Hallo all,
to prevent the computer users in our company from infecting their
pc's with viruses we want to restrict their accounts. But the users
should still be able to install certain software packages without
being told the administrator passwords.
I'm writing an installer utility that makes this possible.
I do this by the following trick:
- If the installer utility is started under a non-admin account, it
executes a copy of itself using built-in administrator credentials
(user name and password). The non-admin instance then terminates.
So I have an instance of the utility running with admin privileges.
The utility then asks the user for a one-time password which he
can obtain from me. If this password is entered correctly, the
utility does the following:
- Under the admin account, it maps a drive to a shared folder on our
file server that contains setups for several programs.
- It then executes "explorer.exe /separate" so that one instance of the
windows explorer is running under the same admin account. The
command line switch "/separate" is absolutely necessary or else it
doesn't work.
- The utility then terminates itself immediately.
Using this explorer window, the user now has the opportunity to
install or uninstall software. Once he closes this explorer window,
he is no longer admin and the drive mapping is gone.
So far the utility works as planned, with one flaw: I am unable to tell
the explorer to directly open up directly my mapped drive Y:\, it
always starts in C:\ when I start it using the command line
"explorer.exe /separate".
I have tried all possible variations of the command line, such as
"explorer.exe /separate /root,Y:\ " but they all don't work.
Any clues what command line I should use?
--
Arthur Hoornweg
(In order to reply per e-mail, please just remove the ".net"
from my e-mail address. Leave the rest of the address intact
including the "antispam" part. I had to take this measure to
counteract unsollicited mail.)
