Solving poorly programmed app that requires local admin rights

TAHIN

@Dashrender

I don't follow?

I learned about that tool on reddit.

Jason

depends on the program some we use Process Explorer to find what it's doing

other times we use compatibility toolkit like for UPS worldship

https://community.spiceworks.com/how_to/36348-man-ups-allow-users-to-update

wrx7m

When I migrated from XP to 7, I ran into issues with programs requiring local admin and rights to run. Specifically, the UPS Worldship updater. I found that using the Microsoft Application Compatibility Toolkit was the answer. You create a small DB that allows you to specify certain executable to run as a local admin without prompting the user to specify admin credentials.

https://msdn.microsoft.com/en-us/library/windows/desktop/dd562082(v=vs.85).aspx

Dashrender

Thanks to those that mentioned the Application Compatibility Toolkit.

I installed this last night and spent around 4 hours having it create and apply mitigations to my program and it still never worked.

Damn this program is stubborn! This program specifically checks what permission level it has on several processes. If I have time I'll dig out a log and post it.

Dashrender

One of the issues I had with the ACT is that I couldn't save the log files unless I ran ACT as an admin, but this brought along the problem that ACT would only run in privileged mode, which allowed my application to run and ACT to create some additional mitigations, but still not enough to make the program work as a non admin.

Alex Sage

@Dashrender What about RemoteApp? Would that help at all?

Dashrender

@aaronstuder said in Solving poorly programmed app that requires local admin rights:

@Dashrender What about RemoteApp? Would that help at all?

RemoteApp is just the application running on a Terminal Server, right? So that wouldn't help, because I'd still have to have it running as an admin on the TS.

Alex Sage

@Dashrender The app would have admin right on the server, but none on the workstation? Maybe I am misunderstanding?

brianlittlejohn

@aaronstuder You would have to give everyone admin rights on the Terminal Server.

JaredBusch

@brianlittlejohn said in Solving poorly programmed app that requires local admin rights:

@aaronstuder You would have to give everyone admin rights on the Terminal Server.