Allow user to run a few program only, using 'run as'

[nos]

I have a VoIP program that requires admin level privileges to run (messed up, I know) but I don’t want to give every user admin rights. What I’ve done is that I’ve created an admin account that i want people to use exclusively for the VoIP phone. I’ve managed to hide this account from the ‘Welcome’ screen but a user can still abuse this account ( DUH! ). I looked into group policy to find an option that would allow me to ‘deny local logon’ to this admin while at the same time allowing him to run the VoIP phone. The ‘Deny local logon’ option doesn’t work cause that denies the admin from executing the VoIP phone. Is there any other way to solve this problem i.e. restrict an admin to execute just a single program while denying him the optin to logon using that account.

[TofiBaba]

Re: Allow user to run a few program only, using 'run as'

Have u checked to see why it (VoIP app) requires admin priv? You may just be able to get by with giving the user (or domain group) change or full permission on the HKLM/Software/VoIPApp section of the hive.

Another thing you can try is start up that app with the user's login paramaters. In the user/group profiles you can specify to start certain apps (even using GPO's). I never tried that out personally so I don't know how it works exactly, but i have restricted out "all else" and allow only certain appls for restricted users.

[nos]

Re: Allow user to run a few program only, using 'run as'

I'm not sure why the app requires admin level privileges ... I don't know what changes it is making to the system. I searched for a corresponding key in the registry but couldn't locate anything.

How can I start an app using certain credentials? The only way i can recall is by registering the app as a service and then starting it with some given credentials. Is this what you were referring to? I don't know of any GPO setting that can help achieve the mentioned task.

Any other ideas baba G ?

[TofiBaba]

Re: Allow user to run a few program only, using 'run as'

What application is it? I can play around with it when I'm back in the office and see what we can accomplish.

[nos]

Re: Allow user to run a few program only, using 'run as'

any updates chief? Did you get to play around with the app?

[TofiBaba]

Re: Allow user to run a few program only, using 'run as'

Not yet, I have to get home and in my lab environ. to do the testing. I can do it next week.

[nos]

Re: Allow user to run a few program only, using ‘run as’

set :k: … I’m waiting for your feedback

[DeSiMuNdA]

Re: Allow user to run a few program only, using ‘run as’

This might help…if u haven’t seen it yet that is

Run Just the One Problematic App with Elevated Privileges

Some apps address LUA bugs by explicitly checking for admin group membership on startup and displaying an error message insisting that you simply have to be an admin to use the program. This may be due to developer laziness, incompetence, or arrogance (or all three), but these apps will be resistant to any other workarounds available to you. As a last resort, after you’ve confirmed that all else fails, you can consider running the one problematic app with elevated groups or privileges.

Instead of running the app as admin, try running it elevated but as less than full admin. You could run the app as a member of Power Users or with a specific privilege, such as SeLoadDriverPrivilege. But with just a little more work, many of these other groups and privileges can be used to take over an entire system.

So how do you do this? If you trust the user with the admin password (or you trust the user to make security decisions) you have four options:

1. You can use RunAs. (For more details on this, see my postings ““RunAs” basic (and intermediate) topics](http://blogs.msdn.com/aaron_margosis/archive/2004/06/23/163229.aspx)” and “RunAs with Explorer”.)
2. You can use MakeMeAdmin. This is a batch file, which you can easily customize to run something other than a command shell. You can also tweak it to make the elevated context less than full-admin. (For more information on this, see my blog posting.)
3. SysInternals offers PsExec and Process Explorer. These apps provide various RunAs-like options.
4. Finally, you can use RunAsAdmin. This is an interesting and useful open source utility by Valery Pryamikov. RunAsAdmin takes an approach that is a little bit like the Windows Vista User Account Control feature (UAC), elevating the current user in place without requiring a password.

On the other hand, if you don’t trust the user with the admin password, there are a couple of third-party options that are worth considering.

1. PolicyMaker Application Security by DesktopStandard uses a Group Policy extension to configure rules for modifying process tokens. It mitigates some of the drawbacks mentioned below. It can be configured so that child processes launched by a targeted app do not inherit its modified token. And it can perform granular token modification, to raise (or lower) permissions or add (or remove) privileges.
2. Winternals (the commercial side of SysInternals) offers Protection Manager, a tool that uses a lightweight client-server application and a whitelist technique to block all untrusted applications. Protection Manager allows applications to have their process tokens and privileges elevated to that of an administrator or reduced to that of a user (in cases where end users are non-administrators or administrators, respectively). Protection Manager doesn’t allow a child process of an elevated app to run elevated unless it is also explicitly configured as an elevated app. All children of reduced privilege processes are reduced automatically. Applications can be allowed, blocked, elevated, or reduced as specified by an administrator via digital signatures, hashes, NTFS file ownership, or path.

PolicyMaker Application Security and Protection Manager both determine in kernel-mode code whether, when, and how to modify a process token. Since passwords are not used, they’re not at risk, and the modification decision cannot be interfered with by non-admins.

Other tools are available that perform RunAs-like operations with the admin account credentials encrypted—or sometimes just obfuscated. Even though this technique raises the bar and will stop some users from getting the admin credentials, those passwords still have to be decrypted within the user’s security context and therefore may be exposed to an attacker with the right tools.
A question I’ve heard asked frequently is whether the RunAs.exe /savecred option can be used as a shortcut to let a user run a single app as admin using a saved password (without requiring further password entry). But this can cause unanticipated problems and there are a number of issues you should be aware of. The credentials are not tied to any one shortcut; once the credentials have been saved they can be used to start any app. While the password is securely encrypted with a user-specific key, it will still be decrypted in the user’s security context and briefly exposed. And the /savecred option is not available on Windows XP Home Edition.

Benefits: With this approach, you are able to avoid always running everything as admin. Unfortunately, that’s about the only benefit for this one.

Drawbacks: Running an application with elevated privileges is much riskier than any of the other options I’ve already described. It’s very difficult to defend a system against a malicious user or a malicious app when there’s an application running as admin. Here’s a simple example. If you run Notepad as admin, and then choose File | Open, you are presented with a little Explorer-like window. You’re still in Notepad, which means you have full admin-level access to the entire file system—you even have the ability to launch programs as admin from here. This simple technique can be exploited by a malicious user or by malware pumping keystrokes or window messages into the elevated program.

[nos]

Re: Allow user to run a few program only, using ‘run as’

^^ Yaar article tou bara he set hai laikin its talking about stuff that’s just flying over me head! I got regmon and filemon to check registry and file level access information but its a very tedious task. ‘Runas’ is working but I don’t want to create an account with admin privs and then leave the door open to abuse. Will look into the artile in detail …

[PakistaniAbroad]

Re: Allow user to run a few program only, using 'run as'

ok.. this may not work.. but that's how it's done in midrange environments.

Grant privileges through a program.. the concept is called adopted authority.

You deny the users all rights to the VoIP program thus securing it, but write another program that has access to this VoIP program and give the users rights to run that program.

[TofiBaba]

Re: Allow user to run a few program only, using 'run as'

Hey nos,
I'm going to test this out, but in the meantime another idea occured to me. Did you try setting this up as a service? Cuz a service you can setup to run as whatever you want. If you do want an icon to run the application you can just run a cmd to start and stop the service.

[nos]

Re: Allow user to run a few program only, using 'run as'

@nos

... How can I start an app using certain credentials? The only way i can recall is by registering the app as a service and then starting it with some given credentials. Is this what you were referring to? I don't know of any GPO setting that can help achieve the mentioned task.

Any other ideas baba G ?

I already tried that chief - By registering the app as an interactive service and then using a limited user account. But the problem is that the application requires access to certain files and/or registries, which become inaccessible when I run the app using 'limited access' user credentials. You see where I'm coming from?

I'm not fully aware of efficient ways to track registry and file changes that are made by the VoIP app. I tried 'Filemon' and 'Regmon' but they just throw up a lot of info, making it difficult to track the relevant changes.

[TofiBaba]

Re: Allow user to run a few program only, using 'run as'

What I meant was register it as an interactive service and use an elavated user account to run the service. Don't know if it'd work or not, just thought of it so suggested it.