We're setting up a public gaming area where customers can play games through Steam. The games are installed ahead of time, but customers sign in with their own domain accounts and then use their personal Steam accounts. During testing, some games still request administrator elevation when they launch, possibly because of their anti-cheat components or first-run installers. What is the safest way to support these games without giving customers unrestricted local administrator access? I'm also concerned that a static Task Scheduler workaround would break whenever a game updates. What management, isolation, or reset strategy would work better?
5 Answers
Do not broadly bypass UAC with a compatibility-layer trick or give Steam, game launchers, or customers unrestricted administrator access. A RUNASINVOKER-style workaround does not grant the missing permissions and can leave the game unable to access protected files, registry settings, services, or anti-cheat components. Elevate only explicitly approved software, and confirm the design with your security team.
The overall design has serious security and operational risks. Customers signing into personal accounts on shared domain-connected computers could leave behind credentials or active sessions, and elevated game software could compromise the workstation or potentially provide a route toward internal systems. At minimum, use non-domain gaming stations or a separately managed environment, strictly isolate the network, reset the machines between users, and ensure the licensing arrangement is appropriate for a commercial venue.
Before building a custom workaround, check the vendor’s official PC-cafe program. Commercial gaming venues generally need the appropriate cafe or site licenses, and the supported client and licensing model may solve part of the account and deployment problem. It may not eliminate every UAC or anti-cheat requirement, but it should be handled before opening the service to customers.
Treat these as public-access machines, not ordinary domain workstations. Put them on an isolated network with no path to production systems, avoid using personal or corporate devices where possible, and restore each machine to a known-clean state after every session or reboot. Deep Freeze, Unified Write Filter, automated reimaging, or a similar rollback system can prevent one customer’s software, credentials, or malware from carrying over to the next person.
A university gaming or lab setup I’ve seen used a separate local environment, write protection, and an automatic restart on logout. It’s much safer than trying to make a permanent elevation exception for every game.
The safest approach is application privilege management rather than making users local administrators. Tools such as Admin By Request, AutoElevate, BeyondTrust, or similar products can allow specific approved executables to run elevated while keeping the user and machine otherwise restricted. The downside is that game updates and new titles may require ongoing policy changes, so this still needs maintenance.
Admin By Request is worth evaluating first; it can whitelist particular applications and may offer a small trial allocation, which would let you test whether it handles the anti-cheat components.
The cafe program requires the venue to obtain the proper game licenses, so customers’ personal accounts alone may not be sufficient.