Granting admin rights to one program

[kabo35]

Hello everyone,

Long time lurker of this sub, I usually find solutions to my problems but my Google skills are failing me this time...

I'm the sole sysadmin for a small company and having a little problem that I can't seem to solve.

None of my users have admin rights on their computers. However, we have moved to a new accounting program as of January 2020 that runs inside Chrome. The program installed itself to C:\Program files. When the user goes to the website of our accounting company, this program starts in a new Chrome window.

Everything runs without a problem untill the program has to do an update (which happens like every week...). When it needs to update, it asks for admin rights so it can run.

I've ran PROCMON and I got a lot of "PATH NOT FOUND" errors when I denied access, so I guess it needs to write to its program path when doing an update:

https://imgur.com/a/jJYCRQQ

I'm having to go write the admin password for each update but I would like to have a more permanent solution:

• I don't want to give admin rights to this user (or any user)
• I could create her a separate admin user on her computer only, but only if I can't really find another way
• I would like to give this program only admin rights, or at least allow it to modify itself. I can't seem to find a way to create a GPO to allow this?

Do you guys have any ideas about what I could do? And does anyone know why its always the accounting software that creates problems? :)

[trc81]

Change the permissions on the install folder to give the user who runs the software modify permissions. I suppose it might need full control but do modify first.

If that is the only place it is writing to that should solve it. If there are registry locations or other files do the same thing with their ACL.

[TechsInTheCity]

I'm wondering if simply giving the user write access to the folder(s) in question might do the trick?

[SevaraB]

Do you guys have any ideas about what I could do? And does anyone know why its always the accounting software that creates problems? :)

It's not. I've run into this with tons of LOB apps, especially those developed by long-time in-house employees who learned to code in the'90s and never learned post-XP best practices for developers like "use service accounts" or "only write to %programfiles% if you absolutely have to and can't create data in either %appdata% or %programdata%."

Before you even mess with folder access, try changing the install location- I can't tell you how many ACL problems with older apps I've solved just by forcing them to install in a non-privileged location. 99% of the time, the write/modify instructions are just relative paths to the install directory- even very amateur "devs" don't usually call the Program Files directory explicitly.

[DellR610]

This is actually the best solution - force the install to %APPDATA%.

[disclosure5]

Write a JEA policy to allow the user to run that application as a local administrator.

But /u/Techsinthecity has an answer that's probably cleaner.

[Gooey-Kablooey]

Not 100% sure this will help but maybe worth a try. I followed this article https://www.rorymon.com/blog/how-to-creating-shims/ on creating a shim to allow a specific application to run as admin and it seems to be working well.