How to allow limited admin rights to a user/program in Windows

Question

I work in security and often come across situations where a user requests local administrator rights to their machine because 1 program needs to be run as Admin in order to work. Unfortunately, a lot of these programs are critical and so I cannot deny these requests.

That said, granting a user full local admin because a single program needs to be run as admin seems excessive.

For Window, what options are there to allow a user or program the rights needed to run without granting holistic admin rights?

PS. I've looked at third party tools such as CyberArk's EPM, but I'm curious if there is any sort of Windows native ability to accomplish what I need.

Answer 1

A user will ask permission to run a program as administrator when the program itself requires this. Often the user starts the program, a UAC prompt fires up asks if the program can be run as administrator, the user clicks yes and now they need to enter administrator credentials if their user is not a local administrator.

Does that mean the user needs to be a local administrator?

No.

It means the program wants to perform a function that the current user lacks permission to do so. Because the administrator has all permissions, the program wants full access to perform one or more tasks.

Does that mean you can change things for the program to work without administrative permissions and not even get that question?

Yes.

The hard thing is going to figure out what the permissions are going to be, which will be a bit of trial and error, but if the time is invested, you can succesfully set permissions on a pc such that the user can run the program without requiring administrative privileges.

Here are a few pointers that you need to know when researching the permissions.

1. This will not work with every program. If a program wants to do something weird that is unexpected, it can be hard to nearly impossible to find out what it tries to do. If your trials fail, consider sending an email to the developers to ask what/where the program is writing data.

2. UAC fires if a program wants to write in a folder it has no permission to, or modify a registry item it has no permission to.

3. On Windows 10, the Program Files folders are read-only to non-administrator users and require administrative permissions to write to, because the user Trusted Installer is owner and has write permissions.

4. The Local Machine registry keys are read-only to local users, and writable to administrators.

5. If a program is installed for my user only, it is stored in the users profile (the user has write permissions here), whereas if they are installed for all users, its stored in program files. Consider reinstalling as user based program if the installer permits this.

6. You can modify security settings for both a registry subkey and a folder and grant the user write permissions. This is often enough if you manage to identify what folder or key the program wants to write/change.

7. It doesn't hurt to just try giving the folder the program is installed in full write access to the user for that folder and subfolders, and see if its enough. It is 8 out of 10 times enough to get it working right from the start.

8. Controlling the state of a service requires administrative privileges. If you identify that the program indeed requires a service to be operated, use SubInACL to grand permissions to the user to start/stop this service.

With the above in mind, if a program is programmed correctly for windows 10, it should not require administrative privileges. If the program was created for an earlier version of windows, it may simply be the reason why its not working. Check for updates of the program, or learn why it fails and correct for it manually.