On 7/3/2017 2:38 AM, clipka wrote:
> Am 03.07.2017 um 05:37 schrieb Mike Horvath:
>> On 7/2/2017 3:17 AM, clipka wrote:
>>> The proper way to do this stunt would be first of all to use a user
>>> account with the privilege to obtain admin privileges. As such a user,
>>> you would then invoke Windows Explorer via "run as admin" (which would
>>> prompt a UAC popup to grant you admin privileges for this instance of
>>> Windows Explorer), access the directory in question, and finally close
>>> Windows Explorer again (which would revoke the admin privileges again,
>>> because they were limited to the instance of the program anyway).
>>>
>>
>> I was unable to accomplish this in Windows 7, so I did some research. It
>> seems Microsoft disabled this capability after Windows XP. Maybe you
>> should actually test your advice first before offering any?
>>
>>
https://social.technet.microsoft.com/Forums/windows/en-US/2a366967-f9fb-4010-81f3-94dc15c86ad3/run-explorer-as-a-different-user?forum=w7itprosecurity
> 
> Don't confuse "run as different user" with "run as admin": The former
> would actually allow you to run the program as a different user (which
> in XP times may have had admin privileges); the latter allows you to run
> the program with admin privileges, without switching user accounts.
> 

On Windows 7 I have been using "Run as administrator".

> I wasn't aware that Microsoft has stipped the "run as admin" from the
> context menu of the link; but you can still run it as admin by
> navigating to "C:\Windows", right-clicking "explorer.exe", and choosing
> "run as admin".
> 

They didn't. The link still exists. It just has no effect as of Windows 
Vista. On Windows 7 your second suggestion makes no difference. The 
result is the same.


> That said, yes, I should probably have tested my advice: It turns out
> that you don't even need to run Windows Explorer as admin to access
> other users' directories. If you are using an account that has UAC
> privilege, Windows Explorer will prompt you for UAC elevation "on the
> fly" when you click on a folder you don't normally have access to.
> 
> 

As I explained earlier, doing this grants User A *permanent* access to 
all of User B's files. If User B's files are located in "C:\Users\User 
B\Documents\POV-Ray", then User A gets access to "C:\Users\UserB" and 
all sub-folders, which I don't want. Read the prompt more closely.


>> Further, even if this worked, it would not help when using the File >
>> Open command inside POV-Ray.
> 
> If you were relying on UAC rather than the outdated (for end users)
> approach of using separate accounts, you wouldn't have that problem:
> You'd click on the other user's directory, would be prompted with a UAC
> dialog, and be perfectly fine.
> 

This is a security/privacy issue. User B gets access to all documents 
belonging to User A, whether they have anything to do with POV-Ray or not.


Mike

Post a reply to this message