-4

Users in my domain are usually standard users, aka do not have Admin rights. However, there is one program that needs to be run as Administrator to function properly. Is it possible to permanently run this application as administrator while keeping everything else non-admin?

Run-as administrator will not work as they will have to provide the admin username and password, which they're not supposed to know. Creating a batch file creates a security hole, as the password is in clear text.

Hennes
  • 65,142
Brendan Long
  • 85
  • Also http://superuser.com/questions/109741/allowing-non-admins-to-run-programs-as-admins, http://superuser.com/questions/242839/run-a-program-without-administrative-privileges-in-windows-7/599391#599391, http://superuser.com/questions/614709/run-a-program-as-admin-all-the-time...In fact, it's been asked many, many, many times: http://superuser.com/search?q=run+program+as+admin –  Dec 23 '13 at 05:05
  • 1
    You're incorrect. I'm getting tired of users NOT reading questions and quickly posting garbage responses. I've been to that answer AND the one it links to. The first has no solutions that are secure enough. The second has no accepted answer, but did have a 3rd party solution. It was something I overlooked before, because I was hoping for a built-in solution.

    I've been through the rest. None worked. Don't automatically assume a person hasn't done his share of searching.

     – Brendan Long Dec 23 '13 at 05:42
  • 2
    The short answer is no: you're trying to put a Windows-shaped peg into a UNIX-shaped hole. Strictly, being an Administrator doesn't mean anything except "You are in the Administrators security group"; in itself that doesn't grant a user rights. It's tiresome and it's why we hate windows, but if the program demands it you have three choices:
    1. Make them administrators
    2. Figure out what it's trying to access that it can't, and using either ACLs or GP making it accessible (some software still won't care, and will demand to be run as an admin)
    3. Find another piece of software.
     – Bandrami Dec 23 '13 at 06:11
  • 1
    @BrendanLong I never suggested you hadn't done any research, I was merely trying to point out the fact that if a suitable answer existed, it would have been posted on those questions. As Bandrami pointed out, the answer is essentially "no". The reason I marked as duplicate is because this question is the same as the others, except with a tag line: "Without run-as admin or batch". That doesn't make it a new question, it makes it a duplicate question with a couple qualifiers. –  Dec 23 '13 at 13:47
  • 4
    @Brendan If you don't share your research, people can't guess which questions you've already seen and what answers you've already dismissed. Please read [ask] again. Also, you don't mention which OS you're using. – slhck Dec 23 '13 at 15:10
  • Moses is correct; this has been asked many times. In fact, in addition to always run a program as admin and run a program as admin without credentials and phraseology to that effect, it is also often asked as uac white-list. It has been asked many times and some solutions have been created, some okay, some less than ideal, but the fact is that unless Microsoft deigns us with the ability to white-list programs, it just can’t be done quite how we like and we’ll have to compromise and accept work-arounds. – Synetech Jan 04 '14 at 23:39

1 Answers1

2

Per Redmond:

http://support.microsoft.com/kb/922708

You cannot set UAC to automatically run a program as an administrator without the user being prompted.

Your bug is actually a feature. The user's token or tokens are what they are, and there's no equivalent of setuid that lets a file elevate that.

Sathyajith Bhat
  • 61,800
Bandrami
  • 1,903