We have some older Windows 11 applications that ask for admin rights or don't work properly without them. The PCs are on an Active Directory network, and users need to run the apps without getting unrestricted local admin access. What's the best way to handle this?
Can I let users run one program as admin without making them admins?
Asked by
_gently+unindexed_3
Answers
First, find out what the app actually needs. Some older programs try to write to their installation folder under Program Files or to registry keys under HKLM. Sysinternals Process Monitor can help you spot access failures when the app runs as a standard user.
If you find a specific file, folder, or registry key causing the problem, grant only the necessary permissions there and retest. Be careful about making executable files or their folders writable, because that can create a security problem of its own. The app may also need access to a database or another service, not Windows administrator rights.
Reply to this answer
If it really does need elevation, look at an endpoint privilege management tool. Intune Endpoint Privilege Management is one option, and there are other products that can approve specific applications without making the user a permanent local admin.
There is setup and licensing to consider. Check how the tool identifies the approved executable and what controls it has around elevated processes. An unrestricted elevated app can still be a route to broader admin access if users can make it run other code or alter what it loads.
Reply to this answer
Don't mistake RunAsInvoker for an elevation method. It can suppress the elevation request and start the app with the user's existing permissions. That may be enough if the app asks for admin unnecessarily, but it won't grant missing admin rights.
A compatibility shim is worth testing for an older app, though it won't magically provide permissions the program genuinely needs.
Reply to this answer
A scheduled task running under an admin account is sometimes suggested, but be cautious. An interactive app may start in the admin account's context without appearing on the user's screen. Also, if the user can alter the program or influence what the elevated task runs, the task can become a way to gain broader privileges.
I wouldn't put saved admin credentials in a batch file either. It creates another credential and launch path to protect.
Reply to this answer
For software that genuinely needs broad privileges and can't be replaced yet, consider isolating it on a separate machine or virtual environment with limited network access. That won't fix the app, but it can reduce what a compromise can reach. You'll still need to check that users can access the app and any services it depends on.
Reply to this answer
Add your answer
Answers are reviewed before publication.
q.5!brackenjar:
Check the app's normal workflow after changing permissions, not just whether it opens. A missing login prompt or configuration can be a clue that it still can't reach something.