Re: Automatic Updates as a Limited User in Security

Re: Automatic Updates as a Limited User

Sat, 03 Sep 2005 17:23:57 EDT

geierr : You must be doing this in safe mode, as XP Home does not let you log on using the Administrator account in normal mode. This is one of many reasons why I hate XP Home and use XP Pro instead.
--
Robert L. Geier

WFSE/AFSCME Local 1326

Re: Automatic Updates as a Limited User

Sat, 03 Sep 2005 11:47:59 EDT

anon : Actually, what you don't want to do is install XP Pro over XP Home...be prepared for random crap to happen. Things run slower, hardware gets all jacked up, etc.

Re: Automatic Updates as a Limited User

Mon, 22 Aug 2005 19:13:35 EDT

PhoenixAZ :

said by toadlife :

The solution to that would be to simply create a second admin account in XP home. There are some things that you just can't do using runas...changing your network connection settings (try and change your IP address using runas ;)) is one of them.

Weird because on my laptop that had XP Home on it, I can log in as the Administrator account and it just works.

Re: Automatic Updates as a Limited User

Mon, 22 Aug 2005 17:28:46 EDT

anon :

said by RedXII1234

said by toadlife

Can you not edit file permission in XP Home?

Yes, you can. But not with the GUI.

»www.rt-sw.de/en/freeware/freeware.html
or
»www.dougknox.com/xp/tips/xp_home_sectab.htm

more info:
»www.msfn.org/board/lofiversion/i···800.html

Re: Automatic Updates as a Limited User

Mon, 22 Aug 2005 03:01:17 EDT

toadlife :

said by Quitch :

But I do use automatic updates and I do use a limited account and it works perfectly and it sounds like you are having a problem because automatic updates doesn't do any of what you describe.

You're confused about what this thread is about. Automatic updates will install automatically while limited users are logged in, but the users don't have the same control over the process that a logged on admin has. By default, regular users can't postpone the install or pick and choose which updates to install.
--
"With other distros when you have problems they are problems with Redhat or with SuSE or with Lindows. But if you have problems with Gentoo you have problems with Linux. That's because with Gentoo you have returned to the source." -Some Gentoo Fanboy

Re: Automatic Updates as a Limited User

Mon, 22 Aug 2005 02:52:30 EDT

Quitch : But I do use automatic updates and I do use a limited account and it works perfectly and it sounds like you are having a problem because automatic updates doesn't do any of what you describe.

Re: Automatic Updates as a Limited User

Mon, 22 Aug 2005 02:13:02 EDT

toadlife :

said by Quitch :

Give them a Power User account. The software will work and they'll not revert to using the admin account for everything. Programs which alert them to update will work, then you simply leave them with automatic updates on, install Microsoft Anti-spyware and some anti-virus program, switch on the firewall (or install one) and you're done. Beautiful :)

There is one problem with that. Power User accounts do not exist in XP Home.
--
"With other distros when you have problems they are problems with Redhat or with SuSE or with Lindows. But if you have problems with Gentoo you have problems with Linux. That's because with Gentoo you have returned to the source." -Some Gentoo Fanboy

Re: Automatic Updates as a Limited User

Sun, 21 Aug 2005 19:09:01 EDT

redxii :

said by Quitch :

you simply leave them with automatic updates on, install Microsoft Anti-spyware and some anti-virus program, switch on the firewall (or install one) and you're done.

I use a limited account so I don't have to install all that, or the "very best" that so happens to eat up 100s of megabytes of memory and slows my computer down. You still have to teach users to use all that software, and chances are very likely, they'll always allow firewall traffic or allow something popping up thru MSAS.

Apparently you don't use a limited account, and automatic updates, so that is why you fail to see the point.

Why go through all this? It's already built into Windows.

This guide does not use any 3rd party functions

--
"If you like linux then use it otherwise stop preaching about linux we all already know about it and if we like it we'll use it. If you keep pestering people you look like those annoying Jehovah's witnesses... [..] with nothing better to do."

Re: Automatic Updates as a Limited User

Sun, 21 Aug 2005 18:23:39 EDT

Quitch : If you've got someone who knows nothing about computers it's impractical to set them up with a limited account. There'll be too many programs which simply fail to work, they won't know how to fix the permissions to make them work and they'll use their admin account to run them and eventually run everything.

Give them a Power User account. The software will work and they'll not revert to using the admin account for everything. Programs which alert them to update will work, then you simply leave them with automatic updates on, install Microsoft Anti-spyware and some anti-virus program, switch on the firewall (or install one) and you're done. Beautiful :)

Re: Automatic Updates as a Limited User

Sun, 21 Aug 2005 18:19:03 EDT

Quitch : Forgive me, but I fail to see the point of this for XP. Automatic Updates run under the SYSTEM account and once setup by the admin it doesn't matter whose logged in, or with the Background Intelligent Transfer Service set to manual even if you're logged in at all, the updates will download and then install at your scheduled time, at shutdown if you choose the option, or the next time you start your PC.

Why go through all this? It's already built into Windows.

Also, you can fire up Windows Explorer using RunAs and then you can access the entire control panel as the admin (assuming you've turned it on under My Computer). I've found that on some machines RunAs sometimes doesn't work for Windows Explorer so that Command Prompt tip is handy.

Frankly though, limited users are a pain not because of Microsoft, but because 95% of apps fail to think of non-admin users. Hell, how many programs prompt you to install an update with no option to RunAs or fail to use a registered service with SYSTEM priviliges to handle it?

Re: Automatic Updates as a Limited User

Sun, 21 Aug 2005 11:00:28 EDT

TerryMiller : Thanks for posting this. I've already put it into use on a neighbors new computer.

Re: Automatic Updates as a Limited User

Sat, 20 Aug 2005 05:37:45 EDT

gracie :

said by Tuulilapsi :

kind of makes you wonder why MS even bothered to give us limited user accounts in XP Home, when they seem to have made every effort to make them as difficult as possible to operate.

first off, fabulous article in the original post; thanx.

second, xp home is a blight and a stupid concept, imho. ms should have made all xp's pro and strongly encouraged (and documented the instructions for) running as user for everyday tasks. xp home is NOT easier or more user friendly---users not needing the advanced features of xp pro can just not use them in most cases.

that said, since many of the noobs i support are indeed using xp home, every tip on making it more usable is so welcome! i'll never forget my first "friend's new computer with xp home" setup as i tried desperately to figure out how to get into the built-in admin account to rename and put a password on it (dell ships 'em with a blank password); the old CAD twice definitely doesn't work in xp home.

a quick edit of policies to use the classic login and require CAD to login makes short work of that stupid welcome screen ;).

i hope longhorn will incorporate the best of xp pro and lose the stupid xp home restrictions, making them optional for those wanted a leaner and less-featured setup.
--
graciella! "not tonight dear, I have DSL."
Creating SuperOrganizations Worldwide
Creating & Hosting SuperSites Worldwide

Re: Automatic Updates as a Limited User

Sat, 20 Aug 2005 03:55:32 EDT

Tuulilapsi : Indeed, it is horrible, and kind of makes you wonder why MS even bothered to give us limited user accounts in XP Home, when they seem to have made every effort to make them as difficult as possible to operate.
--
And lead me not into temptation - for I can find my way there myself easily enough.

Re: Automatic Updates as a Limited User

Sat, 20 Aug 2005 03:48:07 EDT

redxii : I forgot about Safe Mode.

That is still horrible, why would anyone reboot into Safe Mode just to click on one checkbox? The command I use hasn't mucked mine up and has always given me desired results. That is what "/e /t /p" is for.

cacls "C:\Program Files\mIRC" /e /t /p Users:F

Re: Automatic Updates as a Limited User

Sat, 20 Aug 2005 03:43:19 EDT

Tuulilapsi : Well, actually, that's not correct. You can edit file permissions in XP Home, with the Explorer GUI, but you can only do so in Safe Mode. Which is, of course, retarded, but better than using the command line tool, in my opinion, since it's notorious for mucking up permissions.
--
And lead me not into temptation - for I can find my way there myself easily enough.

Re: Automatic Updates as a Limited User

Sat, 20 Aug 2005 00:47:38 EDT

toadlife :

said by redxii :

said by toadlife :

Can you not edit file permission in XP Home?

Yes, you can. But not with the GUI.

That blows. Microsoft should not have crippled XP home so much.
--
"With other distros when you have problems they are problems with Redhat or with SuSE or with Lindows. But if you have problems with Gentoo you have problems with Linux. That's because with Gentoo you have returned to the source." -Some Gentoo Fanboy

Re: Automatic Updates as a Limited User

Fri, 19 Aug 2005 21:30:44 EDT

redxii :

said by toadlife :

Can you not edit file permission in XP Home?

Yes, you can. But not with the GUI.

Run command prompt as admin, and use cacls command to change permissions. You need admin for cacls if you are changing permissions on files/folders that you don't have the ability to change ACLs.

Example, I want to giver Users full access to C:\Program Files\mIRC:

cacls "C:\Program Files\mIRC" /e /t /p Users:F

"Users:F" -> : where permission is (N)one, (R)ead, (W)rite, (C)hange (write), and (F)ull Control

Well, just type cacls in a command prompt and see the syntax for yourself. Definitely not user friendly for Home users (but you get to look l33t using the command line).

Hint: Instead of using Program Files, create a subdirectory in the root of the drive (limited users can do this). Create it as your limited user, and you have full control over that folder and all subfolders and files in that folder. That way, such thing can be avoided unless you really want to use Program Files.

On this subject of FAT32, let's keep it ended here: »Re: for those who say "get a mac if you want secur
--
"If you like linux then use it otherwise stop preaching about linux we all already know about it and if we like it we'll use it. If you keep pestering people you look like those annoying Jehovah's witnesses... [..] with nothing better to do."

Re: Automatic Updates as a Limited User

Fri, 19 Aug 2005 21:19:19 EDT

toadlife : Can you not edit file permission in XP Home? Why not just edit the ntfs permissions of the offending program so you can use it as a non-admin?

Re: Automatic Updates as a Limited User

Fri, 19 Aug 2005 19:26:45 EDT

novaflare : still one reason to run as admin. Programs that use program files to store settigns in plane text. But i have a idea for that if some one is willing to test. What you will need is a fat 32 partion or drive put program files on it and change the path to point there. Now if im right just like restore partions on fat 32 there should be able to write to the dir just fine.
--
DSLR security chat at us.ausirc.net chanel #dslr_sec lets pack this channel open source dns server for *nix and windows »powerdns.com

Re: Automatic Updates as a Limited User

Fri, 19 Aug 2005 19:16:20 EDT

toadlife : I have a feeling this might be fixable by tweaking a some local security policy option.

I don't have an XP Home CD avialable to me...just pro, so I can't investigate. :mad:

Re: Automatic Updates as a Limited User

Fri, 19 Aug 2005 19:03:12 EDT

redxii : Here's that error Home Edition will give, if anyone is interested.

If I do so happen to find a way around it without using Safe Mode, i'll be sure to post it but it isn't of much priority.

Re: Automatic Updates as a Limited User

Fri, 19 Aug 2005 18:57:49 EDT

toadlife :

said by redxii :

said by toadlife :

changing your network connection settings (try and change your IP address using runas ;)) is one of them.

Oh crap! I didn't know there was a command to launch control panel from the command line. :)
--
"With other distros when you have problems they are problems with Redhat or with SuSE or with Lindows. But if you have problems with Gentoo you have problems with Linux. That's because with Gentoo you have returned to the source." -Some Gentoo Fanboy

Re: Automatic Updates as a Limited User

Fri, 19 Aug 2005 16:03:00 EDT

Tuulilapsi : This is a good thread. Instead of concentrating on what anti-malware detects this and that, I think it would be much more worthwhile for everyone to pay more attention to the concept of least privilege. I do my Linux and Windows work as regular user, and have had little trouble with the practice, even though I also occasionally play games on both platforms - and I don't mean Solitaire. I'm sorry, folks, but I can't resist spamming this thread with a link to this very good Windows non-admin wiki: »nonadmin.editme.com/
--
And lead me not into temptation - for I can find my way there myself easily enough.

Re: Automatic Updates as a Limited User

Fri, 19 Aug 2005 15:55:15 EDT

redxii :

said by toadlife :

changing your network connection settings (try and change your IP address using runas ;)) is one of them.

I launch a command prompt as admin, then type "control panel". Voila, a control panel where everything will run as admin :p Including Network Connections.

Yeah, XP Home users will have to create an admin user.
--
"If you like linux then use it otherwise stop preaching about linux we all already know about it and if we like it we'll use it. If you keep pestering people you look like those annoying Jehovah's witnesses... [..] with nothing better to do."

Re: Automatic Updates as a Limited User

Fri, 19 Aug 2005 15:51:52 EDT

toadlife : The solution to that would be to simply create a second admin account in XP home. There are some things that you just can't do using runas...changing your network connection settings (try and change your IP address using runas ;)) is one of them.

Re: Automatic Updates as a Limited User

Fri, 19 Aug 2005 15:46:40 EDT

Cudni : No, pressing Ctrl+Alt+Del twice, will not work in XP Home as it does in XP Pro. That admin account can only be accessed in SafeMode

Cudni
--
What is now proved was once only imagined.
Help yourself so God can help you

Re: Automatic Updates as a Limited User

Fri, 19 Aug 2005 15:45:14 EDT

toadlife : Ok. Good to know. I've had very litle experience with XP Home - only Pro.

Re: Automatic Updates as a Limited User

Fri, 19 Aug 2005 15:40:49 EDT

redxii :

said by toadlife :

This works in XP pro, and it might very well work in XP home too. Can someone here with XP Home tell me if it works try it out with XP Home?

Having used Home, and having tried it, I am correct in that you cannot do it that way either. It says something about being restricted. I can't give a verbatim error message since I use XP Pro now.
--
"If you like linux then use it otherwise stop preaching about linux we all already know about it and if we like it we'll use it. If you keep pestering people you look like those annoying Jehovah's witnesses... [..] with nothing better to do."

Re: Automatic Updates as a Limited User

Fri, 19 Aug 2005 15:35:54 EDT

toadlife :

said by redxii :

XP Home users cannot use the builtin Administrator account except in Safe Mode.

Excellent post, but I think the above *might* be wrong. If you press Ctrl+Alt+Del twice at the logon screen, the classic logon screen will come up and you can log in as administrator.

This works in XP pro, and it might very well work in XP home too. Can someone here with XP Home tell me if it works or try it out with XP Home?

Re: Automatic Updates as a Limited User

Fri, 19 Aug 2005 15:20:00 EDT

Cudni : So now there are no excuses not to run as limited user ;), ok there are some but overall.

A great post and a great workaround. Good stuff!

Cudni
--
What is now proved was once only imagined.
Help yourself so God can help you

Automatic Updates as a Limited User

Thu, 18 Aug 2005 22:41:24 EDT

redxii : Here are a few references:
»Catch-22 Limited Account vs. Auto Updtes
»auto updates and limited user

It is possible! However, this guide is geared towards 2000/XP Pro because a certain group policy setting has to be enabled. XP Home users will have to import this registry entry. XP Home users cannot use the builtin Administrator account except in Safe Mode.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"ElevateNonAdmins"=dword:00000001

Prerequisites:
-Windows Update V6
-One of the following:
--XP SP2
--XP SP1
--2000 SP4

Setup:
XP Pro SP2
Windows Update V6
Logged into an account under the Users group

Here's a shot of Add/Remove of XP Pro without any updates other than Service Pack 2:
[att=1]

First of all, as an administrator, you need to enable Automatic Updates. For my purposes, I chose the option to "Notify me but don't automatically download or install them." You can use whatever option you wish, the fully automated and scheduled install will also work.

The easiest way in your limited account to enable Automatic Updates without logging off into an admin account is to go into the Control Panel and hold shift, and right click on Automatic Updates and choosing RunAs. You'll need to run it as an account with admin privileges. Using an admin account without a password will not work!

[att=2]

Next, you need to open the Group Policy editor as an administrator. Alternatively, you may import the ElevateNonAdmins registry entry as admin and skip the group policy editor.

runas /user:Administrator cmd (press enter)
(enter admin password then press enter)
gpedit.msc (press enter)

Browse to the following: Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update. In the right pane, open "Allow non-administrators to receive update notifications," and set its property to Enabled. Apply and exit the Group Policy Editor.

Windows 2000 users will have to right-click Administrative Templates, and choose to add a template. Click "Add" and add wuau.adm.

XP Home users will have to, as admin, import the registry entry for ElevateNonAdmins.

[att=3]

You may need to log off to get the process going, or you may not have anything to update at all. Rebooting is not required!

[att=4]

Select updates to download:

[att=5]

Updates begin to download:

[att=6]

After updates are finished downloading, I selected Custom. I was going to pick all the updates anyway, but just wanted to see the list:

[att=7]
[att=8]
[att=9]

Updates are installing:

[att=10]

This is just to assure you that I am still running as a limited user, and wuauclt.exe running as SYSTEM and my account.

[att=11]

Updates are done! All installed successfully. Time to reboot.

[att=12]

After rebooting, all the updates appear in Add/Remove. For extra assurance, one update (in this case MS05-039) is shown to have properly been installed:

[att=13]
[att=14]

As you may or may not know, you won't be able to install new versions of programs this way. Say you decide to install WMP 10 or new version of DirectX, you can always go to »www.microsoft.com and download the setup. Use RunAs to install, and you are still saved a trip from *logging out, logging into admin, running Windows Update*.

Some might argue, that strictly only the administrator account needs to update Windows. For home users, this will be VERY helpful for non-admin users. Not all IT staffs may find this suitable where a large number of the users are non-admin, and strip to the bone of their account rights (especially schools).