at 19:38
1

I think I found what you are looking for, it's a program that is free and it should do what you are hoping to accomplish.

Runas-GUI

This is intended for a domain admin type setup, but it looks like you can do it locally.

Simply on your administrator side you would build the RAG file (an encrypted file hosing the admin credentials for the client to use). You would set the permission to the file/program available to be run as an admin.

Then you would copy the RAG file over to the non-admin side and install the CLIENT for Runas-GUI. Then import the RAG file and they should, theoretically, have access.

nerdwaller
  • 17,384
1

You can create a scheduled task that runs the target application. Set the scheduled task to run with credentials that have administrator rights. You can create a shortcut to run the scheduled task for users that only have standard credentials, but when the task runs it will still use the administrator credentials.

Joel Coehoorn
  • 28,180
  • Are there any security concerns from doing this? Privilege escalation or whatnot? – ChimneyImp Nov 30 '12 at 20:46
  • 1
    It means any user on that machine can run that program, not just the one you want to give access for. Also, I'm not 100% sure it will work, because you may still need to pass a UAC prompt. – Joel Coehoorn Nov 30 '12 at 21:13