Running as non-Admin sucks? Not for me, it doesn't...

Posted Saturday, April 12, 2003 12:16 PM by G Andrew Duthie

Samer writes:

Ok let's be honest here... Running as non-Admin ABSOLUTELY SUCKS.  There is no doubt about this one. I've been on the running as non-Admin kick on my home machine for a while and quite honestly it's not easy.  We're all used to the "god powers" on our machines.  Running as non-Admin you are more like a peasant than a god.  I find myself having to switch back and forth between account ALL the time.  I have some setup somethings setup as  "run as" according to Raj Chaudhuri's recommendations (look in the comments).  That makes it easier but hell running as non-Admin is still hard and not everything works.  Andrew is right however.  Running as non-Admin teaches you not to cheat as a programmer and security issues you never knew existed.  Follow Andrew, Anil, and Keith's recommendation but dont fool yourself into thinking it's easy.  It's not.

[Samer Ibrahim]

I just have to disagree somewhat with the "ABSOLUTELY SUCKS" part. I'm not sure what, if anything Samer is doing that I'm not, but I just don't find running as a non-admin to suck even a little. Just for the record, though, I don't think I ever said it was easy. There are a few inconveniences I've noticed, which include:

  • You can't conveniently run Windows Explorer as an admin, so changing ACL requires either using XP fast user-switching to switch over to an admin login long enough to change the ACLs, or using CACLS from a command line opened using Run As...
  • Norton Antivirus cannot successfully run LiveUpdate from a non-admin account (how stupid is THAT?), so in order to update your virus definitions, you have to switch over to an admin login session (though I think you might also be able to run LiveUpdate standalone using Run As... I'll have to try that next time). What's particularly irritating about this is that LiveUpdate pops up automatically at specified intervals, trys to run, but fails to properly install the updates. Guess what? This software was almost certainly written by someone running as Admin, which highlights why it's so important for developers not to do this.

I'd love it if everyone who has tried/is trying this could post a list of the things that they've run into that "don't work", and any workarounds they have. The more we can build up a knowledgebase of how to make running as a non-admin work, the more likely it is that folks will do it, rather than think that they can't do it.

Comments

# Tip for Explorer when running as non-Admin : A Blog for Graymad

Saturday, April 12, 2003 12:16 PM by TrackBack

Tip for Explorer when running as non-Admin : A Blog for Graymad

# First post from w.bloggar... : A Blog for Graymad

Saturday, April 12, 2003 12:16 PM by TrackBack

First post from w.bloggar... : A Blog for Graymad

# Windows Explorer as Admin

Saturday, April 12, 2003 1:56 PM by Drew Robbins

Does this qualify as convenient?

You can launch Internet Explorer as Admin and switch to folder view while remaining in admin mode.

In XP, you can't do a run as from the "Pinned" start menu. You have to use a shortcut from Program Files, Quick Launch, etc.

Now, if I could just find away to launch iexplore in folder view...any ideas?

# One more interesting thing

Saturday, April 12, 2003 2:09 PM by Drew Robbins

First, I should have been more precise. Launch Internet Explorer as Admin and turn on the Folder explorer bar (View | Explorer Bar | Folders). That's what I meant by "folder view".

This is interesting. Once you have this admin explorer open, applications including control panels are all launched as admin. This could also be dangerous - at some point you are basicly running as Admin again.

I wonder if there is someway I can color the background or make some visual indication just for this Admin explorer. So that I can see clearly what mode I'm in for that explorer. A bright red background, although annoying, would sufficiently warn me when I go to launch an app from this admin iexplore instance.

And it should be said, never browse the internet as Admin.

# re: Running as non-Admin sucks? Not for me, it doesn't...

Sunday, April 13, 2003 1:04 PM by Samer Ibrahim

Sorry for the delay in responding to you.... hectic week. Anyway, just to give you an example of the problems I've encountered just today:
- I don't have a calendar at my desk so I normally use the system time calendar. I tried to double click it so I can see the calendar, access denied.
- I wanted to see The Matrix trailers so I needed Quicktime 6 on my machine. I need to log on as admin to install.

WinAmp doesn't save any of my settings as a normal user. Everytime I change my settings and close out it, the next time I restart it the old settings are back.

I was working on a project where I need to copy files to Inetpub. No go. Had to log on as Admin to do it.

Maybe you've found work arounds for all these things but they are not limited to these problems. If you have any tips let me know otherwise I guess you're simply a better man than I :).

By the way I'm not the only one who thinks it sucks just look though Craig Andera's blog starting from this entry [1].

-Sam

[1] http://staff.develop.com/candera/weblog/2003/02/06.html

# re: Running as non-Admin sucks? Not for me, it doesn't...

Monday, April 14, 2003 4:40 AM by Julien Adam

About LiveUpdate I disagree with you. Software that updates my antivirus should definitely require admin permissions. It should however fail more gracefuly when ran from a non-admin account. Liveupdate replaces .exe, .dll files, I can't see how it could run as non-admin. Am I mistaken ?

# re: Running as non-Admin sucks? Not for me, it doesn't...

Monday, April 14, 2003 6:16 AM by G. Andrew Duthie

Julien,

No, you're probably right. LiveUpdate *should* require elevated permissions to run (not sure that it should require full Admin perms, but that's another issue). You are also correct, and I should have been more specific that what's stupid is that it will try to run as non-Admin, and fall over in such a way that it is completely unclear why it fails. If you didn't know that it was failing as a result of low privilege, you would have no idea how to fix the problem. THAT'S stupid, in my mind, and likely the result of developing with elevated privileges, or at least poor testing.

# Running as Admin - Don't!

Saturday, April 10, 2004 11:33 AM by TrackBack

# re: Running as non-Admin sucks? Not for me, it doesn't...

Friday, July 30, 2004 11:44 AM by Aaron Margosis

Sorry for coming in so late here. The answer to LiveUpdate is the same as for WindowsUpdate - it should be done by a service, not a user.

Also, see my blog for different ways to differentiate privileged from nonprivileged cmd, Explorer and IE windows.

# re: Running as non-Admin sucks? Not for me, it doesn't...

Sunday, August 24, 2008 2:12 PM by ламинат

2oThank's for greate post.7w I compleatly disagree with last post .  auv

<a href="http://skuper.ru">купить ламинат</a> 1p

Leave a Comment

(required) 
(required) 
(optional)
(required)