The Windows XP runas command

[jsauce]

Okay usually I don't have problems with windows that I cannot fix myself but this one is annoying. I figurd maybe someone might have found a fix for this issue and can provide me with the solution.I have yet to find one and Microsoft isn't even clear on it.

OKay I have the normal administrator account, and myself as an adminstrator. This is local not domain. Okay my problem is that when I try to install a system type program the program is denied access even though I am an adminstrator. I come to find out that when I right click on the executable and select runas, I get the normal dialog about running the program as a different user, except that checked is 'Protect my computer and data from unauthorized program activity.' If I uncheck this the install is fine, or sometimes I have to run it as as the Administrator account. In any case I believe this happened when I installed Windows XP SP2 beta. But I cannot be absolutely sure. Although I reverted my system back to Windows XP SP1, this problem occurs. I don't ever remember it annoying me about installing things since I am the administrator, and I believe that in other times when I actually looked under runas it was never checked before. THe annoyance is that even when you uncheck it, Windows just resets it. There doesn't seem to be a setting that allows this to be changed. I've looked through all the docs and knowledge base and the technet and I cannot find anything on it. It's one of those obscure windows things that hasn't gotten a lot of press. Its extremly annoying and I'd hope someone else might have found a fix. I'm really looking for a registry setting or something to not have Windows check that box on every executable. So any help would be appreciate, this admin has struggled to fix it and cannot figure it out.


Thanks in advance.

John D. Saucier
jsauce@magicguild.com
Certified Technician
Network Administrator

 

[bcastner]

John,

There is still a lot unresolved as to how credentials are passed under Service Pack 2.

Diagnosing RUNAS is difficult without specific details, but see what I call the "bcastner" MS KB article to give you possible clues depending on what state your registry may be with hotfixes/service packs:

http://support.microsoft.com/?kbid=834489

 

[bcastner]

You might consider that a registry key needed was changed by some malware, or even by SpyBot.

I am not certain why it should effect anything other than Internet Options, but it does at times effect an important registry key for regular Folders.

See Kelly Theriot's notes on this curious issue: (quote)

When you try to access Folder Options from within Windows Explorer, or Internet Options from within Internet Explorer, you receive the following error message:

"Restrictions - This operation has been cancelled due to restrictions in effect on this computer. Please contact you system administrator."

The Folder Options and Internet Options may still be available from the Start Menu, Settings, and the Internet Options Control Panel applet.

A NoBrowserOptions setting in the Registry causes both Folder Options from within Windows Explorer and Internet Options from within Internet Explorer to be 'restricted'. Why Folder Options is affected, is not known at this time.

Click the link below and download the nobrowseroptions.inf file. Save the file to your hard drive. Locate the file and right click it, select Install. This will clear the Registry entry. You may need to log off/log on for the change to take effect.

http://www.kellys-korner-xp.com/regs_edits/nobrowseroptions.inf

 

[jsauce]

Had no effect, when I right click on any program and select runas the default of 'Protect...' is checked. Like I said I think my mistake was ever installing Windows XP SP2 beta. I actually liked the tough restriction on security until it made some webpages and scripts not run and the security center was impossible to really disable. Like I said I uninstalled it, however apparently this was one thing that didn't get disabled. This is really one of the biggest annoyances I have seen so far, as if I'm an administrator then I have full access and I should be assumed as not need this data protection. Its really designed for the limited user. OKay about having spyware or a trojan installed. Never happened to me, I take my security very seriously. I would normally not care about such a problem, but for the fact that this option should not be enabled by default on an administrator or once unchecked it should stay unchecked. I don't need microsoft enforcing something I can decide for myself.

Thanks bcastner, got any more ideas about the problem. I'm hoping this is one problem where enough people with info can fix it. As I said I have looked at everything and there doesn't seem to be anything from microsoft on it. My belief is that this was in fact enabled by SP2. And of course another reason I didn't like SP2 the enforcment of microsoft security without a choice or a way to remove something.

John D. Saucier
jsauce@magicguild.com
Certified Technician
Network Administrator

 

[bcastner]

Then treat the issue as "normal."

I know it is an obscure message, but just check the box and continue; your RUNAS session will work.
Quoting MS:
"When you launch a program in Windows XP Professional with the graphical RunAs utility, selecting 'Protect my computer and data from unauthorized program activity' runs the program with a restricted token that contains the
S-5-12 SID."

Meaning, you get one SESSION value with the token.

 

[jsauce]

Well I removed every hotfix, then proceeded to repair install Windows XP Pro. Long story short, no go. Looks like the only fix now will be a format/reinstall. Looks like I won't be installing SP2.

John D. Saucier
jsauce@magicguild.com
Certified Technician
Network Administrator