Need help - how do I make a program run as administrator?

[bigfoot]

I loaded our whole company with XP Pro. I have a program that updates it's files each day that no longer runs because I made the users as "users", and not admin's of their machines.

This program needs permissions to delete it's files and refreash them. Also it needs to get a new version of itself from our intranet when I make changes, but because I removed the "install" permissions from the users, it crashes.

How can I keep my users from installing stuff (from the internet), and still be able to run programs that update themselves.

I am new to Active Directory.

 

[bcastner]

You want to use a batch or CMD file that includes the use of the RUNAS command line.

If you do a Google search you can find lots of examples.
If the batch file was in a system directory it would not be editable. You could even have its properties set as Hidden.

 

[bcastner]

In the interest of completeness I should also point out that the Scheduled Tasks feature allows you to assign RUNAS permissions for a sheduled job. This might fit into your needs perfectly.

 

[bigfoot]

I need to give my application runas permissions then?
I don't want to run it in a batch file. It is an application like word that the user will be running all the time. It needs to create and delete files on the drive, but it does not. I have to find out why. I think it's a security issue.

 

[bcastner]

I am certain it is a security issue.

Two things you can do:

1. Move the program out of C:\Program Files

This directory area is protected usually from a users ability to modify, install, etc..

Create a New Folder: C:\Organization Files

Grant the Group Everyone full permissions to the folder. Or whatever is appropriate, by as Administrator right-clicking the new folder, Security, and grant the permissions to Everyone.

2. Grant selective permissions to C:\Program Files\your program. Add the Group Everyone to just this folder by doing the steps outlined above.

 

[bigfoot]

Hey bcastner... My program installs itself into C:\Arett2003\MyApp.exe, so I'm ok here.

I added the everyone group, and the program works great. Thanks. And it has a \data\ folder under it, so I told it to trickle down to that folder too.

Now I have another problem. My program gos out to the our intranet and gets updates. This does not work because WiseUpdate needs to get to the registry, and the security won't let it.

I shell out the WiseUpdt.exe program from my VB progtam, so I guess I can shell the RUNAS command to call the WiseUpdt.exe.

How do you compile the batch file so they can't see the administrator password?


How about power user(s)? I think they can still install stuff.

Sorry for all the questions, but I am a developer. Not a systems person.

Gary

 

[bcastner]

As Administrator, run regedit. Find the registry keys that are edited by your programs installation. Right-click the master key, Permissions, and apply permissions to Everyone.

 

[golflover]

Hey bcastner, is there a way of finding what keys are used by a particular program?

 

[bcastner]

golflover,

I use a freeware tool called rmon from the terrific freeware package PSTOOLS by Sysinternals:

http://www.sysinternals.com