Unoffical empeg BBS

Quick Links: Empeg FAQ | RioCar.Org | Hijack | BigDisk Builder | jEmplode | emphatic
Repairs: Repairs

Topic Options
#353747 - 03/08/2012 21:47 Group policy question
Dignan
carpal tunnel

Registered: 08/03/2000
Posts: 12338
Loc: Sterling, VA
So I work for a small (4 person) law firm with a server/domain/active directory setup, and the main lawyer at this firm is pretty concerned about about locking down the computers smile He really doesn't want his users installing ANY applications on their computers, so none of them have admin rights (he does, of course wink ).

But there's a little problem. He had me install a program called Timeslips today, and apparently this program requires that the user have admin access to the local machine. I'm not sure why this is the case, but that's what they're saying.

I logged into the machines as the network admin and gave them local admin rights for now, promising this attorney that I'd try to find a workaround.

So that's where I am smile Is there another way to do this that might get around this requirement from the software? Do you think this software actually requires admin rights?

*edit*

ps- sorry, I just realized after posting this that it doesn't really have anything to do with group policies smile


Edited by Dignan (03/08/2012 21:48)
_________________________
Matt

Top
#353750 - 03/08/2012 23:35 Re: Group policy question [Re: Dignan]
gbeer
carpal tunnel

Registered: 17/12/2000
Posts: 2665
Loc: Manteca, California
Seems strange that something named timeslips would need admin rights.

I have local admin on my work pc. But recently, the company deemed it necessary to add a bit of nannyware which inhibits all access to anything deemed off limits to a local admin. The impression I was given is that it was highly configurable. The one thing I know it made off limits, was reg edits. They talked about making things like adding networked printers off limits. They seem to have found a balance that works.

Monday I'll check to see what that package was.
_________________________
Glenn

Top
#353762 - 04/08/2012 05:30 Re: Group policy question [Re: Dignan]
Roger
carpal tunnel

Registered: 18/01/2000
Posts: 5683
Loc: London, UK
Quote:
Do you think this software actually requires admin rights?


No. I'd say to uninstall it and find something else. However, you might be able to use a compatibility shim to lie to it.
_________________________
-- roger

Top
#353766 - 04/08/2012 13:12 Re: Group policy question [Re: Roger]
Dignan
carpal tunnel

Registered: 08/03/2000
Posts: 12338
Loc: Sterling, VA
Originally Posted By: gbeer
Seems strange that something named timeslips would need admin rights.

It might sound like a punch-card system, but it's actually for tracking billable hours and using the results for billing. It's a very common thing in law firms, but these vertical applications can be annoying sometimes and not have the best support.

Quote:
Monday I'll check to see what that package was.

Thanks, I'd be interested.

Originally Posted By: Roger
Quote:
Do you think this software actually requires admin rights?

No. I'd say to uninstall it and find something else.

Unfortunately, this is probably one of the biggest names in this type of software (from what I've seen), so anything else is kind of a step down.

I suppose I could always remove the admin rights and just see what happens!
_________________________
Matt

Top
#353771 - 04/08/2012 14:54 Re: Group policy question [Re: Dignan]
BartDG
carpal tunnel

Registered: 20/05/2001
Posts: 2616
Loc: Bruges, Belgium
Couldn't you just contact the creators of Timeslips and ask them if it's absolutely necessary to run the program with admin rights? If you explain them situation like you have here, I'm sure they'll respond. Maybe even with a workaround.
_________________________
Riocar 80gig S/N : 010101580 red
Riocar 80gig (010102106) - backup

Top
#353772 - 04/08/2012 18:28 Re: Group policy question [Re: BartDG]
Dignan
carpal tunnel

Registered: 08/03/2000
Posts: 12338
Loc: Sterling, VA
Originally Posted By: Archeon
Couldn't you just contact the creators of Timeslips and ask them if it's absolutely necessary to run the program with admin rights? If you explain them situation like you have here, I'm sure they'll respond. Maybe even with a workaround.

They claim it's absolutely necessary...
_________________________
Matt

Top
#353773 - 04/08/2012 18:34 Re: Group policy question [Re: Dignan]
wfaulk
carpal tunnel

Registered: 25/12/2000
Posts: 16706
Loc: Raleigh, NC US
There are some claims on their forums that all it really needs is write access to the registry (probably just a specific part of the registry) and write access to the installed application's directory. Worth trying.

You might also try using a utility like Process Monitor to see if you can match the program's failure with the failure of a specific type of access, and then resolving that access problem.

Also, you might see if a sandboxing program (like Sandboxie or Cameyo) will allow the program to function thinking that it has admin rights when it really doesn't.


Edited by wfaulk (04/08/2012 18:46)
_________________________
Bitt Faulk

Top
#353804 - 06/08/2012 12:56 Re: Group policy question [Re: Dignan]
gbeer
carpal tunnel

Registered: 17/12/2000
Posts: 2665
Loc: Manteca, California
Quote:
Quote:
Monday I'll check to see what that package was.

Thanks, I'd be interested.


Beyond Trust
_________________________
Glenn

Top
#353807 - 06/08/2012 15:01 Re: Group policy question [Re: gbeer]
rubennyc
member

Registered: 27/01/2006
Posts: 142
Loc: New Jersey, USA
Don't know if this is the same version, but this doc says users only need change rights to the install folder.

http://www.sagetimeslips.com/~/media/Cat...S2012Readme.pdf (see p.2)

Quote:
Preparing to Install Timeslips
Verifying access rights

In order to install and use Timeslips, all network users must have Change file rights (Read, Write, Execute, and Delete) for the installation folder.

Before installing Timeslips, you must log into Windows with administrator rights to install Timeslips. The Setup program will change Windows access rights to the installation folder for Users group to Full Control.


Edit: The security event log might help identify if there's a security privilege the app is trying to use, e.g. does it require permissions to load/unload device drivers or backup files, etc.?


Edited by rubennyc (06/08/2012 15:11)

Top
#353823 - 06/08/2012 20:25 Re: Group policy question [Re: rubennyc]
Dignan
carpal tunnel

Registered: 08/03/2000
Posts: 12338
Loc: Sterling, VA
Hmm, that's very interesting. I already have it installed on the computers it needs to be on.

I believe one thing I read/heard was that it needs privileges to connect to Outlook or Quickbooks for integration. But at least two of these installs don't need that capability (or so I think, I might be wrong).
_________________________
Matt

Top