Windows XP, Games, and Administrator Privileges?

An anonymous reader asks: "I manage my kids' computer, running Windows XP Professional, with an iron fist. They have limited access rights as I do not want them accidentally deleting the wrong file or downloading trojan software. However, software products, particularly games, fight my user management schemes at every turn. Each user on the computer is member of the 'Gamers' group. This group has full access to the games directory, the place I install all of the game software. I did this since games often need to update configuration files or write save files. Despite these changes, I still run into problems. Our latest two games, Age of Mythology and Battlefield 1942, require administrator privileges irrespective of the file privileges. I have not been able to overcome the problem and it seems, based on Googling, that others are in the same boat. Fellow Slashdot readers, what have you done to overcome this problem?"

Comments

short answer

[nsebban]

1- Dual Boot (WinXp for you + Win98SE for your kids)
2- A ghost image of the win98SE partition
3- Let them play
4- Wait for them to say "Dad it doesn't work anymore !"
5- Restore your ghost backup
6- Goto 3

Seems a bit dub, but it works better and it's less a pain than managing XP user rights.

Re:short answer

[Decado]

Or you could just use the system restore facility that you got free with Windows XP. Install your games, set a system restore point (start->programs->accessories->system tools->system restore) and give full admin access to the kids. Then when they mess anything up go back to your known good restore point. Thats a hell of a lot easier than dual booting and ghosting and you dont need any extra software to do it.

Standards? We don't need standards...

[Drakino]

Unfortunatly a ton of programs do not adhere to the exact standards they should, and there really isn't a way around it. XP easially lets you grant someone full control, or none, but this dosen't mean every program is going to listen and act the same. The sad realty is to get anything done on a Windows box, you have to sit logged in as an admin. It's ironic that a Microsoft published game is one of the ones giving you pains...

Though, to address your current problem, you could create a new user, use the policy manager to only allow one of the troublesome games to be run, and grant them admin rights. Then use the "Run As" feature of XP to run that program as this new user, from the kids login. Just keep an eye on where the game is saving files, as it could be doing so in the new users home folder somewhere.

Same problem with my kids - different solution

[Captain Kirk]

I've a 10 and 8 year old who play Warcraft and Age of Mythology. My fix it to let them do what they want and accept the consequences it the system broke. Sure enough it wouldn't boot after a few months.

Rather than rush to fix it, I spent a week doing nothing but said I "was doing research into how to fix the problem." The 1 week without games was sufficiently traumatic that there's been no problem since.

Re:Same problem with my kids - different solution

[PainKilleR-CE]

Rather than rush to fix it, I spent a week doing nothing but said I "was doing research into how to fix the problem." The 1 week without games was sufficiently traumatic that there's been no problem since.

This is actually what drove me to learn how to do an OS reinstall. As time went on, each time Windows ate itself, my dad would take longer and longer to get around to fixing it. Eventually, I got sick of waiting and did it myself. Within about two months I had him in complete understanding of the beauty of keeping data and OS on seperate drives, and now, many years later, my dad calls me when he wants information on how to do something or advice on new hardware.

Re:Same problem with my kids - different solution

[GeckoX]

No kids ehh?

It's all too obvious really.

Here, I'll spell it out for you:

He was giving his children an opportunity to learn the relationship between their actions and subsequent consequences, on their own.

Again, the key word here is: LEARN

Re:Same problem with my kids - different solution

[4of12]

Exactly right on.

I agree with the earlier poster, too, who was motivated to learn how to re-build his computer after crashes because, well, no one else had time to do it.

I think that's a great way for kids to learn something practical as well as the moral lessons of actions/consequences, if you want something done you have to do it yourself, etc..

The double edged sword, of course, is that when your sharp kid learns the intricacies of re-installing the OS from scratch, getting the settings right, etc. that they'll be empowered to see the Internet in all its ugliness, too.

So the corollary is that, before you throw the installation CD and manuals and have your kid rebuild the computer, explain plainly the basic fact that much of the world is screwed up in these 23 different ways and that you'll see it all on the Internet.

Arbitrary ages of 18 ought to be replaced by "whatever age someone is able to figure out how to rebuild a computer" IMHO. Yes, there are some people who ought never to be exposed to some stuff no matter how old they are... The age of understanding concepts should be the threshhold for driving, voting, consuming harmful addictive substances, etc. rather than some X years.

secondary logon service

[happylight]

Use the secondary logon service. Right click on the game program short-cut, select properties, under the "Shortcut" tab click on advanced, then check the box that says "run with different credentials".

It'll prompt you for the administrator password when you run it.

Re:secondary logon service

[SurgeryByNumbers]

Let me give you some more details on WinXP that will let you work around having your kids login as admin.

1) Download (TweakUI) Powertools for WinXP from the Microsoft website.
2) Create an admin login with the rights required to play the game, and use TweakUI to disable that account. No one will be able to actually login as that account.
3) Set up the game to "run with different credentials," as outlinded above.

Regmon + Filemon

[EddWo]

Use Regmon and Filemon from sysinternals.com to discover which files/keys the program is trying to modify and is failing on. Then adjust the ACLs on those files/keys so that the Gamers group has write access.

One of the conditions for obtaining the "Designed for Windows XP" Logo is that the program must be capable of being run under a Limited user account. If MS's own software isn't capable of this then you ought to report it to them as a bug.

The situation with XP home which only has "Limited" and "Administrator" account types really does not help people adopt more secure working practices.

The situation ought to improve in future but at the moment it does not seem to be something that most developers test against.

Patches

[NexusTw1n]

Microsoft appear to have a patch for this problem, I don't know if that will fix it for you.

Other ideas include giving "Gamers" full access to the "Program Files" directory in case it's trying to write there rather than your games directory.

If that doesn't work then perhaps mail the CD back and ask for a refund. There is no reason any application, least of all a game should require admin rights for normal operation, and if it does, the software is not fit for the purpose it was sold for.

My Advice: Don't even bother.

[Domini]

I've got the same setup for family of mine where they only use internet browsing and mail as multiple users. (They don't even use fast user switching.) And even though they all use restricted accounts, they still seem to be able to corrupt system registry hive files.

My advice is not to even waste your time with this. I'm sure your time is worth so much that you could have afforded another PC, or at the very least Hard drive imaging and restore software.

It's best to let kids loose on a machine, and if they mess it up, you just restore it... it's their (save game) loss.
They will learn about all those vital microsoft tricks like backing up your important data and do not install all that junk.

It's also imporant then to get them each a machine, but since you will not be wasting time admining those machines anymore, I'm sure you will have a lot more time and thus money.

I mean, really, since Win NT 4.0 the graphics drivers have had admin rights... and you are still denying this to your kids! ;)

I think the best admin policy is education of the user. Also keep a system restore handy with software such as Norton Ghost (with all the propper patches already installed to protect against internet worms etc.) as well as good anti-virus software. Believe me, this is the cheaper solution..

'kids computer'

[xmple]

If it is truly the kids computer (so you have another one with all your important data on it), then I should let them have full privileges, and let them explore the computer on their own.
How else will they know what a computer can 'really' do, if you just let them have restricted access to a single game directory.

Let them explore, let them familiarize with the computer, they learn from their mistakes: if you do something wrong, like deleting system files, you probably wont try that again.

When my parent bought me (well it was ment to be for the whole family) a 286 computer with dos installed, I knew nothing, and neither did my parents.
so I explored, and I found a 'help' command, and a 'dir' command, and I found different types of files (the ones you can execute, and others)...

So once again:
It's not that bad when something goes wrong, format the disk, and reinstall.

However I would recommend on restrincting access to the internet, so they can't accidently download malware.

Check your ACLs

[stevenbdjr]

These kinds of problems are most certainly related to file and/or registry permissions. Working at a K-12, I'm often troubleshooting software that won't run as a normal user. I've found the majority of the problems are related to poorly written software trying to add and modify files to the SYSTEMROOT directory (usually c:\windows or c:\winnt). The rest are usually solved by opening up permissions on the applications registry keys under HKLM.

Get yourself a copy of RegMon and FileMon from Sysinternals. You'll need to logon as an Administrator, start up reg or filemon, then do a RunAs on the application to run it as a normal user. You'll probably want to filter the output of reg/filemon to only show activity of the app itself, otherwise you'll be looking at all activity on the system. Look for ACCESS DENIED errors in places where normal users can't usually write. Slowly open up those areas to modify access until you've found a solution.

Re:Encourage your children in life, not games.

[Babbster]

I'm always amazed that in these modern times, with so many bicycles, motorcycles and cars, people still manage to care for and ride such high horses.

Re:VMWare

[Gyler St. James]

Have you even TRIED to play a game like BF1942 in a frickin VM window? I have. It's not viable. Let them play DOOM, sure. Quake is fantastic in a VM. Max Payne 2 tries to run...keyword: tries. Never does. Love playing games at 1fps.

Re:Hrm.

[KDan]

More to the point, stop struggling and realise that windows is by design a system which will fall over itself after a long enough period of time, and you WILL have to reinstall it sometime. So stop trying to delay that moment, and make sure that you can do that easily. The previous suggestion about ghosting the system in a stable state is good, but not the best because you will still have to keep track of what important updates you hadn't done when you made the ghost image.

Probably the best solution would be to keep a CD-RW regularly updated with the entire list of drivers/service packs/updates that you need to install when you reinstall the computer, along with a list of the programs that must be reinstalled before any games (eg Office, any dev tools that you need, etc), and (this will be a shocker) teach your kids to do it!!! Then when the computer falls over, you can tell the kids that it's in part their fault, and that this is a good learning opportunity for them (and it is - you learn more about how a computer functions when rebuilding it from scratch than when using it), and so stick them on there for whatever time it takes and let them do it (under penalty of no gaming if they screw it up and you have to do it yourself, of course).

The result will be kids who know more about PCs than just gaming, who will not need to pester their friends/parents to get their computer(s) set up, and who will be more computer-literate than most of their age group. And don't worry about the task being 'too complicated'. Don't underestimate your kids, they will pick it up in no time, and by the time the next version of Windows comes along they'll probably be the ones giving you tips on how to install your PC.

Daniel

XP and the Compatibility Engine.

[tvadakia]

One other thing you might consider is the fact that Windows XP initiates the Compatibility Engine on a lot of games. One game I can think of right off the bat that does is The Sims. A user needs to be either in the Power Users or the Administrators group in order to run a game or any other application with this engine included in use.

There are a few things you might consider doing. First would to be to google to figure out how one might add the "lesser" users to be able to use the compatibility engine, or at least to run those particular applications (games) with elevated privledges. Another is to write a simple script to use the "runas" command to automatically run a program as administrator using a cached password (in the registry) to run the game in question and then creating a shortcut to that script on the desktop (or wherever) to run the game.

One other thing you can do is add your kids to the power users group then use the Local Security Settings mmc and right-click on "Software Restriction Policies" and chose "Create New Policies." You then can start creating rules of what directories are accessable on the computer (make sure in the "Enforcement" policy to choose "All users except local administrators", you don't want to lock yourself out). You can refine which folders they are granted or denied access to by right-clicking on the "Additional Rules" folder and choosing a new "hash" rule to specify a particular application itself, or a new "path rule" to specify an application path (which'll include EVERYTHING in all subfolders within that path.)

These are just a few ideas to get you started down the path.

The real reason admin access is required...

[DiSKiLLeR]

I have found this to be the case, too. I didn't want my gf's son (an 8 year old) having admin access on my XP machine, but half the damn games required admin access.

This required rightclicking on the game's shortcut, selecting 'run as' and calling me over to type in my admin password... several times a day! )(#@()$*@#()$&@#$@#

Its not that programs want to write to the registry, or system files, or anything else.

It simply seems to be the cd copy protection... most games have various types of cd copy protection (i dunno, daemon tools can emulate most of them when it mounts iso's, but anyway). It seems the games require admin access to perform their little sneaky copy protection checks on the CD...

Personally i think this is a real pain in the damn ass (why do we need the CD in there anyway! The game is already installed FFS) and now we require to give all kids admin access on XP machines just to play games! Its a damn nightmare.

No wonder we hate software manufactureres for all their sneaky copy protection, serial keys, product activation, and now needing admin access to run anything.... *sighs*

I'm glad i bought my titanium powerbook. And last week i bought a used G4 cube. Forget windows....

D.

Re:educate / console / play outside

[karnal]

Why is this insightful?

The man wanted to know how to solve a problem. Granted, you give him a few good "alternatives", but that doesn't solve the problem.

It'd be like me saying "My car is old and doesn't run well -- what do I do to ensure it won't leave me stranded?" and you telling me "Ride a bike. It doesn't pollute and it's always ready to roll...."

Re:OT:Where do I find def'ns for Win's process nam

[EddWo]

A list of system processes, what they are for etc.
http://www.liutilities.com/products/wintasks pro/pr ocesslibrary/

A lot of system services share process space with each other. You will have 3 or more svchost processes. To find out which services are safe to disable.

http://www.blackviper.com/WinXP/servicecfg.htm

Re:educate / console / play outside

[GeckoX]

Pretty much exactly what I wanted to say.
I in no way got the impression that the submitter of the question tries to use his machine as a substitute for parenting. Or is it now bad to ever let children play games, even for a second?

I got the impression that for once a parent was trying to do the right thing in regards to their computer and their children.

Run as different user/Crack the games?

[rufo]

No, they don't. It says right on that page to "try logging in as an Administrator" before it says to install the fix.

The reason the games need this is because of the CD copy protection; they need to access the drive directly to be able to see whether the bad sectors/whatever hidden data they're looking for are there. You could try cracking the games and seeing if that helps, as I'm pretty sure that's the only they need Admin access - a good site for cracks is GameCopyWorld. I often use them because I'm a lazy bastard who doesn't want to risk ruining his (original!) CDs by switching them around all the time, and I've never had a problem with any of the cracks I've downloaded from there.

One other possible method.. Isn't there a way to have Windows "run as" a different user (ala +s on UNIX)? So you could have it run as some special Admin-priveleged user, while keeping them in the non-Admin account most of the time.