Channel 9 Forums - Coffeehouse - Do you login as admin?

Coffeehouse - Do you login as admin?

BanjoFrog — Wed, 07 Apr 2004 05:13:37 GMT

Just curious. Maybe this should be a poll, but I'd like to how know many people out there actually run as a non-admin user and can successfully do your daily busines with Windows XP.

Coffeehouse - Do you login as admin?

tiernan — Wed, 07 Apr 2004 05:18:07 GMT

the user i login to my workstation at both home and work is the admin of the machine. not necessarrally named Administrator, but still an admin, none the less. i dont see why not either. certin things on my machine, as most people know, cannot be done without admin rights. so, to work properly, i need admin access.

Coffeehouse - Do you login as admin?

undead — Wed, 07 Apr 2004 05:18:10 GMT

I know Mike (Howard) will probably die a painfull death when realizing that people out there running XP are pretty much a sad case of (and i quote)
"everyone is an admin !!"

the problem is Windows does not ship "Secure by Default" .. they've done a better jobon WinXP.. kinda.. but its still pretty open.. I know of VERY few companies that actually only allow normal users on their own desktops..

sad.. but true.. I myself run as admin.. ships that way, works that way, so I Keep it that way ! (Yes another lame excuse of "but stuff breaks when I'm not an admin")

sorry Mike.. its an ongoing battle !

Coffeehouse - Do you login as admin?

bshankle — Wed, 07 Apr 2004 06:16:55 GMT

As a developer you have to run as admin on the local machine....how else are you gonna edit the registry and install the latest security patches and drivers?

Not to mention create software that works on your computer, but has security exceptions when any of your 'users' run it

Coffeehouse - Do you login as admin?

CGuy — Wed, 07 Apr 2004 06:36:09 GMT

Hello

I'd first like to say that I think Channel9 is a great idea and I'm excited about seeing how it evolves over the next year or so.

Do I run as admin on my computer? No, I don't. I have WindowsXP Pro and I have two user accounts: an admin account which I use sparingly, and a limited user account I use for day to day stuff. When I need to do something requiring admin rights, I simply open an IE instance with my admin account using Run As...

Using Run As... seems to suit all my needs with maybe one or two rare exceptions. I can defrag, edit the registry, and configure security policies just to name a few.

Regards
Glenn Nitschke

Coffeehouse - Do you login as admin?

Michael Elsdoerfer — Wed, 07 Apr 2004 06:53:28 GMT

Well, I tried. I promise, I honestly tried, when I re-installed Windows a few month ago.

But since a few weeks I switched my limited account to an admin account again.

It's not so much the application, which will not run on a account with restricted access (you can use "run as" or give such an application additional rights), but it is two issues that really annoyed me:

* You cannot run the explorer using "run as". Anybody managed to do that?

* You cannot use fast user switching when the welcome login screen is disabled.

Coffeehouse - Do you login as admin?

Mike Sampson — Wed, 07 Apr 2004 07:10:28 GMT

While I too run as admin on my machines at work and home, the VS team does put a lot of work into making sure that you can use our product as a normal user on the machine. I've seen many a bug about issues from arising from running with a less than admin account (worked on one today in fact).

Most dev's like to be admins on their machines anyway to run things like gacutil, regsrv32, etc. but we do try to make it possible!

Coffeehouse - Do you login as admin?

PeterV — Wed, 07 Apr 2004 08:54:04 GMT

At work I'll change my user profile when needed. In times when I don't need much admin rights, I'll go down to Power User. But at the moment I'm running admin cause I need to test some new tools and play around with some services.
At home I'm just a user and it works out great for me ... but I share that computer with my girlfriend and she keeps nagging about the freedom she had in Win98/Me. She sometimes gets mad about it and thinks I don't trust her.

Coffeehouse - Do you login as admin?

CumpsD — Wed, 07 Apr 2004 09:07:45 GMT

Michael Elsdoerfer wrote:

* You cannot run the explorer using "run as". Anybody managed to do that?

You can do this by running IE with RunAs and then go to your local hard drive and switch to 'Folders' view.

I usualy open up a "cmd" with Runas, and execute IE in there.

Coffeehouse - Do you login as admin?

peteri — Wed, 07 Apr 2004 10:20:59 GMT

Nope, but I know I should. I may give it a go at home when I nuke'n'pave my laptop next time.

Coffeehouse - Do you login as admin?

Cronan — Wed, 07 Apr 2004 10:38:14 GMT

Too many workarounds required when using VS.Net as a non-Admin, esp. related to interop. I run as Admin all the time.

Coffeehouse - Do you login as admin?

Peter — Wed, 07 Apr 2004 11:56:58 GMT

"You cannot run the explorer using "run as". Anybody managed to do that?"

From Peter Torr's blog ( http://weblogs.asp.net/ptorr/archive/2004/03/21/93352.aspx )

"you can run Windows Explorer (and the related control panel applets) from your Admin account as long as you've set the "Run Explorer windows in a separate process" option from the admin account. Run regedit from your Admin console, navigate to:

HKEY_CURRENT_USER\ Software\ Microsoft\ Windows\ CurrentVersion\ Explorer\ Advanced

and set the SeparateProcess DWORD to 0x01."

Coffeehouse - Do you login as admin?

gmiley — Wed, 07 Apr 2004 12:08:38 GMT

I work for county gov and we have a well implemented network, everyone logs on as a user, even the network admins and yes even us (the programmers). As long as you have someone that knows how to manage MS networks you should never have to log in as an administrator. That being said, some groups have certain admin rights on their workstations.

At home, I rarely have a need to log in as admin. I have a stable network of several different operating systems including a Palm IIIc as well as a linux based handheld. The home network offers me wireless as well as cat5 connections giving my complete roaming freedom.

So... no, I don't run as admin unless I need to do admin things. =)

Coffeehouse - Do you login as admin?

muad — Wed, 07 Apr 2004 12:21:42 GMT

I work for an ISP and we run our workstations as Admin, although if I use TS from home, my login is on the AD and im not in the admin group, yet i have very few problems with VS.

I think in general though there's that many things that need admin privs, that's it's hard not to run as admin.

Coffeehouse - Do you login as admin?

XSiVE — Wed, 07 Apr 2004 13:13:47 GMT

gmiley wrote:

As long as you have someone that knows how to manage MS networks you should never have to log in as an administrator.

That's the problem right there. Most companies dont have people that are actually certified ( or have even read a book) on domain / AD adminstration and the users are the ones who end up suffering.

I always add my domain account to the local admin group as soon as I get a new pc. It's the only way I can actually get around the badly designed domain policies and get my work done.

Coffeehouse - Do you login as admin?

sir_flexalot — Wed, 07 Apr 2004 13:25:50 GMT

Ironically, for many of us we can't do our jobs as non-admin, because admin functions of various kinds are required throughout the day (i.e. installing programs, compiling stuff, dropping temp tables, etc.) I think you are asking the wrong group of people. There are a fair number of "regular users", one example group is (ironically) called "administrative assistants", who don't really need those other functions and are usually logged in as "non-admin" users. That has been the case at most of the br/click and mortar businesses I have seen. Software companies are not that way, though.

Coffeehouse - Do you login as admin?

harumscarum — Wed, 07 Apr 2004 13:26:45 GMT

Isn't Admin the only way to run? I am unaware of this domain account you speak of.

Coffeehouse - Do you login as admin?

Michael Elsdoerfer — Wed, 07 Apr 2004 13:29:04 GMT

* You cannot run the explorer using "run as". Anybody managed to do that?

CumpsD and Peter: Thanks for the tips. Works now for me too..

Coffeehouse - Do you login as admin?

WetGoat — Wed, 07 Apr 2004 13:48:36 GMT

Security best practise would suggest you should not use an account with admin rights for day to day work. This would apply to home machines as well as business.

As for business networks then software installation should be done via GP, SMS or such like and use elevated installation rights. An end user should not be installing software on a company network anyway.

If an end user requires "certain" right's then they should be delegated in active directory for that user or group. No user, including administrators should be using accounts with full admin rights. Full admin accounts should only be used when required for that purpose.

I remember reading in FYI mag a while back about some gent being so pleased that his account was a member of the schema admins. He was told he should only be in that group whilst performing the task required (I think he was domain preping for exchange or something).

Thats my $0.05

Coffeehouse - Do you login as admin?

Barnaby James — Wed, 07 Apr 2004 14:03:17 GMT

I do (but I'm a developer). I would guess it's going to become more common for users to run this way after XP SP2 since you can't open the firewall ports without being an Admin.

Coffeehouse - Do you login as admin?

darklotus — Wed, 07 Apr 2004 14:14:23 GMT

Begin a developer you dont really have a choice not to run as admin. You would spend most of your time logging in as admin, fixing things and then logging back in as a user. Since windows doesnt have the SU commands like any *nix OS's, your kinda stuck running as an admin, at least when developing software.

Coffeehouse - Do you login as admin?

vanlandw — Wed, 07 Apr 2004 14:20:19 GMT

at work our accounts are non administrator...at home since nobody has access to my terminals i run as admin. I know it's a security issue...but when I'm at home I don't wanna deal with user switching and not having an -su option really makes it a hassel

Coffeehouse - Do you login as admin?

miamijjs — Wed, 07 Apr 2004 14:25:05 GMT

Hello,

I would love to be a admin. I use a Dell 9100 at work and on the road, A Media Center 2004 desktop at home (networked to 4 rooms).

I can do admin functions while on the road and at work so checking the board would not be a problem.

Coffeehouse - Do you login as admin?

BanjoFrog — Wed, 07 Apr 2004 15:03:04 GMT

Are your home terminals connected to the web? If you read e-mail on them, you might consider trying to run as non-Admin.

I'd love to hear more suggestions from people who run as admin as to what they think MS should change to make it easier to run as a "safe" user account.

Coffeehouse - Do you login as admin?

FrankCarr — Wed, 07 Apr 2004 17:28:57 GMT

I run admin at home for two main reasons. First, since I do VB6, Web, and .NET development on my main system here, I need to have that level of access. Secondly, many games I like won't run under a non-admin user (they were apparently designed for Win9x).

At work, I have local admin access for development purposes on my desktop. I have a custom 'power user' level access on the network and to our Citrix boxes. I have admin access on some servers since I'm also an admin some of our Intranet sites.

Coffeehouse - Do you login as admin?

dwoodard — Wed, 07 Apr 2004 22:01:21 GMT

I do not run as admin at home or at work. As a developer, I have been living Keith Brown's developer lifestyle for quite a while. I only switch to admin when I need to be an admin. I think this is very important for developers to do as it exposes security issues early in the dev cycle. I'm currently developing on Windows 2003 as a non-admin and have stumbled across a few issues that some of my admin-running collegues would have never found.

A previous poster said a well designed network will make this easier for you and that is true. Even here at Microsoft, some of our IT applications require administrative privileges to run (Try submitting your annual review without being an admin). The cool thing though is that when you bring it up to the IT staff they are very receptive to it and willing to try to resolve the issue.

My biggest issue with the non-admin thing is that you need to have a fairly high degree of technical sophistication in order to accomplish this. While the security enhancements for Windows XP SP2 are great for notifying the user about certain unsafe actions. A lot of the actions require you to be an administrator (installing ActiveX controls for example).

In my example of our annual review tool problem, I had to run Internet Explorer as an administrator then provide my network credentials to access the tool. That worked fine for me, but good thing my grandma wasn't trying to do the same thing!

The problem as I see it, is with conflicting agendas. We want people to be admins to perform admin tasks (install programs, update the registry etc.) but we don't want to require our users to be administrators to read their email. ClickOnce deployment should help somewhat in this area, but you still have the issue of deploying CAS policies. I would love to see Longhorn nail this issue down so that it is easier for users to not run as admin.

Coffeehouse - Do you login as admin?

sseveran — Wed, 07 Apr 2004 22:15:57 GMT

The following is a post from my blog. While it is not targetted at strictly developers the lesson is universal:

Last fall I got an email from the IT department at my school informing me that I was sharing files in an XDCC chatroom. I mailed them back and told them I wasn't and that I don't use XDCC. The sent me back a message with the server that I was connected to as well as the ports and other relevant information. I immeadiantly went to work to diagnose the problem. A virus scan turned up nothing as did adaware. I proceeded to download a copy of TCPview from Sysinternals. Sure enough there was copy of netsvc running on the port that the emailed me. As I dug into the issue I discovered a file called cfgmgmt.dll that had been added into system32. This did indeed turn out to be the culprit.

I wasted a day tracking down this issue. It wasted a huge amount of my time that I did not have to waste. The trojan had come with something that I had downloaded that was less than legit. Even so I wanted to make sure that it never happened again. Sometime before I had bookmarked an article to read later about developing applications as a non-administrator. After this incident I sat down and read it, and implemented everything that it said.

Why did I do that? The answer is simple, if my user had not been in the administrator group nothing would have happened. As a regular user you don't have permission to add files to system32 and settings to the registry. I would have saved alot of time that I spent trying to hunt it down. Many virii that exist require the user to be an administrator to be effective. If the user is not an administrator than there are insufficient privledges for the virus to do what it wants. Obviously this does not protect against virii that exploit a security flaw to gain elevated privledges so a virus scanner is still needed.

Is all this security a pain? I have not found it to be. You can easily run an application or an installer as an administrator through the runas option in the windows shell. There are plenty of guides out there on how to use your computer effectivly as a non-administrator. So I implore you, DON”T RUN AS AN ADMINISTRATOR.

And if you do? I never want to hear you cry about any companies security flaws, you are just as culpable as they are.

Coffeehouse - Do you login as admin?

object88 — Wed, 07 Apr 2004 22:22:57 GMT

I run as admin at work. I tried doing web development with ASP.NET as a power user, and frankly, it sucked. I had to "runas" far too many times.

That, and my Palm software / USB sync pretty much refused to work unless as Admin. It's "old" enough that it doesn't get along well with XP Pro.

Coffeehouse - Do you login as admin?

sseveran — Thu, 08 Apr 2004 03:13:28 GMT

Actually when I did some COM+ development I ran as admin just how VS could automatically unregister and reregister the component. But thats the only time.

Coffeehouse - Do you login as admin?

billy — Thu, 08 Apr 2004 07:20:01 GMT

No, I log in as Administrator... seriously though, at home I have my son's login as an admin with highly modified priveledges due to gaming issues. For myself at home, I use a Mac, and no. At work, I log in as a member of the Administrators group, so technically yes.

Coffeehouse - Do you login as admin?

orcmid — Fri, 09 Apr 2004 19:36:32 GMT

I had been to a couple of events where Developmentor guys would work as regular (power) users and do admin thingies via Run As ... on a command shell or some other application. I thought, wow, I have to upgrade to XP and be able to do that!

So I did. But I can't figure out why I don't get Run As ... options. I end up having to set the Run With Different Credentials on the Properties for programs, and then that makes me do too much work. First to set it up, secondly to go through the dialog that comes up every time I want to run that particular program. (Sometimes I don't want to run as Administrator). I will still go through all of that, because it is easier than switching to my admin account.

I like that kind of advice, I like keeping as much as possible locked-down and opening up only where necessary. I would like the system better if it made such safe habits easier and more natural.

Coffeehouse - Do you login as admin?

prog_dotnet — Tue, 13 Apr 2004 18:52:26 GMT

HOW TO: Enable and Use the "Run As" Command When Running Programs in Windows

http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q294676&

Coffeehouse - Do you login as admin?

eagle — Tue, 13 Apr 2004 20:13:33 GMT

No, not as a developer.

Coffeehouse - Do you login as admin?

warren — Tue, 13 Apr 2004 21:51:19 GMT

Doing development work as an Administrator is an excellent way to facilitate making mistakes in your programming that will prevent your application from working properly as a Standard User.

HOW TO DEVELOP AS A STANDARD USER:

- If you need write access to certain areas of the registry, grant yourself access to those areas using the 'Permissions' dialog in Regedit (you'll need to run Regedit as an administrator, of course, but that's easy)

- The same logic applies to the filesystem, but you really should try to avoid making changes to filesystem permissions.

- Keep track of the latest Windows Updates by using the Automatic Updates feature.

- Need to muddle with network configuration stuff? Add yourself to the 'Network Configuration Operators' group, which was introduced in XP. MSKB">http://support.microsoft.com/?kbid=297938">MSKB 297938 covers this subject.

- VS.NET facilitates non-administrator developing and debugging; there are user groups created on your machine when you install Visual Studio that you can add yourself to: "Debugger Users" and "VS Developers". You only need the latter if you are working on web projects.

- If you need write access to Windows system directories for your application to work, YOU ARE DOING SOMETHING WRONG. Windows Installer should be the only avenue by which you add, update or remove system components.

- Your entire application should be written with security considerations in mind; never assume that you have write access to any given location, and always provide useful error messages in the event that the user doesn't have access. Developing in a standard user context will force you to be aware of these issues.

- If your application needs to do things that a standard user doesn't have the capability of doing, then ensure that your application supports elevating priviledge (by way of a "user/password dialog") for those actions.

I'm sure others can add more to this list, but if you are a developer working with an admin account, try this out -- you may be surprised at how much will still work.

Coffeehouse - Do you login as admin?

Ich — Tue, 13 Apr 2004 22:18:50 GMT

I don't run as admin, except I call it "root".

Coffeehouse - Do you login as admin?

ZippyV — Tue, 13 Apr 2004 23:13:27 GMT

I run as an Admin at home.
Why? Because all my games need it.

The problem is that a lot of applications (or games) tend to put the configuration files in the same map as the executable in the program files folder.
When you run as a normal user, changing something in the program files folder is not allowed -> that's probably the main cause of all problems.

The recent games from EA: Simcity 4 and Command & Conquer: Generals are now using the My documents folder to store user only stuff in it, but those folders are getting to big in my opinion (186 MB) and you still need to login as an administrator.

Coffeehouse - Do you login as admin?

prog_dotnet — Wed, 14 Apr 2004 00:59:59 GMT

add the user to the power user group

Coffeehouse - Do you login as admin?

BanjoFrog — Wed, 14 Apr 2004 19:30:46 GMT

Call me crazy, but maybe it's time for folks to send feedback to games companies that they're part of the problem and their games don't run when logged in as non-admin. If they don't hear it from customers, they'll never care.