Welcome to MS Vista Forums!
FAQFAQ    SearchSearch      ProfileProfile    Private MessagesPrivate Messages   Log inLog in

Full Control to Users programmatically

  
Goto page Previous  1, 2
   MS Vista Forums (Home) -> Account Administration RSS
Next:  Logon Credentials  
Author Message
Paul Clement

External


Since: Feb 12, 2007
Posts: 2



(Msg. 16) Posted: Mon Feb 12, 2007 11:10 am
Post subject: Re: Full Control to Users programmatically [Login to view extended thread Info.]
Archived from groups: microsoft>public>vb>general>discussion, others (more info?)
On Sun, 11 Feb 2007 04:50:27 GMT, "mayayana" wrote:

€ > Look guys,
€ >
€ > It has *never* been acceptable to MODIFY files in Program Files.
€ >
€ > Just because it WORKED in earlier version of Window doesn't mean it was
€ *OK*
€ > to do so!
€ >
€
€ We all know Microsoft's party line. What Microsoft
€ decides is "OK" is not particularly relevant here. They
€ designed a product. They sell it. Now people writing
€ software need to decide the best way to deal with it.
€
€ You know perfectly well that Program Files has always
€ been where most software worked out of until recently.
€ (After all, what point would there be to VB's App.Path
€ property if nothing there could be accessed? Smile And very
€ few people other than corporate lackeys on workstations
€ run XP as anything other than admin.
€
€ It's not as simple as just "going along with the plan".
€ Even if you think that Microsoft's general plan makes
€ sense, it's only geared toward corporate users. Home
€ and small office users want functionality...they don't want
€ frivolous warnings...and they usually don't want settings
€ changing between users. So the challenge is to work
€ out the simplest way to seamlessly allow people to run
€ software that way, as unrestricted for all users.
€
€ I think that everyone wants to try to do that in a
€ standard way that makes it easy for users, but the
€ options in Vista for all-user-accessible software seem
€ to come down to either cutting the security in Program
€ Files or moving everything to All Users App Data. There
€ doesn't seem to be an option that's in accord with what
€ MS officially defines as "OK".
€

Make up your mind. If you want to provide your application with free reign over the system then
disable UAC. Otherwise follow the rules that are implemented in a secure environment and play in
your own sandbox.


Paul
~~~~
Microsoft MVP (Visual Basic)

 >> Stay informed about: Full Control to Users programmatically 
Back to top
Login to vote
Paul Clement

External


Since: Feb 12, 2007
Posts: 2



(Msg. 17) Posted: Mon Feb 12, 2007 11:18 am
Post subject: Re: Full Control to Users programmatically [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
On Mon, 12 Feb 2007 10:00:18 -0000, "Dave O." wrote:

€
€ "Jimmy Brush" wrote in message
€
€ > Look guys,
€ >
€ > It has *never* been acceptable to MODIFY files in Program Files.
€ >
€ > Just because it WORKED in earlier version of Window doesn't mean it was
€ > *OK* to do so!
€
€ Interesting, I wonder why MS SQL Server stores its database files in
€ C:\Program Files\Microsoft SQL Server\MSSQL$<instance name>\Data
€ They change a lot, one tune for the piper and one tune for everybody else!

Nope. SQL Server operates under a service which has sufficient permissions to access the file store.
It is middle-ware that has its own security mechanism, by which the underlying files can be
accessed.


Paul
~~~~
Microsoft MVP (Visual Basic)

 >> Stay informed about: Full Control to Users programmatically 
Back to top
Login to vote
"cquirke

External


Since: Feb 18, 2007
Posts: 368



(Msg. 18) Posted: Mon Feb 12, 2007 9:37 pm
Post subject: Re: Full Control to Users programmatically [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
On Mon, 12 Feb 2007 08:04:49 -0800, "Ken Halter"

>...because MS has no other way of preventing a virus
>from infecting a users files, then... guess what. That user is an idiot
>anyway and deserves to have their files wasted. As anyone ever heard the
>term "backup"?

Yep, part of the problem is a broken data/code distinction, both by
design (autorunning macros in "documents", scripts in HTML plus
pervasive use of HTML as generic "rich text") and via exploit (GDI
Plus, WMF, etc.). It doesn't help when MS replaces a complex but
reasonably accurate file name extension with self-spoofable icons,
before going on to undermine extensions by acting on hidden type cues
embedded within the file itself.

But simple date-based backup is close to useless as a way of hedging
against malware, which is often designed to avoid being detected until
Payload Day or (as more common now) for its working life.

So you have to scope between backed-up data and malware or infectable
code, it you aren't going to restore malware with the backups.

In an age of "code of the day" patching, you can't combine a
scoped-out data backup with a day-zero code base, known to be
malware-free because it was saved before malware exposure. If you
take an unpatched code base online to patch it, you may very well get
malware'd before your patches are downloaded.

So, how do you maintain an up-to-the-minute fully-patched code base
backup that excludes malware? Are you going to use the same av that
missed the malware in the first place, to scan this code base and data
backups before use? If so, from what ?clean OS will you do this scan?



>--------------- ---- --- -- - - - -
Saws are too hard to use.
Be easier to use!
>--------------- ---- --- -- - - - -
 >> Stay informed about: Full Control to Users programmatically 
Back to top
Login to vote
Schmidt

External


Since: Feb 11, 2007
Posts: 5



(Msg. 19) Posted: Tue Feb 13, 2007 5:26 am
Post subject: Re: Full Control to Users programmatically [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
"Steve" schrieb im Newsbeitrag


>>No that's not so easy.
>>Imagine an app (e.g. a FamilyAddresses.exe with a
>>'CommonAddresses.mdb') for wich every user of the
>>machine (the whole family) has to have Read *and*
>>Write-Access.
>>Where should the file 'CommonAddresses.mdb' has to
>>be placed?
>>In "AllUsers"?! - ok - but then only the owner (creator) of
>>this file has write-access to it.
>>This means, either FamilyAddresses.exe has to run under
>>an Admin-Account or an Admin allows write-access to
>>this single file in (and for) "AllUsers" explicitely.

>Am I mis understanding it or is this poster simply wrong? Or is
>this simply not really a solution?

My quoted post is based on tests on (german) XP only.
There you can create Accounts based on the (predefined)
Useraccounts (over Group-Memberships) as "Benutzer"
and "HauptBenutzer" - in english probably something like
"Users" and "MainUsers".
The MainUsers have more rights than the "normal" Users
(in another post I've named them "advanced" and "reduced"
User-Accounts.

The restrictions from my quote above are related to the
"normal", "reduced" UserAccounts, not the MainUsers.
Don't know, if the "Standard-Useraccount" on Vista
is closer to XPs normal, reduced Useraccount or closer
to XPs advanced, MainUser-Account.

I'll write the last sentence from the above quote again,
because it was not entirely correct.
[Regarding Data-Files, in AllUsers-Documents]
[XP-only -> Vista not yet checked]
"This means, either FamilyAddresses.exe has to run
under an Admin- or a MainUser-Account ...
or an Admin or the Creator of the Data-File allows
write access on this file for other "reduced Users"
explicitely (either by hand or using the appropriate APIs)."

Olaf
 >> Stay informed about: Full Control to Users programmatically 
Back to top
Login to vote
Eric

External


Since: Feb 13, 2007
Posts: 1



(Msg. 20) Posted: Tue Feb 13, 2007 8:39 am
Post subject: Re: Full Control to Users programmatically [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
"Steve" wrote in message


According to the post I quoted, putting data in the Allusers AppData
will not really work...Any user other than the owner of the data file
still does not have write privileges to that data file (although they
do presumably have read access).

Steve

I'd have to test that to be sure, I haven't tried it, but the owner could
modify permissions..
 >> Stay informed about: Full Control to Users programmatically 
Back to top
Login to vote
Øyvind_Sørbye

External


Since: Feb 17, 2007
Posts: 1



(Msg. 21) Posted: Sat Feb 17, 2007 8:52 pm
Post subject: Re: Full Control to Users programmatically [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
vovan wrote:
> Most programs (at least before Vista) use this design.

No, they don't. This is bad design.
 >> Stay informed about: Full Control to Users programmatically 
Back to top
Login to vote
bp

External


Since: Feb 24, 2007
Posts: 76



(Msg. 22) Posted: Sat Feb 24, 2007 7:36 am
Post subject: Re: Full Control to Users programmatically [Login to view extended thread Info.]
Archived from groups: microsoft>public>vb>general>discussion, others (more info?)
"mayayana" wrote:

>
> > I found some way (using Windows script) to give Users full control on
> > "C:\Program Files\My Program", not on entire "C:\Program Files\". Just on
> my
> > folder.
> > It looks like adjustment will take much less time than full redesign.
> > What is wrong with this approach?
>
> That sounds like a good idea to me.
> How do you achieve that?
>
> (My best idea for a solution so far is a note saying
> something like: "If you have the misfortune to be using
> Windows Vista, and you want to use this software,
> then you will need to give yourself permission to
> fully use your PC." Smile
>
Or you could say this:
I'm to lazy to code this correctly so I am trying to hack it and in the
process I will destroy your windows security. Sorry.
>
>
 >> Stay informed about: Full Control to Users programmatically 
Back to top
Login to vote
Ann

External


Since: May 25, 2007
Posts: 10



(Msg. 23) Posted: Fri May 25, 2007 8:31 am
Post subject: RE: Full Control to Users programmatically [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
I have a question that may relate to the current discussion....

I am currently using my husbands computer because mine is on its' last legs.
I have created a new user account for myself, but am unable to print any
documents. It seems my only choice is to save each document as a "XPS" file
on the hard drive, but I am still not able to print them.

I can print when I am on my husband's desk top I imagine because he is the
administrator. I know there is a relatively simple solution for this, but
being technically challenged, I, so far, haven't been able to figure it out!

Any help would be much appreciated!

--
Ann


"vovan" wrote:

> My VB6 program is installed by setup created in InstallShield 12.
> Before Vista everything was working fine.
> On Vista one of the operations (replace file located in c:\program files\my
> program with another file) fails - my research showed me than there is an
> error 70, 'Access denied'
> After I set manually Full Control to Users of that machine everything works
> fine.
> Any advice how to set Full Control to Users programmatically from VB6 or
> from InstallShield project.
>
> Thank you
> Vovan
>
>
>
 >> Stay informed about: Full Control to Users programmatically 
Back to top
Login to vote
koze

External


Since: Dec 18, 2006
Posts: 145



(Msg. 24) Posted: Fri May 25, 2007 5:44 pm
Post subject: Re: Full Control to Users programmatically [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
It could be he has the printer installed for this user onl, in that case you
have to reinstall the printer for use with your account.

Else it would have worked!

Ko.

"Ann" schreef in bericht

>I have a question that may relate to the current discussion....
>
> I am currently using my husbands computer because mine is on its' last
> legs.
> I have created a new user account for myself, but am unable to print any
> documents. It seems my only choice is to save each document as a "XPS"
> file
> on the hard drive, but I am still not able to print them.
>
> I can print when I am on my husband's desk top I imagine because he is the
> administrator. I know there is a relatively simple solution for this, but
> being technically challenged, I, so far, haven't been able to figure it
> out!
>
> Any help would be much appreciated!
>
> --
> Ann
>
>
> "vovan" wrote:
>
>> My VB6 program is installed by setup created in InstallShield 12.
>> Before Vista everything was working fine.
>> On Vista one of the operations (replace file located in c:\program
>> files\my
>> program with another file) fails - my research showed me than there is an
>> error 70, 'Access denied'
>> After I set manually Full Control to Users of that machine everything
>> works
>> fine.
>> Any advice how to set Full Control to Users programmatically from VB6 or
>> from InstallShield project.
>>
>> Thank you
>> Vovan
>>
>>
>>
 >> Stay informed about: Full Control to Users programmatically 
Back to top
Login to vote
Mike Williams

External


Since: May 25, 2007
Posts: 2



(Msg. 25) Posted: Fri May 25, 2007 8:54 pm
Post subject: Re: Full Control to Users programmatically [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
"Ann" wrote in message


> I am currently using my husbands computer because mine is on
> its' last legs. I have created a new user account for myself, but
> am unable to print any documents.

Just get your husband (or yourself) to reinstall the printer for all users.
You may have to uninstall it first.

Mike
 >> Stay informed about: Full Control to Users programmatically 
Back to top
Login to vote
Arteekay

External


Since: May 26, 2007
Posts: 1



(Msg. 26) Posted: Sat May 26, 2007 5:46 am
Post subject: Re: Full Control to Users programmatically [Login to view extended thread Info.]
Archived from groups: microsoft>public>windows>vista>administration_accounts_passwords (more info?)
It's more likely that the default user profile has the xps document
writer set as the default printer. Ann might just need to discover the
printer selection drop box and how to set a default printer.

Her husband's default was probably changed when he installed the
driver, but it's doubtful it's installer was smart enough to set the
default user profile's default printer.


--
Arteekay

rtk
 >> Stay informed about: Full Control to Users programmatically 
Back to top
Login to vote
dmex

External


Since: May 26, 2007
Posts: 1



(Msg. 27) Posted: Sat May 26, 2007 11:44 pm
Post subject: Re: Administrative Headaches [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
riskman, create a new admin user and see if the new user will allow you
to add a printer or other things.

Arteekay, My reasons (rant) why UAC is not needed... Administrators do
not need UAC because most privileged server fuctions get denied access
to windows services they require also most administrators are smart
enough not to run any program likely to cause infestations or undesired
actions on there computer (IE7/IE6/outlook to name a few) IE in
inherently flawed because of its complete intergration with windows and
protected mode was designed to provide a shield between fuctions, UAC
detects calls made to services and asks the user if the process should
or shouldnt be asking for that privilege, it doesnt stop a thing if you
clicked accept.. brandons blog was talking about the protected mode
stoping a program from running so if most others used another web
browser UAC is not required because its only fuction is to ask you if it
should or shouldnt be asking for it.
It will definalty not help stop anything soon when malicious programs
are modified to disable it and other windows protections though the
registry, its a easy process.


--
dmex
 >> Stay informed about: Full Control to Users programmatically 
Back to top
Login to vote
bkrajendra

External


Since: Feb 20, 2010
Posts: 1



(Msg. 28) Posted: Sat Feb 20, 2010 5:25 am
Post subject: Re: Full Control to Users programmatically [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
I think there is an alternate solution to all these problems....
Make an two level application.
1) Launcher which will launch another Main App using code such as (VB)

Code:
--------------------


Call ShellExecute(hwnd, "runas", App.Path & "\MainApp.exe", 0, 0, vbNormalFocus)


--------------------


2) Main App, which is writing to protected areas, ie Program Files
folder

I've successfully tried this with windows 7 :rolleyes:

I'm also developing an app which has online update feature. But it
doesn't work in Vista/W7..

I agree with other peoples about Microsoft Policies and Standard
Practices. Cool

But my Question is :confused:
1) How to apply update to an existing application, which probably
always remain in Program Files folder.
2) There might be some way to do this, otherwise how goolge updater,
antivirus updater or any software updater workes?

I need answer to my questions..... Surprised

Prof. Rajendra Khope
(MIT, Pune, India)


--
bkrajendra
Posted via http://www.vistaheads.com
 >> Stay informed about: Full Control to Users programmatically 
Back to top
Login to vote
Display posts from previous:   
Related Topics:
How get Full Access Control Files for Pemissions files? - I have software use video files open but problem try click allow but look too manys stuck try to I need all allow files! Some I clicking open files but say: Open file --------------------- Tri. (!) Yellow "Files title" You don't have permissi...

Full Administrator Access -

Full administrative access - I am the only user on my new Dell PC and as such I am an administratror. I have turned off UAC but still seem to get asked for administrative permission when installing programmes. The latest one is a Driving Test disk and it says I don't have full..

old xp users - since upgrading to vista from xp, I have noticed that there are lots of old xp accounts still on the disk....which ones can I remove? Directory of C:\Users 12/11/2006 11:34 AM <DIR> . 12/11/2006 11:34 AM <DIR> ....

Changing the way users log on and off - In Windows XP there were two options for the way users logged on and off. One was the welcome screen and the other was the password box/form. When I install Vista, the default is the welcome screen. How do I change it to the log in box? Thanks.
   MS Vista Forums (Home) -> Account Administration All times are: Pacific Time (US & Canada)
Goto page Previous  1, 2
Page 2 of 2

 
 You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum



[ Contact us | Terms of Service/Privacy Policy ]