Password Prompt

paradigmshift

Hello Kays,

1. I can't get "Don't ask and always start the program with elevated rights" and "Start the program automagically with elevated rights" to work right. I have a batch file in the Startup folder that always asks for a password after login. I thought that "Don't ask and always start the program with elevated rights" and "Start the program automagically with elevated rights" was supposed to bypass the password prompt. Under Common Settings, Security, I have "Users must enter their password" checked with nonrestricted SuRunners and Administrators (*). I added the batch file to the Program list.

2. How do you change the password?

cosmo

You must disable the password option on page 1 to make it work as expected.

Further more you are likely having mixed 2 things by this:

ParadigmShift wrote:Under Common Settings, Security, I have "Users must enter their password" checked with nonrestricted SuRunners and Administrators (*).

The selection in the second row (here: nonrestricted SuRunners and Administrators (*)) is regarding to whom will the warning about missing passwords in admin accounts be shown; it has nothing to do with the setting above if the password has to be entered.

How to change the password: It is the password of the Windows' account, you change it in the control panel.

paradigmshift

Thank you Thomas.

I have been using LUA's with MakeMeAdmin for years. I have several remote users that are thousands of miles away that I configure laptops for. I would like to see the password settings in future versions of SuRun changed to include both the Administrator account password and the local user account password just like MakeMeAdmin. Why? This is more secure for "untrusted" remote users. As it stands now, "untrusted" users have full access the SuRun settings by just entering in their Windows password. If the settings are changed to hide SuRun from the user everyone gets locked out in that account. That makes it impossible for me to remote into their laptops with NetMeeting and make changes to the settings without logging into another Admin user account and I don't have that option. MakeMeAdmin still works better in this situation.

cosmo

Hi - and a Happy New Year.

To be honest, I had to read your post several times to understand, what you want. Hopefully I did understand you right. In this case: This can be done, as you want, but more comfortable and more secure.

SuRun uses the Admin password only once: to give the user the option to get a member of the SuRunner-group. If the Admin does this, there is no need to give the User the Admin-password, what would be a great problem / securitry leak.

There are already options to take the user the chance away, to change the SuRun options. Take a look at page 2 of the dialog. So you can set a number of programs, which the user may start with Admin privilges (if you want, possibly in a way, that the user does not even notice, that the program runs with elevated rightzs), but the user may not start another program elevated or change any setting.

What do you miss anyway?

paradigmshift

Hello and Happy New Year to you too. Thank you for your reply.

1. I use Windows NetMeeting
2. I have remote users and I remote into their laptops with their user Limited User Account using Netmeeting
3. The "Hide SuRun from this user" option does not work in this situation

How to change the password: It is the password of the Windows' account, you change it in the control panel.

Yes, but that is not secure for "untrusted" users. They can change the SuRun settings.

There are already options to take the user the chance away, to change the SuRun options. Take a look at page 2 of the dialog.

Yes, but when choosing "Hide SuRun from this user", it locks me out too when I have to remote into the laptop with NetMeeting for servicing. Are you familiar with NetMeeting? Do you know how it works? I can't have the remote user log into the Administrator account so that I can change the SuRun settings, I don't want him to know the Administrator account password. MakeMeAdmin still works better with remote users and NetMeeting. There needs to be a security change in SuRun in future versions so that the password used to access the SuRun settings is NOT the Windows password from the SuRun account. I setup all laptops prior to them being shipped out to various remote locations. When configuring SuRun for remote users, I cannot use the option "Hide SuRun from this user" as this will not allow me access to the SuRun settings when I connect into their laptops with NetMeeting. I can configure it to use the password, but then I'll have to lie to them and tell them that it's a secret password that only I know. With NetMeeting, you can see everything the remote user is doing inside your PC. He doesn't know it's the Windows password I'm using, all he sees are asterisks as I'm typing it in, but he could try the Windows password on his own after I have disconnected from NetMeeting so see if it works and voila! Now he knows how to get in. With MakeMeAdmin, I don't have this problem with my remote users. There should be an option with "Untrusted" users to set the SuRun settings password to the Windows ADMINISTRATOR account instead of THEIR Windows account so they can't ever get in.

Kay

Hello and Happy new Year!

To the first post:
There's already a request for an Option to mark programs in the user's program list to not ask for a password even if the Option "Users must enter their password" is checked. I'll do that as soon as I find some spare time.
For now, if you uncheck "Users must enter their password", the AutoRun should work fine.

To the problem that untrusted users can modify SuRuns settings:
Uncheck "The user can change SuRun settings" and check "User can only run predefined programs with elevated rights" for those untrusted users. (This is what Cosmo already mentioned)
SuRun will then ask for an Administrator password to change SuRun settings.

paradigmshift

Hello Kays, thank you for your reply.

To the problem that untrusted users can modify SuRuns settings:
Uncheck "The user can change SuRun settings" and check "User can only run predefined programs with elevated rights" for those untrusted users. (This is what Cosmo already mentioned)
SuRun will then ask for an Administrator password to change SuRun settings.

Yes, that did it! Thank you and thank you for your excellent program!