Lothar Claus/DEE/Elster

29.11.2007 18:19

Hi to all fans of alphaSET and Windows-Vista,

OK, I just had the chance to investigate alphaSET running under "Windows Vista" with the focus on
access rights. In the last weeks I got some mails that criticized, alphaSET doesn't run with standard user
privileges. This is not really true, it does !!! (With some "legal" tricks!)

1. First, some background information: under Vista, nobody has permanent administrator access,
even if you are logged in with an administrator account! During the normal session you only have
standard access rights (as an administrator, too!), only during "critical operations", e.g. installation of
software, the system (Vista) is asking for higher privileges, that are active only during the action asked
for! If you are logged in as administrator, you are just asked for continuing the job, logged in as
standard user, you are asked for an administrator account and its password - valid only for the "actual
action", too.

2. The second aspect is, that alphaSET, similar to a large count of software, too, needs writing
permission in its own installation path: e.g. in the subpath "..\DB" reside the databases, that are
permanently written during the session and in the subpath "..\IniPfad" reside the INI-Files, that
contain the user settings - and must be writable, of course.

3. The third aspect is, that Vista definitely does not give writing and changing permission to anybody for
the standard program installation path "C:\Program Files\.." (resp. "C:\Programme\..") -
except during the installation of software and only for (temporary) administration account! This is the
only real new feature in Vista - but this causes the problems and error messages.

This means, that the way we were going mostly in the past (installing and working permanently as an
administrator) does not work any more. But, on the system I was testing, I found out some different
solutions:

1. Installation of the software in a different path as "C:\Program Files\.." (and not

"C:\Windows\..", of course!), e.g. directly in the root like "C:\alphaSET\..". Therefore the
proposal path must be changed. Installation must be done with administration account, but the
user later on must not have administrator acces (does not work, look above), but, of course,
writing and changing permissions - please check!

2. The installation can be done in the default path ""C:\Program Files\ELSTER\alphaSET\.."

as all the time before (with temporary set administration rights). Then the installation path and
its subdirectories have to be set writable and changeable to the user group "Standard
User": in Explorer, right mouse click on the path , "Properties", tab "Safety", select group
"Standard User", button "Change", "OK" to continue and then set the changing and writing
permission of the group "User" to Yes".

3. The No. 2 can be done without logging in as an administrator! The only condition is, that the
user (in the group "Standard User") has access to an account as administrator. E.g. the sys-admin
creates a local admin-account for the user, and this can be used temporarily for installation and
administration purposes by the standard user. So the installation and the setting of writing
permission can be done by the user itself, using the local temporary admin account.

Remark: I tried to uncheck the "User Account Control", but this didn't work as a single action (additionally
the installation path must be set outside to "C:\Program Files\.." and this can be used as a single
method!).

I hope, some things are coming a bit clearly now,

best regards and good success,
Lothar