Windows sysinternals

16 Part I Getting Started
unrestricted access to the computer and all its resources, while Users are restricted from
making changes to operating system configuration or accessing data belonging to other
users. For historical reasons, however, until recently end users on Windows computers were
frequently granted administrative access, so many people have remained unaware that these
distinctions exist. (Even today, the first local user account created on a Windows 7 computer
is a member of the Administrators group.)
Note Users can have effective administrative control over a computer without explicit membership
in the Administrators group if they are given the ability to configure or control software that
runs in a more powerful security context—for example: granting users control over systemwide
file or registry locations used by administrators or services (as Power Users had before Windows
Vista); granting users “admin-equivalent” privileges such as the Debug, Take-Ownership, Restore,
or Load Driver privileges; or enabling the AlwaysInstallElevated Windows Installer policy, under
which any MSI file launched by any user runs under the System account.
Recently, organizations wishing to improve security and reduce costs have begun moving
toward a “non-admin” model for their end users. And with Windows Vista’s introduction of
User Account Control (UAC), most programs run by users—including those who are members
of the Administrators group—execute with user rights, not administrative rights. However,
it sometimes becomes necessary to run a program with administrative rights. While many
people didn’t know how to do this in Windows XP, Windows Vista changed those methods
significantly.
Many of the Sysinternals utilities always require administrative rights, while many have full
functionality without them. Some, however, are able to work correctly with standard user
rights but have features that need administrative rights, and thus operate in a “partially
degraded” mode when executed with standard user rights.
Running a Program with Administrative Rights on Windows
XP and Windows Server 2003
If you log on to a Windows XP or Windows Server 2003 computer with an account that is a
member of the Administrators group, no special steps are required to run a Sysinternals utility
with administrative rights. Every program you run has full administrative rights.
But if you log on to that same computer with an account that does not have the required
privileges to run a particular Sysinternals utility, you will need to get the administrative rights
from a different user account. The Secondary Logon (Seclogon) service enables programs to
start a new process as a different user on the current desktop by supplying alternative credentials.
Two programs that expose this functionality are Explorer’s Run As dialog box and
the Runas.exe command-line utility.
www.it-ebooks.info