Windows XP, Games, and Administrator Privileges?

An anonymous reader asks: "I manage my kids' computer, running Windows XP Professional, with an iron fist. They have limited access rights as I do not want them accidentally deleting the wrong file or downloading trojan software. However, software products, particularly games, fight my user management schemes at every turn. Each user on the computer is member of the 'Gamers' group. This group has full access to the games directory, the place I install all of the game software. I did this since games often need to update configuration files or write save files. Despite these changes, I still run into problems. Our latest two games, Age of Mythology and Battlefield 1942, require administrator privileges irrespective of the file privileges. I have not been able to overcome the problem and it seems, based on Googling, that others are in the same boat. Fellow Slashdot readers, what have you done to overcome this problem?"

Comments

short answer

[nsebban]

1- Dual Boot (WinXp for you + Win98SE for your kids)
2- A ghost image of the win98SE partition
3- Let them play
4- Wait for them to say "Dad it doesn't work anymore !"
5- Restore your ghost backup
6- Goto 3

Seems a bit dub, but it works better and it's less a pain than managing XP user rights.

secondary logon service

[happylight]

Use the secondary logon service. Right click on the game program short-cut, select properties, under the "Shortcut" tab click on advanced, then check the box that says "run with different credentials".

It'll prompt you for the administrator password when you run it.

Re:secondary logon service

[SurgeryByNumbers]

Let me give you some more details on WinXP that will let you work around having your kids login as admin.

1) Download (TweakUI) Powertools for WinXP from the Microsoft website.
2) Create an admin login with the rights required to play the game, and use TweakUI to disable that account. No one will be able to actually login as that account.
3) Set up the game to "run with different credentials," as outlinded above.

Regmon + Filemon

[EddWo]

Use Regmon and Filemon from sysinternals.com to discover which files/keys the program is trying to modify and is failing on. Then adjust the ACLs on those files/keys so that the Gamers group has write access.

One of the conditions for obtaining the "Designed for Windows XP" Logo is that the program must be capable of being run under a Limited user account. If MS's own software isn't capable of this then you ought to report it to them as a bug.

The situation with XP home which only has "Limited" and "Administrator" account types really does not help people adopt more secure working practices.

The situation ought to improve in future but at the moment it does not seem to be something that most developers test against.

Patches

[NexusTw1n]

Microsoft appear to have a patch for this problem, I don't know if that will fix it for you.

Other ideas include giving "Gamers" full access to the "Program Files" directory in case it's trying to write there rather than your games directory.

If that doesn't work then perhaps mail the CD back and ask for a refund. There is no reason any application, least of all a game should require admin rights for normal operation, and if it does, the software is not fit for the purpose it was sold for.

Run as different user/Crack the games?

[rufo]

No, they don't. It says right on that page to "try logging in as an Administrator" before it says to install the fix.

The reason the games need this is because of the CD copy protection; they need to access the drive directly to be able to see whether the bad sectors/whatever hidden data they're looking for are there. You could try cracking the games and seeing if that helps, as I'm pretty sure that's the only they need Admin access - a good site for cracks is GameCopyWorld. I often use them because I'm a lazy bastard who doesn't want to risk ruining his (original!) CDs by switching them around all the time, and I've never had a problem with any of the cracks I've downloaded from there.

One other possible method.. Isn't there a way to have Windows "run as" a different user (ala +s on UNIX)? So you could have it run as some special Admin-priveleged user, while keeping them in the non-Admin account most of the time.