Limited User Accounts Problems

[igraul]

I'm trying to run SageTV from a "Media Center" limited user account on my XP Pro system. The splash screen seems to hang as it loads the interface. Any suggestions regarding what's up?

Thanks, I love SageTV.

[Mike]

Just to bump this up a bit, I'm interested in this also. Right now I'm running under an admin account, but when I make my next major system change, I would like to limit the account for security. I'd appreciate input as well.

MBrew

[Mike]

I filed a support request on this issue, and was told that it was not currently possible to run as a limited account, but that it was being looked into.

Mbrew

[ctgoodman]

Hi all.. I work as a systems analyst and deal with these issues on a daily basis. I'll not get on my soapbox about developers that say any application must run as an admin.

There are a couple of things you can try. first you can set the permissions on the Frey Technologies folder in program files and give "users" modify rights to the folder. Second you can give "users" full control of the Frey Technologies registry key at HKLM\Software\Frey Technologies. If it's just an issue with file or registry rights this should get it going under the limited account. There could be some other areas where permissions may be needed but you'd have to use some utilities like filmon and regmon www.systernals.com to monitor the file and registry reads writes under the limited account.

Now if it's something else like we see with some CD/DVD burning packages. The need some access to the hardware or system driver that these permissions can't fix.

I havn't had a chance to work on this myself since I only connect my box to the internet about once a week to get the guide data I havn't worried too much about it. I do plan to do some other things that will require a constant connection that I'll really wish to pursue this. So if anyone tries this or gets it working let me know.

[dvd_maniac]

I am having a similair headache trying to get office 2002 to run under a restricted user account as well as Sage.
Anybody give me some tips on this?

I gave the office10 folder (everyone: full control) and even gave the restricted user full control as well. but everytime I open up an office app with the user it goes through the reconfigure installtion process...make that user an Admin and it works fine.

[dongta]

Have you tried giving the limited account administrative rights? Then run SageTV so it can make the necessary changes. Afterwards, remove it from administrators group.

[Opus4]

In case there is confusion about today's posts on this topic: I found a bunch of duplicate posts to similar threads this morning, so I consolidated them all to the most recent thread on the subject.

- Andy

[dvd_maniac]

Have you tried giving the limited account administrative rights? Then run SageTV so it can make the necessary changes. Afterwards, remove it from administrators group.

How would I do that?

[dvd_maniac]

could be some other areas where permissions may be needed but you'd have to use some utilities like filmon and regmon www.systernals.com to monitor the file and registry reads writes under the limited account.

Thanx !!!ctgoodman!!! that worked perfectly.

[Mike]

I am having a similair headache trying to get office 2002 to run under a restricted user account as well as Sage.
Anybody give me some tips on this?

I just installed Office 2003 last week and I'm having the same issue. So far
Iv'e spent more than half a day on the web looking for a solution, and i've found seeral supposed fixes that don't fix nothin! I'm torqued at Microsoft over this, you'd think if anybody would get that one right it would be them.

Hi all.. I work as a systems analyst and deal with these issues on a daily basis. I'll not get on my soapbox about developers that say any application must run as an admin.

I almost didn't post that followup...now I'm glad I did. It loks like there are some pretty good tips here.

[dvd_maniac]

Hi Mike,

I used the regmon from www.sysinternals.com and it worked perfectly.
I also gave full perrmission to the office folder in program files. Took me about 15-20 minutes to fix it. Also you have to run each program and actually open something up like a template and just keep assigning permissions to the reg keys as you go.
If you have mulitple limited user accounts then just assign the \\computername\Users account so you do not have to do it more then once or whenever you add limited users.

On a different note:
Can somebody help me with logging off a limited user on an XP client machine at a certain time? I have the "Logon Hours" setup correctly but that and "force logoff when logon hours expired" in the domain policy does not actually log them off the console.
The at command does not work with limited users so using:
at 22:00 Shutdown will not work.
Using Task Scheduler without it seems to be more of a Global Local Computer setting. I only want to restrict Limited Users.
I am using Windows server 2003 as a domain and users logon to XP clients using roaming profiles.

I would appreciate any help on this one as it is the final step in my 2 week project of setting up a home domain network.

And thanx again ctgoodman for your help with Office. I was about to give up.

[Mike]

Thanks to both dvd maniac and ctgoodman for the tips. I'll give them a try as soon as I get a chance. It does irritate me that I'm having to use work arounds like this on a Microsoft program though.

Thanks again,
Mbrew

[dvd_maniac]

It does irritate me that I'm having to use work arounds like this on a Microsoft program though.

That sounds like a double negative to me...
Everything Microsoft related "IS" a work around in progress...IMHO

Good Luck

[ctgoodman]

Well the issue with the limited user on a Windows system stems from that's not what it was designed to work with. It was designed for the user to run as a system administrator. This is the reason windows systems are targeted and so easily inundated with viruses and spyware/adware/malware. Also it's why it's sometimes so difficult to run as a limited account. The Macintosh and Unix/Linux machines always ran the systems with the least privilege out of the box and only elevated privledges when necessary.

From what I've read Windows Vista is making great strides in operating as a limited account. I run as a limited account on my main machine and it poses some challenges that most people not savvy in the computer area would quickly switch back over to an admin account. I can say that I have zero spyware/adware/malware issues running as a limited user.

Those interested in limited user account setup check this site out
http://blogs.msdn.com/aaron_margosis/

dvd_maniac. the logon hours GPO will only lock them out of network resources and will not log them out of the local machine. Have you tried adding and startup script under your computer configuration of the GPO with your "at 22:00 shudown" command? I havn't tried it but it may execute as the machine account rather than the user

Also if anyone is wondering running as power user is just as bad as running as admin. Never grant users modify rights to the entire Program Files or Windows folders and only assign registry permissions to the specific softwares keys in the registry. I had friends open up all those folders and the entile HKLM and HKCR keys. The where absolutely crushes by malware and spyware shortly after.

[ctgoodman]

dvd_maniac you may also try the psshutdown tool from www.systenals.com and make a scheduled task on your server to shut them down remotely over the network or script it to create the task on the local PC, so you would have some control over changing the parameters as needed without having to sit down at the machine. You could also buffer in 5 or 10 minutes to finish up their work or email.

[dvd_maniac]

dvd_maniac. the logon hours GPO will only lock them out of network resources and will not log them out of the local machine.

Figured that one out after tearing a few hairs out of my head!!!

Have you tried adding and startup script under your computer configuration of the GPO with your "at 22:00 shudown" command? I havn't tried it but it may execute as the machine account rather than the user

I ONLY want the limited users booted as these are the kids. I do not want Me to get booted in the middle of something. I can do this on the kids machines in thier bedrooms but the main problem is the Living Room and downstairs Family room.

dvd_maniac you may also try the psshutdown tool from www.systenals.com and make a scheduled task on your server to shut them down remotely over the network or script it to create the task on the local PC, so you would have some control over changing the parameters as needed without having to sit down at the machine. You could also buffer in 5 or 10 minutes to finish up their work or email.

I would appreciate any help of pointing me in the right direction to write a logon script that would start a task schedule on the machine they logon to.

[dvd_maniac]

Finally got it working
create Restricted User
logon to an admin and create a task schedule for Shutdown -r -f and set the scheduled times
give restricted user only read & execute and deny write permissions. and click only if logged on under advanced settings.
I was wondering if it would be better to create a logon script instead though. That way, He'll be logged out from any pc he's logged into instead of creating seperate tasks on each pc and then have to worry about password changes...

[trini0]

Im still on my 15 day eval with Sage.
Its late, and Im not sure if Im reading this thread correctly.
SageTV cannot be used in a limited account, unless hacks are performed on the OS...

Please tell me I misunderstood.

[dvd_maniac]

It's funny because I was able to run Sage just fine from a limited account. I only had to apply hacks for other things to work...

[trini0]

Ok. Thanks for the reassurance..
Just need more sleep