none
How can I allow a standard user to run a program with admin rights without prompting for a password?

    Question

  • I want to create a shortcut that will allow regular users to execute a program with admin rights, without prompting for an admin password.

    I tried creating a task to run with admin rights, then I created a shortcut on the desktop that attempts to execute the task but I get access denied when running it as a standard user.

    I guess one way would be to grant users permission to create/run tasks - but I couldn't find anything on how to do that.

    Anyone have any ideas on the easiest way to do this?

    Tuesday, January 12, 2010 9:31 PM

All replies

  • first define "regular users"
    and what "execute a program"

    Standard / default users have no problems running programs such as office / Muni software / the patient management software / others.

    what are the issues you seeand how do you get them.

    Tuesday, January 12, 2010 10:16 PM
  • Standard user means someone thats in the computers local users group - and this software requires admin rights to run. If the program is run without admin rights it crashes and there's no update for it.

    Besides that lets say you want to grant users the ability to run chkdsk /f or defrag their own system the same issue would exist. These utilities require admin rights.

    I'm aware that doing this does create a security risk, but my only other option is to grant the user full admin rights which is a lot more dangerous then just allowing a single app to be run with elevated rights.

    In this case I do not want to add the user to admins, power users, etc. I want them to have the least amount of rights - but the right to execute this app (which does require admin rights).

    Any advice is much appreciated.

    Tuesday, January 12, 2010 11:09 PM
  • If you are using Win 7 Enterprise, take a serious look at AppLocker.

    http://technet.microsoft.com/en-us/magazine/2009.05.win7.aspx?pr=blog
    Wednesday, January 20, 2010 3:28 PM
  • AppLocker is meant to make it easy for IT pros to author a simple set of rules that express all of the applications that are allowed to run and ensure that the rules are resilient to application updates.

    It does not allow you to create a shortcut that will allow a standard user to run an application that require administrator privileges without prompting for an administrator password, which was the original question.

    Saturday, February 20, 2010 7:29 AM
  • You may well be out of luck here, unless you change the givens in this problem...

    The problem is that what you are proposing goes dead against the Windows 7 security model.

    To run with administrative privileges, an application (run by a non-admin user) must be escalated.  The only way to do that is to escalate, which involves the UAC prompt.

    Now, you could do one or some of the following:

    - Figure out just why the app is crashing and work around that.
    - Disable UAC.
    - Make the users administrators over their computers.

    Personally, I'd start with the first one above.  What does the application need that it is not getting?

    • Does it need to write to a location on the disk that is otherwise protected?  For example, into a subfolder of C:\Program Files?  If so, you can open the protections of the folder/files it needs to access so that your non-privileged users would be able to access them.
    • Does it need to write to the registry in a protected location?  Same thing as above:  Set the permissions to allow the user to read/write to that/those registry location(s).

    FYI, installers that work successfully within the modern UAC-based security model often do exactly what I described above.  The installer is escalated so that it can accomplish these things, then the application can run for that user and access what it needs.

    What application is it that won't work for you?

    -Noel

    • Proposed as answer by Noel Carboni Saturday, February 20, 2010 3:18 PM
    Saturday, February 20, 2010 3:14 PM
  • Basically, what you need to do is:

    1) Move the Application to a folder outside "Program Files". E.g. make a folder named "User Apps" or something like this.

    2) Select the app folder properties (by clicking with right mouse button on it), go to "security" tab and press "edit" to change its permissions.

    3) Press "Add" and enter the name of the user you want to run the app. Press ok. 

    4) In "Permissions for -user name-" box, mark the checkboxes to give him full control (or just "modify") rights. Press OK and OK. Now your users application has the nessesary permisions to write to its folders.

    But the app may ask to write something in the systems registry. So, follow the next steps:

    5) Go to start and run "regedit". Inside Registry Editor click "Computer" and make a search ("ctrl-F") with the app name (e.g. "quake.exe"). Wait to find it.

    6) When you find some registry folder that is connected somehow with the app, press the right mouse button on it and select "permissions".

    7) Here you have to add the user name once more and give him the full control permission. Now his app can write to system registry.

    8)Go to the app shortcut you have created for the user, click properties and enable "always run as administrator".

    9) Done! Your user can run the Application without having you to give him admin rights!

    • Proposed as answer by Luxus Sunday, May 16, 2010 12:44 PM
    Sunday, May 16, 2010 12:43 PM
  • I know I'm late getting to this party, but, Noel, I'd love to learn more about figuring out why MY app is crashing.

    I agree that when something must be run as administrator, its simply a matter of file system and registry permissions.  Not black magic somehow imbued into the administrator token.

    My problem is, I'm not exactly sure how to do that with Windows 7.  In the past I would use FileMon and RegMon and look for "Access Denied" message.  Can that be done with Process Explorer?  I've looked, but haven't figured it out.

    My application relies on files in its own program folder (obviously), file in the Oracle folder, and file in another application folder.  I have given users Modify permissions to all three of these locations, but I'm still having a problem.  That leads me to believe that it is having trouble access a .DLL (or DLLs) in the Windows and/or System32 folders.

    From Process Explorer, I created a list of .DLLs that my application called, but I'd like to avoid experimenting with elevating permissions to various combinations of these files if I can avoid it.

    Monday, October 04, 2010 2:32 PM
  • I'd probably start with ProcMon...

    http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

    -Noel

    • Proposed as answer by Chitti Sistu Thursday, May 24, 2012 9:14 AM
    Tuesday, October 05, 2010 2:19 AM
    • Proposed as answer by Notalumberjack Monday, November 25, 2013 8:42 PM
    Monday, November 22, 2010 1:04 AM
  • hi,

    whatever you are asking is not possible on windows 7 buddy, to launch an application as admin while using a standard user it always asks for the admin privileges its by default u cant change it....... 

    -------------------------------------------------------------------------------------------------------------------------------------------------------Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. 

    Monday, November 22, 2010 7:44 AM
  • I believe the possibility is dependent on the manifest included with/within the executable.  If the program was compiled to "Require Administrator", there is no way to make it work.

    On the other hand, I have an executable that was compiled with no UAC manifest at all, but it fails unless I right click and select "Run as Administrator".  This particular application has a myriad of dependencies on 3rd party applications.  I'm convinced that if I can figure out what folder/file/reg key I've failing to access as a standard user, I can make this work.

    I looked at ProcMon, but I didn't get anywhere.  I'll check out the robotronic software next.

    Tuesday, November 23, 2010 3:29 AM
  • Try this software http://www.robotronic.de/runasspcEn.html

     

     

    That worked ^
    • Proposed as answer by Notalumberjack Monday, November 25, 2013 8:42 PM
    Thursday, December 09, 2010 4:03 AM
  • Try this software http://www.robotronic.de/runasspcEn.html

     

     

    Agreed, this works like a charm!  No messing around with trying to figure out what part(s) of the program or registry require changing.

    Only annoyance is that it briefly opens a command window to execute, which I can live with.  Also, encryption type/level isn't specified, so theoretically could be broken if it isn't one of the more secure ones.

    • Proposed as answer by Notalumberjack Monday, November 25, 2013 8:42 PM
    Friday, January 21, 2011 7:47 PM
  • Try these two options:

     

    Using Compatibility Mode


    NOTE: This will allow you to always have the program run as an administrator when you open it.

    1. Right click on the program shortcut or program .exe file, then click on Properties, and on the Compatibility tab. (See screenshots below)
    NOTE: If you are doing this while logged on as a standard user instead of an administrator, then you will need to also click on the Change settings for all users button and type in the administrator's password.

    2. To Always Run this Program as an Administrator

    A) Check the Run this program as an administrator box, and click on OK. (See screenshots above)

    3. To Not Always Run this Program as an Administrator

    A) Uncheck the Run this program as an administrator box, and click on OK. (See screenshots below step 1)

    4. Open the program.

    5. If prompted by

    UAC, then click on Yes to apply permission to allow the program to run with full permission as an administrator.
    NOTE: If you are doing this is while logged in as standard user instead of an administrator, then you will need to provide the administrator's password before the program will run as administrator.




    Using Advanced Properties


    NOTE: This will allow you to always have the program run as an administrator when you open it.

    1. Right click on the shortcut of the program, then click on Properties.

    2. Click on the Shortcut tab for a program shortcut, then cllick on the Advanced button. (See screenshot below)

    3. To Always Run this Program as an Administrator

    A) Check the Run as administrator box, and click on OK. (See screenshot below)

    4. To Not Always Run this Program as an Administrator

    A) Uncheck the Run as administrator box, and click on OK. (See screenshot above)

    5. Click on OK. (See screenshot below step 2)

    6. Open the program.

    7. If prompted by

    UAC, then click on Yes to apply permission to allow the program to run with full permission as an Administrator.
    NOTE: If you are doing this is while logged in as standard user instead of an administrator, then you will need to provide the administrator's password before the program will run as administrator.

    Monday, February 27, 2012 2:53 PM
  • I have the same problem: as normal user I cannot run .exe files. Nothing happens when I click on the executable.

    So, I've copied the .exe which does nothing but writes simple 'Hello World' to console window -> it doesn't work.

    I am running out of ideas what to do. I've also tried to set rights via AppLocker - same thing, nothing happens.

    Friday, May 25, 2012 8:44 AM
  • I want to open an application with Administrator Priveleges but should not always ask for the administrator password. Is this possible ??
    Tuesday, June 05, 2012 6:23 AM
  • The following will allow a program that requires admin rights to run by saving the admin credentials: 

    1. Create a normal Short-Cut to application.exe on the desktop. 
    2. Right-click the short-cut and select Properties. 
    3. In the Target box, insert the following before the path to application.exe: "runas /savecred /user:administrator ". 
    4. Double-click the new short-cut, and enter the administrator password.
    • Edited by steelev3 Thursday, January 31, 2013 4:43 PM
    • Proposed as answer by dom8925 Friday, February 15, 2013 9:32 PM
    Thursday, January 31, 2013 4:42 PM
  • This is by far the easiest way to go. Worked like a charm, without having to download third-party software.

    Thank you.

    Tuesday, July 30, 2013 7:16 PM
  • Worked for me to create a workaround for a problem ASUS created and their ENGINEERS cannot figure out how to fix -yes it was escalated.

    6 programs in their AI Suite II utility require admin p/w to run under a std user.

    What a bunch of idiots. True TNS -- Technical NO Support.

    thanks.


    ruggb

    Monday, November 18, 2013 5:03 AM
  • Use the Application Compatibility Toolkit (ACT)

    The option you want to select in the compatibility mode is "RunAsInvoker"

    Just Bing / Google it, since I am unable to add links for some reason.

    ACT allows a program that usually needs Administrator rights to be run normally.

    To add, the account that wants it setup needs temporary local administrator rights to run ACT. Once done ACT and the administrator rights may be removed.

    Tuesday, November 19, 2013 10:38 PM
  • /quiet
    Monday, November 25, 2013 8:43 PM
  • Hi,

    The answer to this thread is also the answer to this thread

    http://social.technet.microsoft.com/Forums/windows/en-US/03de6f80-d994-4e5c-8ffd-f13778c32e5c/how-to-run-business-card-scanner-program-with-out-prompting-the-administrator-password-on-a-domain?forum=w7itproinstall#8f0f6b9a-4e52-473f-aa61-2e45061ce7a0

    They are both programs that try to prompt for Administrator upon starting.

    The tool you will want to use is the Application Compatibility Toolkit (ACT).

    Monday, November 25, 2013 8:52 PM