Run programs as restricted users

[Brazen]

Is there some sort of program that can monitor what files and registry keys another program is trying to access?

I ask because we have some programs that will not run as a restricted user. We should be able to give users permissions to only a few registry keys and/or files and be able to run the program, but we don't know which keys and files need the permissions.

 

[SagaLore]

I'm not sure... if you come across one, please let me know because that would really come in handy. We want to do the same thing but there is so much inconsistency how different vendors write their software and what affect future updates on it would have, so we're still stuck with local admin privelages for the users. We even tried making them Power Users and that had problems.

mechBgon wrote up some instructions of what you could do:

Limited / Restricted-User accounts and non-cooperational software

 

[Brazen]

Hmmmm, looks like I've found something. Regmon and Filemon, both from SysInternals.

 

[SagaLore]

Originally posted by: Brazen
Hmmmm, looks like I've found something. Regmon and Filemon, both from SysInternals.

I think the Regmon is an all or nothing deal. You can filter based on wildcards but can't specify to monitor just one program that is making changes. Same with filemon.

What we really need is some kind of process walker. From the time you double-click the exe, to running it and then closing it - it would be nice to log all file and registry changes only pertaining to that application. And then it would be doubly nice if it also tracked all the permissions for those changes.

 

[Brazen]

Here's another program, also from sysinternals.

 

[Patt]

Regmon and Filemon are both extremely useful utilities ... we use them all the time at work to diagnose permissions issues.

 

[Brazen]

Originally posted by: Patt
Regmon and Filemon are both extremely useful utilities ... we use them all the time at work to diagnose permissions issues.

How about Process Explorer? Any insight into which is the easiest to use to figure out permissions?