Windows 7 Administrator Privliges

mikef73

Honorable
Oct 17, 2013
1
0
10,510
Are there any tools that a Systems admin can apply to windows 7, be it Third Party or other that can elevate a standard user to Admin status. within our tools we utilise USB to Serial adapters. using tools such as Putty with a Serial port requires knowledge of which port the USB-Serial has attached. This can be anything from 1 through to 30. To add complexity we do not have a standard USB-Serial as there are multiple end devices that have unique adaptors. Compmngt.msc requires administrative permissions to view.
As a company policy we have chosen to disable UAC.
The end users are also field engineers and when the elevated rights are required could be at a remote location that the service desk can not remote onto the machine.
We can give the engineer a second account with elevated rights, is the easy option, however this has the potential to allow malicious software/viruses in and potentially not be caught until too late.
Ideally an overlay that can be initiated that does not affect the base o/s, giving the end users the right to run app (that require admin rights) and change port setting when required.
Has anyone had the same issue, have you a solution. In my opinion cost should not be a factor over security, but bean counters say otherwise!
 

Skippy27

Distinguished
Nov 23, 2009
366
0
18,860
Just a thought, but at my work they created a service that runs and it gives things such as this the ability to run at a higher level by utilizing that already running service.

I can't tell you how they did it, im not a programmer, but I can tell you that if the service is not running we can't do several things we would do based on rights issues and admin elevation.
 

Eximo

Titan
Ambassador
I never like to hear that company has disabled UAC as a policy. That is more or less keeping with Windows XP behavior where everyone was practically an admin.

Our company developed a very simple menu that pulls information from device manager/registry to display all devices associated with a COM port so that our engineers could swap them around more easily for their various Express card, USB to Serial, and other devices. Changing the permissions on only those locations is much safer.

In my work, we use a lot of Microsoft Application Compatibility shims. In most cases you can have a domain user self elevate by typing in their login credentials using the Run as Invoker shim. Only the most privileged actions require elevation from an actual administrator (Run as Highest, which is what the run as administrator option in the compatibility tab does). And usually these are programs that did not follow Microsoft guidelines when they were coded.