DropMyRights

I've been using DropMyRights by creating a shortcut and using drop my rights to start a limited user process. For example, here's the string used in a firefox shortcut:
C:\MSDN\DropMyRights\DropMyRights.exe "C:\Program Files\Mozilla Firefox\firefox.exe"

I want to utilize drop my rights so that whenever I open a certain file type, the privilege is dropped to normal user.
So if I click on a .pdf and had Adobe Reader installed, I want drop my rights to strip the token that will be associated with the Adobe Reader process down to normal user, then have the process run.
Am I explaining this clearly? Kind of having a hard time putting it into words.

Basically I want to use DropMyRights with file associations as a whole instead of through shortcuts. I've been looking through my registry keys and modified the necessary HKEY_CLASSES_ROOT value for .pdf to point at shortcut configured with drop my rights but this didn't work.
I also went into Tools->Folder Options->File Types Tab and configured the .pdf association to point at a shortcut that uses drop my rights to start a process with my .pdf application.
This yields the error, "

hey finiteworld,

Sadly, I do not believe that you can do it that way.

Basically I want to use DropMyRights with file associations as a whole instead of through shortcuts.

By definition, Windows File Associations must be linked to an Application, and as you've observed, a 'shortcut' is not an app.

Also, such a change would be all inclusive for every User account on that PC, and it would then be invoked even when you did NOT necessarilly want the permissions stripped.

Also, keep in mind that attempting to do that with an application that makes changes to files, like say….quickbooks; that application will fail to open at all without admin rights, and generate an error msg.

Perhaps there is a way to accomplish what you need, I just don't believe that method has any chance at success, sorry.

Tallon41

[have you experimented with "run as" ? ]
[you could create keyboard shortcuts for those main apps that you'll use it for most….]

Why not just create a user with limited user permissions, and use that for day to day activity? Then, you can use Run as when something requires administrator rights. Much easier that way, and safer.

Tallon41 - thanks for the info. I am wanting to set this up mainly for use with pdf's, so that Adobe reader always opens with limited user rights when a *.pdf file is opened up. i'm looking at possibly VB or another language that may help me to get this to work. i found something here.

There is a post from someone on that page that says they wrote a VB app. Here's the code that they posted (with +'s input randomly just cuz i don't know if a browser would interpret the code otherwise, I'm still learning programming)

Shell "C:+\dmr\d.exe " & Chr(34) & "C:\Prog+ram Files\Adobe\Reader 8.0\Read+er\SAFEAcroRd32.exe" & Chr(34), vbNorm+alFocus

I keep hearing that it's possible but I just don't know how yet.

—

Raktor - i agree completely and think that it's way safer to be a lim user and elevate privileges as needed rather than be an admin and lower them for certain apps only. trouble is my situation requires users to be admin on the box. it makes me bang my head against a wall but there's nothing i can do, unfortunately.

i'll keep diggin and if anyone finds anything please let me know (i'll post a solution if i figure it out).

It doesn't look like it is possible with DropMyRights as the program doesn't allow program arguments for the programs it runs (if that makes sense). For example, when you open a PDF file, the command you would be running would be something like:
AdobeReader.exe myfile.pdf
DropMyRights doesn't seem to allow the bit in red.

Have a look for something called StripMyRights. It looks to be the same thing (based on the same program) but it does allow arguments, and should do the trick for you.

An interesting topic.. If I were handling this problem I would rather tackle the "faulty" software that requires admin priveleges from the user. Programs such as Quickbooks are this type of "faulty" application. It is now on its umpteenth generation and the geniuses over at Intuit still haven't made it run with standard priveleges. However, you can make a few registry and file modifications that will allow Quickbooks to run while not giving any more permissions than necessary.

The same thing holds true for whatever program you are using that requires admin permissions. These programs are few and far between. If you can not google the situation for necessary information to make the program run without admin rights, a program called Process Monitor will monitor where the "Access denied" errors occur and then you can modify those registry and file entries so the program can run in a "limited" user account.

I found this script: vbrunas.vbs which works perfectly for all intended purposes. It could be used to replace the OPEN command in the .PDF association. However, my problem in testing it was that whenever I changed the .PDF OPEN command in file associations it would always reset as soon as I pushed OK. I'm not real familiar with modifying those values and got sick of looking for the solution real quick. If you can figure out how to add this script, it does work fine. YOu just have to create a limited user account and password to use.

I'm curious as to why you are so interested in making .PDFs open in limited modes? This seems like one of the "safer" things you could do. I'd rather force internet explorer into limited mode or something like that.

I'll have to check out the script and see what I can figure out. I'm also looking at information for StripMyRights. Thank you for all the helpful information & direction. The end goal is to have all internet facing applications always, no matter what, open with normal user privilege. IE, Firefox, Outlook, etc… and also programs that are known major vectors, like adobe reader. Oh how I wish that I could just have user run as "normal user" rather than Admin on the box but, unfortunately, I am currently unable to elicit that change. One brick at a time eh?

You haven't been real clear WHY you can't elicit that change? I'm very curious why any users would have to have admin rights. Almost every privilege and program on the computer can be given the right access permissions for the users to accomplish what they need to accomplish without give blanket admin privileges. Have you thought of using a program (FREE) called Windows SteadyState? Or, deepfreeze (not FREE). If users absolutely have to have admin privileges, give it to them, but as soon as they reboot their computer every change they have made is lost. On a domain, with roaming profiles, and folder redirections this works perfectly.