SuRun: Easily running Windows XP as a limited user

I understand. I guess I made confusion with something that happened yesterday, while testing SuRun. I thought I had created a LUA, but it was in fact a new Administrator account. So, I added it to the SuRun group, and it lowered its rights.

But, today, I made it right, as in I truly create a LUA, but still added it to the SuRun group.

So, that's why I, as a LUA user, got no request from SuRun to input a password, isn't that right? And, I'm guessing that if I don't add the LUA to the SuRun groups, then SuRun will be asking any LUA user for my administrator password. OK. I'm understanding now.

Yes, that's correct. That's why I like the concept of SuRun.


Thank you for your patience with me.

 

Unless something changed, i would expect LUA's, not in SuRunners group, to be unable to use SuRun.
An administrator would have to put them in said group.

 

Yes, that is correct. After playing a little more with SuRun, I now understand a lot better how it works.

So, basically, what it does, is to allow a better LUA experience. Nothing more. I mean, if I don't add a LUA user to SuRunners group, SuRun will prompt that user for my password. But, if I add that user to the SuRunners group, then it won't ask for the password.

I don't know why, and maybe I misunderstood since the start, but I had the idea that, SuRun would work similar to UAC, as in, asking the user to input the Administrator's password.

If I had all LUA users to the SuRunners group, they all have open path to install whatever they want. It's OK if I'm the only user, but, I believe the way it works should be different in situations where there is more than just 1 user.

Maybe something the SuRun's creator should have in mind.

As of now, I only see using SuRun as an advantage for alone users, running in LUA, and are looking for a better experience. Other than that, no good. Once added to the SuRunners group, open path.

Maybe, when I get the time I register over there (SuRun's forum) and share my thoughts.

This does not take away the fact that, this tool, is a great way of easing the use of LUA.


Cheers

 

@m00nbl00d: I suggest that you read Mrk's excellent SuRun Tutorial. It will probably answer most of your questions. You might also want to contact the SuRun author Kay Bruns in his English sub-forum.

 

Thanks... Will check.

I think I know why it wasn't asking for LUA user to input my Administrator password. I forgot to select that users must enter their passwords, which would make them have to input mine, I guess.

I'll check it.


Thank you

 

I wouldn't say as much, just that SuRun is to be used by trusted users only. It's not there to guard against local users, so don't add to the SuRunners anyone who doesn't merit your trust (like an account you keep for guests).

 

Perhaps think about what SuRun is even doing for you. I mean, it is a convenient interface to replace RunAs. Much more sophisticated, options etc. But it is still designed to simply let you no longer run as an admin day to day. Because it can remember your answers among other things, it lets you run in User mode, much safer, while at the same time lets you do stuff without annoying RunAs all the time.

I look at it more as letting ME switch from admin to user, while still allowing ME to be an admin when needed in an easy and convenient way. If a user on my computer/network is not ME, they may not need MY admin rights. So why would they be in SuRunners group then.

Sul.

 

Hello Sully,

Perhaps, I didn't express myself the best way possible. I'll try to do it now.

I agree with you. Untrusted users must not be allowed to install/run anything with Administrator rights.
But, say, I am the Administrator of system A. I have created two LUA, X and Y. LUA X is part of the SuRunners group, because I trust the user. LUA Y is not part of the SuRunners group, because I don't trust the user to make decisions on his/her own.
Now, the user of the LUA Y wants to install something. He/She calls me. To allow it, I need to add this account to the SuRunners group, otherwise it's impossible to install anything (At least, that's how I understand it.). I believe that SuRun should have an option to allow elevated rights for other accounts, without actually adding them to the SuRunners group. Of course, the Administrator would be the one installing, etc. But that's it. Next time, if that same user would want to install/run something with Administrator rights, would need to re-ask again for permission.

I hope I was more clear now.

But, yes, I do agree that SuRun makes LUA easier to deal with.

Regards

 

I was having a problem with Windows XP SP3 updates. I started Windows Update via SuRun, but it will fail to install the validation tool.

Does SuRun has problems handling with Windows updates?

I've read Mkr's tutorial, and seems to be updating from what I see from the last image. But, I just don't seem to get mine to update.

I had to actually download a Microsoft's diagnosis utility, and validate through it.

I'm downloading the rest the updates right now, and will see if it installs them successfully.


Cheers

 

I created a New Admin account A and then changed my old account B to a LUA and added it to surunners (?) via the SuRun Tool.

Now it works fine , apart from I can't see my B account when I'm logged in as Admin under A.

Is this something to do with the surunners group ?

 

SuRun 1.2.0.7 released.


Changelog:

 

Is it OK to install over the top when upgrading? It looks like it may be OK from the web site.

Does it matter from which account it is installed?

Thanks for the update.

 

When you run the SuRun install, it will uninstall the old version automatically.

I've always updated SuRun in my administrator account.


Thanks for the headsup tlu

 

Thanks, it updated smoothly.

 

Anyone using surun 1.2.0.7 with shadow defender? Locks me out of the surunner account whenever I go into freeze mode then reboot thawed. Had to revert to previous version

 

many 10x TLU for SuRun ! awesome works mate , now i switch for using Surun and its so rocks! i just dump any thought using HIPS or any behavior blocker

much respect for your works mate, i hope 2 thing will append 1)ppl will switch to SuRUN (lua accounts actually ) 2) TLU , u will continue update and improve SuRun

cheers

 

Anyone using SuRun with Windows 7 under a Standard user account? Is it even necessary?

 

It wasn't necessary even in Windows XP... I've certainly never used it, and have still been completely happy with using a limited user account.

 

While you're completely correct, I do find it a useful and a convenience in LUA. Necessary? No. Useful? Sure.

As with any convenience in LUA (or any other context), you can also use it to shoot yourself in the foot and that's always the rub. Convenience and security are always in tension.

Blue

 

Thanks for your kind words - but I'm not the developer of SuRun. You should praise Kay Bruns instead. I just introduced and popularized it in this forum. And I will try to inform you about updates in the future - but I can't promise that since I've switched completely to Linux recently. I'm running Windows in a Virtualbox VM once in a while, though, so there is a chance that I will keep an eye on further updates.

 

As Blue already said, it's not necessary but it makes life considerably easier. Post #1 explains how it differs from runas. It offers a lot of advantages (a lot more than the old MakeMeAdmin by Aaron Margosis).

 

Minor update - SuRun 1.2.0.8

 

I'm giving this LUA + SuRun another try, this being my third serious time. In the past, the deal breaker was two apps that just would not co-operate with the LUA no matter what I did. Before trying this setup for the third time, I decided to uninstall the two apps with Revo Uninstaller and made screenshots of the advanced registry entries listed for being deleted by Revo. After getting LUA, SuRun and SRP setup, I installed the two apps, changed the permissions on the couple of reg entries and they work now. I'm thankful for that but now have another problem with Window Blinds in the My Computer explorer window. Every now and then, the explorer sidebar switches back to the XP Luna themed color and stays that way until reboot/logoff - login. I have noticed that if I add explorer.exe to the Black List under the Execution Hooks tab that it works fine. My question, is that an undesired thing to do? One more question, Is the show Windows updated notifications to all users item supposed to work? It doesn't for me. I do have it set to download but notify so that may be the difference.

Some observations,

Source of quote
All the times past that I have tried SuRun, the above quote was never an option. I could manually add an Admin account which did nothing. It was still an Admin account. For me, if the account wasn't already Limited, SuRun was just a nice app installed that did nothing.

Another thing, this lastest version of SuRun didn't offer to add my account(Limited) when logging into it for the first time. I had to do it from within the settings.

And the last, I'm a XP Home edition user which had converted to pro for easily managing the SRP. It had been that way for awhile before giving this SuRun another go. I said that to say this, SuRun would not work after having converted to the Pro. For whatever reason, User Accounts would not let me convert my existing Admin account to a Limited. User Accounts2 would, which I did, followed the advice for changing file permissions on files/folders/registry and ran the command line to set the security settings for the file system to their default values, installed SuRun only to have everything listed as Administrator by the smiley face tray icon. User Accounts did show me as a Limited User and file permissions had all been changed but SuRun would not see it as such. Luckily, I still had a snapshot from before the time I converted to Pro which did the trick. I had do the conversions all over again but it seems to be working well.

 

SuRunners group is an alternate group for the users. Users are put into this group by an admin. You don't want to add your admins to Surunners, only users. This way when you log on as UserX, who is in Surunners group, and then you start something with SuRun, the UserX account is elevated to admin temporarily then demoted back to SuRunner (consider it a special user group).

Also, and I am unsure if this applies to Home or not, but in Pro creating a user from the control panel applet actually creates a power user. You have to create a user from the managment snapin to create a true user.

I have never thought to try it from console, using 'net user'.

Sul.

 

<textProxA>Has anyone gotten SuRun to work with Windows 7 Pro 64-bit?

I tried installing it but nothing really happens when I try to run the executable. A process starts and ends quickly but I don't recall what it was since I'm not currently at that desktop. Same result when running "As Administrator" in the administrator account.



I think I'd prefer to use SuRun. For someone who skipped over Vista, I'm getting used to the "Run As" command with UAC in Windows 7.

I've been messing around with Proxomitron and couldn't figure out why applying filters in addition to Sidki's set and the settings wouldn't stick. I was too used to using SuRun in XP where the current users token were elevated when installing programs as opposed to "Run As" where installing program elevates using the Administrator account.

I realized the proxomitron filters I was applying was only getting applied too the administrator account. After using SuRun for so long, "Run As" just seems inefficient to me. It just doesn't seem logical and messes things up especially with programs that don't install to every user account.<textProxE>