Posted By: raptor3676 | Jul 7th @ 9:19 AM
page 1 of 1
Comments: 13 | Views: 897

Hi,

On one of the servers I manage there are several application running. They have to run in a session (they are not services) and since they are the worst legacy apps I have ever seen, they need administrator rigths, because they have several .ini files scattered in both program files and windows folders (ouch).

I want to prevent the several operators checking the health of those apps, from login to the console (with the /console or /admin) switches.  Is ther a way to prevent that to an account that is a member of the administrator group?

Its a Windows 2003 Standar server.

Thanx in advance

PS: I want to restrict the use of the console for that account because otherwise I cannot ensure that it has a single session per user.

section31
section31
OutOfCoffeeException

During my time at Siemens I did alot of software repackaging. I saw alot of bad application requiring admin rights but due to the company police it wasn't allowed to run desktops as admin. So what we always did was to set just the user rights to the resources needed by the application. So Regmon/Filemon and few hours of try and error is what you need to get the app running with user rights. With this strategy we got almost every app running in a NT4 environment.

 

figuerres
figuerres
???

you may want to look into using Terminal Server - do the apps have to run 24x7 or just on demand?

Terminal Server is part of windows server and can run an appand connect the user to the app so that they have no access to anything you do not want them to have, by use of policy you can remove the start menu, run command and other things.

also the terminal service login can make the app the only thing they can use.

so even if the app has to have some admin privleges you can make the user only have the app and not the whole server.

you may also be able to create a session-connection so that the app is running and they just go back to it if it has to be running when no users are on.

"PS: I want to restrict the use of the console for that account because otherwise I cannot ensure that it has a single session per user."

There is a Group Policy setting which forces a single session per user. That's also the default behaviour of Windows Server 2008.

staceyw
staceyw
Before C# there was darkness...

not sure if something like application virtualization would fit here:

http://www.microsoft.com/systemcenter/appv/default.mspx

figuerres
figuerres
???

I see ... you have a legacy POC (Pice Of Crap)  to try and manage... and it was not designed to run on a "server" environment... sucks.

so really 1 instance has to run 7x24 no matter who is on the box *BUT* you need a few users to be able to access that app w/o giving that user Admin rights to the server ... is that right?

i am wondering if there is some way to run it in a Virtual Box but capture the screen and keyboard I/O and then write a service around that to then allow you to make it into a proper service that you can attach clients to... a really ugly hack around but might just do what you need to do and give you better ways to deal with it.

 

figuerres
figuerres
???

SO I guess here is the "$64,000.00" question: is there any way to screen-scrape a windows app?

we can do things like SendKeys to pipe input into the app but then what about the display?

OR write a custom RDP client app, grab the app window and the child windows and dialogs and show only them in an RDP session.

then you can pipe mouse and keyboard into the app when needed. or make it a Read-Only screen for some uses...

not simple but could be done.

i wonder if there are any screen scrapers that work on windows apps? I know there are some tools that take like vt-100 screens and read the text but this is windows / graphics here...

I'm confused. Do you only want 1 single copy to possibly run, or only 1 per user that might be trying to run it?

Either way, it can probaly solved most easily with a stub checking whether or not you are running in Session 0 before launching the app. If you only want 1 possible copy, insist that it runs in Session 0 (i.e. via /admin or /console). Otherwise a combination of the GP setting and a refusal to run in Session 0 would do it. It's a dirty hack but it'll sort of work.

The alternative is one big global mutex, or a global mutex which partially incorporates the user name if you only want one copy to launch per user.

Or you could, you know, just tell users not to launch it from within a /console session 'cos it breaks stuff. Us ops guys are kinda used to rubbish software apps that don't behave 100% as they should.

page 1 of 1
Comments: 13 | Views: 897
Microsoft Communities