SuRun: Easily running Windows XP as a limited user

Thanx Tlu, got it. I admit I only scanned through the thread after the first few pages. A suggestion; Edit your first post to point to post #146 so others will see it in the future. All set here guys, thanx. I'm playing with it now.

 

I'd love to do that. Unfortunately, it's no longer possible ...

 

I just tried to apply the fix in Post #146. Taking ownership over the files in the C: partition worked fine but I got this error when trying it on my D: partition

http://i33.tinypic.com/2zhmsn4.jpg

Similarily, this happened with the registry entries other than HKEY_CLASSES_ROOT. That one worked fine. The others gave this

http://i37.tinypic.com/2mh8nwx.jpg



oh and another thing. A lot of my settings seem to be messed up now back in the limited account. For example, my extension settings in Firefox seem to have reset and at least one program that I usually have start on bootup is no longer automatically starting.

hmm, I didn't need to start clean but it looks like it might be something to do for today lol


/edit

I just said screw it and went ahead with creating a whole new limited account instead. I figured, why not? It's not like I had to reinstall Windows. Most of my programs are already there with a new account, although I had to redo some minor settings with most of them. Feels better to have a "real" limited account now

 

Does anyone know about SuRun and Unlocker? Unlocker requires debug rights, which the LUA account does not have. The admin account does, but even adding unlocker.exe to the allowed programs and lettng it start automatically with admin rights does not work.

Here is a link to the fix that is given by the unlocker faq
http://msdn.microsoft.com/en-us/library/aa291232.aspx

I use this often, and I am unsure if giving debug rights to a group other than admin that my LUA can use is insecure or not.

Sul.

 

1.2.0.5 is released

http://translate.google.com/transla...active&ie=UTF-8&oe=UTF-8&prev=/language_tools

 

Thanks for the latest update notice.

SuRun + Kafu = ROCKS!!!

 

SuRun 1.2.0.6 is out.

Changelog:

 

Thanks for the headsup on the update. I've been using SuRun ever since I ran into this thread



I still use XP, although I'm curious as to why there's Vista compatibility. Shouldn't UAC in a Standard account to the same thing or is this meant as a replacement like that Norton tool?

 

I'm curious to see if Sully still has the same performance issues he once reported.

 

I am curious too. I will have to restore my image to a fresh state and try it again.

Sul.

EDIT: The new version of SuRun is pretty nice and stable. It does not seem to exhibit any of the permformance issues, the 'lag' or 'pause' that some of the other versions did. Changing my admin account to user, and creating a new admin account worked a charm. Reboot and all up and running. Curious that using RivaTuner in past had error of the sys file (driver) needed admin rights to start error still exists. But, like older versions, only adding to allowed list still does not fix problem. I have built a small startup tool that I have been using, specifically for using DMR and reducing shell to User. Anyway, but allowing this startup tool to run as administrator in SuRun, is achieves much. RivaTuner has no qualms no at all it seems, as long as this tool starts it up and the tool is allowd in SuRun. That was always an downside to using SuRun.

 

I am wondering with SuRun users here, what are your feelings on the prompts for passwords? Do you feel to be more secure and prompt for password? Or do you feel less annoyed by inputing once and let it start (the program in question that needs admin) elevated all the time.

I ask because, at some point, one would think, script kiddies will target a LUA with SuRun environment, hoping that programs are elevated automatically, thus granting them root of some degree.

Do you agree?

Sul.

 

Good point, thats why I hardly only give automatic rights to programs on need to use basis. My hardware monitor and ImgBurn have automatic rights, rest are no need basis. The password is encrypted in SuRun so there is no such issue even if a script kiddie can run from a LUA environment. Just don't give automatic rights to everything there and you would be relatively safer.

 

I'd like to get Process Explorer from sysinternals admin rights when it starts up. Unfortunately, I can't find a way to do this unless it's through a shortcut.

SuRun can't give it automatic admin rights when activating Process Explorer through the CTRL+ALT+TAB hotkey or by right clicking the task bar and selecting Task Manager.

Any ideas?

 

I'm currently investigating surun for an enterprise environment, has anyone done this, and if so do you have any tips, or things to watch out for?

Thanks

 

I've been using it in a K12 environment with around 300 pcs all running limited user accounts. It has really been a godsend for all the shovelware educational software out there, much of which require admin rights to run.

With newer versions of surun it's possible to save the configuration which you can then import in the guirunonce section of the sysprep.inf files if you're sysprepping your computer images. No real gotchas so far. We are not in a domain environment however so I'm not sure if there are any issues in that scenario.

 

Interesting thread. Thank you tlu.

I have been reading this thread (I even saved all pages to my computer, to read them offline), but I'd like to ask the following, and I hope that I'm asking something, in the right direction.

As of now, I have a computer from a family member, where I just installed Windows XP SP2 Home. I then updated to SP3, in the administrator account, which is the only account created, so far... and by default... Well, you know that.

(I also have installed it in a virtual machine, where I will be, first, testing LUA + SRP + SuRun, and see how it works all together. By the way, perhaps you should update the first post to state that people would need SP3 package with the new version of the tool provide by that German magazine. It would be recommended to edit the batch file and change the name of the SP3 package, they have there with xpsp3, for example, and also rename SP3 package to the same name.) Edit: This is meant for the thread where you let people know how to apply gpedit for XP Home.

I understand that, we first install SuRun in the admin. account, and then log off and enter LUA.

I don't remember right now, if it was here or not, that I've seen mentioned that, to update Windows XP, would be better to do it in the admin account, is that right?

Also, something I believe I understood it right, is that SuRun, when we install something, it will install with admin. rights, but will be only changing the current user files and registry keys, and not the admin. account files and registry. Isn't that right?

My family member will be connecting to the Internet through an USB device, and for that, software needs to be installed.
Since I'll be applying LUA + SRP + SuRun, if I install the software of the USB device, under LUA, with admin. rights (through SuRun, obviously), and considering that it will only, actually, change the current user (LUA) files and registry, will it still be available in the admin. account? (The same about all other apps.) (I believe that, as an admin., the user would have access to everything in the other accounts, even if only installed in those. I believe thats the same concept with SuRun, right?)

I understand this may sound a silly question, but I never used SuRun, so I'm a completely newbie.

Thank you

 

Moonblood, he can't update the 1st post.
If i understood you right, the main advantage to SuRun, other than not needing to change to admin account to install programs, is that, upon installing, your chosen configuration is done, and you won't be asked for the same questions when you would change to the LUA account.

 

Update: I installed SuRun a few minutes ago, after Windows XP installation finished, in the virtual machine.

I installed in the administrator account, logged off, and entered the LUA. I went to test it by installing a software application. I right clicked it and chose "Start as administrator", and it asked me to join SuRunners group, and by doing it so, the LUA would lose its administrator status.

Is it a bug? Or expected behavior? I mean detecting a LUA as an Administrator account?

 

Hello Pedro,

Yes, thank you. But, unless I'm making some confusion, which I apologize, I don't think that's the answer I was looking for.

I'll try to explain myself better (Will do my best.).

Imagine, say, I want to install Mozilla Thunderbird. I need to install it with admin. rights (SuRun), considering I've applied LUA + SRP.

Now, if I understand right, one of the concepts of SuRun, is that it allows to install an application with admin. rights, but only changing folders, files and registry keys for the current user, even the application is being installed with admin. rights. Meaning, I'm a LUA, and I install Thunderbird with admin. rights (SuRun), but, despite this fact, nothing in the Administrator account will be changed, isn't that right? Or am I confusing it?

If I am not confusing it, as in nothing in the Administrator account gets changed, if I log in to the Administrator and use, in the example I gave, I am able to use Thunderbird, still, because I'm an administrator, isn't that right?

I know that Administrators have all the rights, which include to use applications, even if only installed for XYZ LUA.

I guess with SuRun is the same deal. It makes sense. Am I in the right thought? After all, SuRun only comes to ease LUA use.


Thank you.

 

moonblood, SuRun correctly changes your account to LUA after your reply to join the SuRunners. SuRunners are LUA's, admins do not need SuRun
To your second post, turn to pages (omg!) 9, 11 and 15/16. tlu and Cosmo's discussion.
Sorry, i don't want to make a mistake in answering your post, more so since i hardly use XP at home (where i can use SuRun). I mix these things up myself you see!

Thunderbird's files are owned by the admins, so yes they can use it, but whatever you configured in the LUA is not there (configuration files, preferences etc. -> Documents and Settings). Hope i'm right, as i am THE user on my own machine besides a guest account.

 

I have never checked, but when you are a User, and you want to install or do something that requires SuRun, which registry hive is used, the User logged in, or since SuRun uses the credentials of admin, the admin hive?

Sul.

 

For what I could understand, SuRun will allow the user in the LUA to install something, if they're allowed to do so by an admin. (I hope I'm not saying any nonsense.), with elevated rights, but it won't mess with any of the settings in the Administrator account.

That's what I could understand. I believe that SuRun does the same job as Run as, only better, because it will bring LUA users back to their limitations. So, that's also my doubt.

Hopefully, someone with a better understanding of SuRun will enlighten us.

 

OK.

This is just to give a tip for users who have other people making use of the same Windows XP system.

SuRun advises you to create a password for you admin. account, which is, obviously, a great advise. But, what some may have no though of, is that, if those users (the ones you want to prevent to make changes) boot in Safe Mode (Windows XP Home), then they will see the built-in Administrator account, and by entering it, they can easily delete you Administrator's account password.

With Windows XP Pro, all those users would have to do is to press CTRL+ALT+DEL, twice.

There are two options for that. Either set a password for the built-in Administrator account or set a password and hide it, as well. But, I guess that setting a password, easily remembered by you and hard to guess by others, would be enough.

Just thought of sharing it. I guess most of you know it already, but for those who didn't... well... there it is.


Cheers

 

I'm having a few doubts with SuRun.

So, I installed Windows XP in the virtual machine, and obviously, the default account is the Administrator's one. I installed SuRun, and I added the LUA I created to the SuRun group.

I logged off the Administrator account, which is password protected, and entered LUA. I tested SuRun by installing an application, but it won't ask for my Administrator's account password. Shouldn't it ask for it?

So, I went to SuRun settings and checked the box "Users must enter their password". I thought that if a LUA user would try to install something as an administrator, then SuRun would ask for the Administrator's account password. But no, it asked for the LUA password, which is none, and wouldn't really make a difference. The LUA would need to input the Administrator password.

So, what I am doing wrong?


Thank you

 

Nothing wrong. SuRun elevates LUA's privileges temporarily for whatever the program you want.
You would only allow trusted user accounts to join the SuRunners, not just about anyone.

Run As allows you to run the program as another user, like the administrator account.