Software and Domain user group

[raksasas]

I am not positive that this is the correct section of the forum because to me in fits into the operating system and the network/security side of things.

Now when when I started working for this Department as the only tech a lot of users here had local admin rights on their computer. I have slowly gotten the numbers down on this but there are still several that still have it; mainly the upper guys that "demand" they have admin rights. Mainly my boss and above. Well the main excuse they they all give/gave me was that the software required admin rights to run but they shut up when I proved them wrong at least most of the time. But enough of this part.

Now, I am getting more into some stubborn software that I just can't figure out all the parts of the drive that it is trying to access.

My questions are:
How do y'all handle getting software to run without giving out local admin rights in a domain environment?

Is there a piece of software that can till me which parts of the drive that the software is trying to access so that I can go in and give the proper security rights on the required folders?

Sorry if these common questions but being the only tech here I don't have anyone to ask and if I ask the guy that I replaced (he was moved else where in the department) he just says give them local admin rights to their computer and be done with it which = less work to do but more security holes. I have tried googling for the answer but I mainly get why users shouldn't run as admin.

Thanks

 

[oakfan52]

I use sysinternals filemon and regmon.

You should also look at the Microsoft Application compatbility tool kit.

 

[TheToE!]

If the clients have XP installed, do this.

-Right click the shortcut to the program

-Click "Run As"

-Click Run as "The following User"

Then just type in the credentials of an administrator. That way they have full admin rights to run that program, but thats it.

Hope this helps,
-ToE

 

[XOR != OR]

Unfortunately, as I understand it, the OP is trying to get software to run as a limited user; Giving admin creds out is the opposite of what he/she wants. The right-click run-as idea doesn't really work in that regard.

However, if you could setup an admin user on the local machines that doesn't have install rights ( as well as a host of other things take away ), you might be on to something. Personally, I'd just use regmon/filemon and be done with it.