The LUA approach:
running under least-privilege
Return to IT/SA Services Documentation: Active Directory

Resources:

for Windows XP...

• Aaron Margosis' Non-Admin Weblog
• Johnathan Hardwick's nonadmin wiki
• Browsing the Web and Reading E-mail Safely as an Administrator
• LUA whitepaper on the principle of least privilege
• Applying the Principle of Least Privilege to User Accounts on Windows XP
• The Administrator Accounts Security Planning Guide
• Proof the LUA makes you safer
• Superior SU
• IFAS Co-Managed Delegation explanation
• Install an .msi with "run as" option (with thanks to Mitch Tulloch):
  1. Open Registry Editor as administrator (via "runas /user:ufad\if-adml-xxxx regedit" in the run box is one method).
  2. under HKCR\Msi.Package\shell, create the following key: HKCR\Msi.Package\shell\runas.
  3. Set the default value of this key to the following: Install &as...
  4. Create the following subkey: HKCR\Msi.Package\shell\runas\command.
  5. Set the default value of this subkey to the following: msiexec /i "%1".
  6. You should now be able to right-click on a .msi file and select Install As from the shortcut menu.
• The TqcRunas utility makes the RunAs command scriptable.
• Sudo for Windows (sudowin) "allows authorized users to launch processes with elevated privileges using their own passphrase. Unlike the runas command, Sudo for Windows preserves the user's profile and ownership of created objects."
• suDown "not quite as configurable as SudoWin, but is simpler to use and doesn't require .NET"
• The Principles of Least Privilege

for Vista...

• Windows Vista User Account Controls
• Developer Best Practices and Guidelines for Applications in a Least Privileged Environment
• Script Elevation PowerToys for Windows Vista

Running as Administrator, but with lowered privileges on specific applications:

• Running as Limited User - the Easy Way - using Process Explorer and PsExec to launch limited-user processes. Backwards from the preferred method, but interesting none the less.
• Microsoft's DropMyRights - WinXP Pro only
• Microsoft's SetSAFER - this also works with WinXP Home provided the .NET framework is installed.
• StripMyRights - more features than DropMyRights, such as command-line parameters.
• AMUST 1-Defender 2.0 - best bet and easiest to use for straight Microsoft setup of Explorer/Outlook/Messenger.