Is it possible to install new programs using the admin password in the user account?

Aandy-price · 27. März 2010

Hi. Thanks for a great program. I am using it, as many others I suspect, to allow me to force users to run as limited while still giving them access to their essential programs. Ideally I don't want users to have access to surun, I just want to add the necessary programs to the program list and not let them know that surun even exisits.

I do not want normal users to be able to be able to right-click an executable and choose run as administrator, and I can achieve that by setting "user can only run predefined programs..." but I would like to be able to come along myself and install new programs (in the user context) by right clicking the installation executable and entering the admin password. Is there any way to achieve that? At the moment the only way to install seems to be to take off the "user can only run predefined programs..." setting first.

It's not a deal-breaker for me, I just wonder if I have missed something.

Thanks
Andy

KKay · 28. März 2010

Currently there are two options to accomplish that:
* You could let SuRun "Replace Windows' 'Run as...' with SuRun's 'Run as...'" and then use Explorer's "Run as..." context menu
* You could directly start the setup app with RUN: "SuRun /RunAs <app>"

Aandy-price · 29. März 2010

Thanks for the quick reply Kay. It almost does what I want now as it allows me to select Admin from the list of users and install a program from a CD or flash drive.

Unfortunately, using surun's runas command lets anyone run an executable as User if that executable doesn't require elevated privilages. I say "unfortunately" because I am using Windows' own Software Restriction Policy to block the running of any executables which are not in the Windows or Program Files folders (i.e. I am restricting users to installed programs only) but surun's runas option circumvents this.

This is in no way the fault of your program, I am trying to use it as part of my locking down of PCs while I realise that it's real aim is to get around the annoying restrictions of running as a limited user!

Thanks
Andy

KKay · 30. März 2010

It seems always to be the same with M$. They do not consequently enforce their own policies. ;-)

SuRun's RunAs function uses the network logon function. I think that if you block the login from a network for your restricted users, SuRun will not be able to run programs in their context.