4 ms·

Yep. It's worse when working with vendors, and even worse when working with vendors in a Windows-centric environment. "Our application needs to run as domain a

by hug 5y ago

Yep. It's worse when working with vendors, and even worse when working with vendors in a Windows-centric environment. "Our application needs to run as domain admin". No, mate, it absolutely does not. "Well it definitely needs local admin". No, mate, it doesn't even need that. What it usually needs is write-access to a single folder or regkey somewhere that has default ACLs on it that only allow local admins, but trying to have that conversation is a waste of time. Of course as soon as you say something like that, all support bets are off. Depending on the business you're working for you either suck it up so you have a 'support agreement' in place, or you do it properly and never talk to the vendor again. (Or option #3, you rebuild the app in its default "holy shit this is how my business gets owned" mode, place a support call, and have them fix that instance while you watch so you can replicate their efforts elsewhere.) Most of the same set of vendors get their panties in a twist when you tell them their database is on RDS, too, but that's a whole different argument to have with these people.

jasonjayr 5y ago
I've had to support an app that: 1) only ran in MSIE 2) required the domain policy to permit VBScript 3) required permission to launch + invoke local COM/applications 4) served over http:// http:// All just so they could direct MSWord to directly print the server-side generated Sales Order template. I audibly gasped and asked if they knew this put our systems at extreme risk, and the tech talking me through it basically shrugged "it's how it works" Thankfully that webapp 'upgraded' years ago so that's no longer how it's done, but when it's the only way to get orders into your business from one of your top 10 customers, you just setup a workstation to do it :(
nicoburns 5y ago
What is so great about this software that people put up with this kind of crap?
- _wldu 5y ago
  Probably non-technical managers making technical decisions. They run off or fire anyone who has a clue (seen as obstructionists). After that, it's to hell in a hand basket.
user5994461 5y ago
I honestly wonder who can use these applications these days? Large companies have stopped giving administrator access years ago. The vendor could corrupt their way into some middle manager all they want, they have zero power over procurement and IT, users won't get administrator access to use the app. If the app is really unusable, which it is, that must be preventing a whole lot of sales.
- hhh 5y ago
  Microsoft provides toolkits to help with this. I have spent easily 100+ hours churning through a catalogue of applications that 'need local admin' and have only found one case where it was true, and it was due to a bug that the latest software version fixed. It is almost always a false truth due to cost I feel. I primarily analyzed applications that were for PLCS and other industrial equipment. You can find more information about this here: https://docs.microsoft.com/en-us/windows/deployment/planning/compatibility-administrator-users-guide https://docs.microsoft.com/en-us/windows/deployment/planning... I run a VM that stays up to date with the latest Windows version that I install the toolkit on for testing. (side tangent, the user of this application insisted they had the latest version, and with it being behind some login that required some form related to ITAR or something to register, we just had to trust him until I had him download it 'just in case.')
  - rckoepke 5y ago
    Great timing. I'm looking for solutions to run Siemens Simatic PDM without being a local admin. Installing it with temporary admin rights seems to silently fail. I'm also trying to use libpcap and USBPcap without local admin. They request UAC every time I open Wireshark to start a new capture session. (Needed for debugging raw Ethernet and serial stacks) If you have any tips for either of these I am all ears!
    - corty 5y ago
      Use npcap and check the settings for the admin-not-required button (forgot the exact name). But generally, accessing raw anything needs elevated rights and should need elevated rights. For a normal user to be able to sniff network and usb traffic is usually a huge security hole and therefore correctly locked away. Not at all comparable to the other cases someone discussed above about some crappy app needing admin to write c:\windows\crappyapp.ico...
schlowmo 5y ago
> It's worse when working with vendors Well this works the other way around too. I found this especially true when delivering software which is considered an interim solution. More than once I got root privileges on customer machines or seen my software run as root because the project owner found it too cumbersome to deal with his own employers security regulations. Or just wasn't given the budget to deal with it properly. Sometimes it's easier to get an exception than to follow protocol. This is coming back to haunt you if something goes wrong or an interim solution wasn't so interim after all. If someone responsible for auditing permissions asks at this later stage it was always the vendors fault.
- anyfoo 5y ago
  Some software refuses to run as root. It's far from perfect, and usually easily circumventable, but it might push a lazy admin to at least create a user for your thing or similar.
  - franga2000 5y ago
    I hate that as a solution. I've had strange issues with software that I couldn't debug, but when I ran it as root in a test VM, it worked instantly. So I immediately knew it was a permission issue and started digging through the docs for a list of files it needed access to. I then fixed the permissions for it and ran it without root in production. If the software limited me to not running as root, I would have probably spent far longer debugging other issues and digging through 100s of lines of strace output.
    - mauvehaus 5y ago
      I think all software should come with the --räikkönen[0] --here-there-be-dragons --yes-i-mean-it set of switches to enable you to do boneheaded stuff when needed. And using them in prod should be grounds for dismissal, or at least pretty severe legal liability if things go wrong as a result. [0] https://m.youtube.com/watch?v=F3d_Cu5Mzbk https://m.youtube.com/watch?v=F3d_Cu5Mzbk
djrogers 5y ago
> Yep. It's worse when working with vendors 20 years in the vendor side, and I can count on one hand the number of times a customer followed the recommended process to create a limited user for one of our AD services. Every other time - just run it as an admin service account, and if they’re feeling motivated we might get a dedicated admin account created. It’s very frustrating…
- z3t4 5y ago
  Cant you just read the files needes then drop privileges ?
  - pjc50 5y ago
    I don't believe you can do that in Windows; your process is bound to the SID it started with.
    - Loranubi 5y ago
      There is `AdjustTokenPrivileges` and `CreateRestrictedToken` which can accomplish something like that.
deleted 5y ago
[deleted]
Ntrails 5y ago
I was responsible for an in house tool, it required local admin to write to the event log I think? I don't even think that was a useful feature, but I never explained why or removed it. Merely demonstrated that debugging crashed out without admin rights. I managed to have local admin on my box by default for as long as I worked there and it was great. Downloading and installing a new VS using my own msdn. Halycon days

by hug 5y ago

jasonjayr 5y ago

I've had to support an app that: 1) only ran in MSIE 2) required the domain policy to permit VBScript 3) required permission to launch + invoke local COM/applications 4) served over http:// http:// All just so they could direct MSWord to directly print the server-side generated Sales Order template. I audibly gasped and asked if they knew this put our systems at extreme risk, and the tech talking me through it basically shrugged "it's how it works" Thankfully that webapp 'upgraded' years ago so that's no longer how it's done, but when it's the only way to get orders into your business from one of your top 10 customers, you just setup a workstation to do it :(

nicoburns 5y ago

What is so great about this software that people put up with this kind of crap?

_wldu 5y ago
Probably non-technical managers making technical decisions. They run off or fire anyone who has a clue (seen as obstructionists). After that, it's to hell in a hand basket.

user5994461 5y ago

I honestly wonder who can use these applications these days? Large companies have stopped giving administrator access years ago. The vendor could corrupt their way into some middle manager all they want, they have zero power over procurement and IT, users won't get administrator access to use the app. If the app is really unusable, which it is, that must be preventing a whole lot of sales.

hhh 5y ago
Microsoft provides toolkits to help with this. I have spent easily 100+ hours churning through a catalogue of applications that 'need local admin' and have only found one case where it was true, and it was due to a bug that the latest software version fixed. It is almost always a false truth due to cost I feel. I primarily analyzed applications that were for PLCS and other industrial equipment. You can find more information about this here: https://docs.microsoft.com/en-us/windows/deployment/planning/compatibility-administrator-users-guide https://docs.microsoft.com/en-us/windows/deployment/planning... I run a VM that stays up to date with the latest Windows version that I install the toolkit on for testing. (side tangent, the user of this application insisted they had the latest version, and with it being behind some login that required some form related to ITAR or something to register, we just had to trust him until I had him download it 'just in case.')
- rckoepke 5y ago
  Great timing. I'm looking for solutions to run Siemens Simatic PDM without being a local admin. Installing it with temporary admin rights seems to silently fail. I'm also trying to use libpcap and USBPcap without local admin. They request UAC every time I open Wireshark to start a new capture session. (Needed for debugging raw Ethernet and serial stacks) If you have any tips for either of these I am all ears!
  - corty 5y ago
    Use npcap and check the settings for the admin-not-required button (forgot the exact name). But generally, accessing raw anything needs elevated rights and should need elevated rights. For a normal user to be able to sniff network and usb traffic is usually a huge security hole and therefore correctly locked away. Not at all comparable to the other cases someone discussed above about some crappy app needing admin to write c:\windows\crappyapp.ico...

schlowmo 5y ago

> It's worse when working with vendors Well this works the other way around too. I found this especially true when delivering software which is considered an interim solution. More than once I got root privileges on customer machines or seen my software run as root because the project owner found it too cumbersome to deal with his own employers security regulations. Or just wasn't given the budget to deal with it properly. Sometimes it's easier to get an exception than to follow protocol. This is coming back to haunt you if something goes wrong or an interim solution wasn't so interim after all. If someone responsible for auditing permissions asks at this later stage it was always the vendors fault.

anyfoo 5y ago
Some software refuses to run as root. It's far from perfect, and usually easily circumventable, but it might push a lazy admin to at least create a user for your thing or similar.
- franga2000 5y ago
  I hate that as a solution. I've had strange issues with software that I couldn't debug, but when I ran it as root in a test VM, it worked instantly. So I immediately knew it was a permission issue and started digging through the docs for a list of files it needed access to. I then fixed the permissions for it and ran it without root in production. If the software limited me to not running as root, I would have probably spent far longer debugging other issues and digging through 100s of lines of strace output.
  - mauvehaus 5y ago
    I think all software should come with the --räikkönen[0] --here-there-be-dragons --yes-i-mean-it set of switches to enable you to do boneheaded stuff when needed. And using them in prod should be grounds for dismissal, or at least pretty severe legal liability if things go wrong as a result. [0] https://m.youtube.com/watch?v=F3d_Cu5Mzbk https://m.youtube.com/watch?v=F3d_Cu5Mzbk

djrogers 5y ago

> Yep. It's worse when working with vendors 20 years in the vendor side, and I can count on one hand the number of times a customer followed the recommended process to create a limited user for one of our AD services. Every other time - just run it as an admin service account, and if they’re feeling motivated we might get a dedicated admin account created. It’s very frustrating…

z3t4 5y ago
Cant you just read the files needes then drop privileges ?
- pjc50 5y ago
  I don't believe you can do that in Windows; your process is bound to the SID it started with.
  - Loranubi 5y ago
    There is `AdjustTokenPrivileges` and `CreateRestrictedToken` which can accomplish something like that.

deleted 5y ago

[deleted]

Ntrails 5y ago

I was responsible for an in house tool, it required local admin to write to the event log I think? I don't even think that was a useful feature, but I never explained why or removed it. Merely demonstrated that debugging crashed out without admin rights. I managed to have local admin on my box by default for as long as I worked there and it was great. Downloading and installing a new VS using my own msdn. Halycon days