How to run cpl as local administrator

Hi!
We have a user that works on graphics and he needs to run "Adobe Gamma.cpl".
But when he tries to run, it shows a message that only administrators can run it:
"To be able to run Adobe Gamma you must log on with Administrator Privileges".
I tried run as administrator, the message persists.
I tried run as domain administrator, the message persists.
I tried to run as local administrator, it worked!
I tried put this user on local administrators group, it worked too!
But I can't give him local administrator password and I must leave him as a simple user on workstation. 
I was imagining how I can make this executable by simple users.
Any Ideas?
Thanks in advance.
FM
Fabio Martins MCDST/MCSA Brasil!!!

There are products like BeyondTrust PowerBroker for Windows that can be configured to attach an administrator token to a process so that it runs in admin context without granting the end user admin privileges.  
http://www.beyondtrust.com/Products/PowerBrokerforWindows/
There's a licensing fee when installed and managed at an enterprise level, but it does not require a license to install locally, at least it didn't some time ago.  While it is technically possible to install that on dozens of workstations, it would
be a bit of a pain to manage and I think it is stretching the interpretation of the license agreement.  The trial might expire now, I haven't used it in years.  The cost wasn't too high and might be worth investigating anyway.
You could also package a simple script to launch the control panel and advertise it to run in system context with SCCM or some other application distribution tool.  While that may seem heavy handed, if you have the tools it is pretty straightforward
and solves the problem.
I hope this post has helped!

Similar Messages

  • DLU and local "Administrator" account

    I have another network admin that has given me some information of the
    subject heading that I don't quite understand...
    They are using ZEN 3.2 with DLU on a Citrix server. This way, when a
    student logs in via Citrix and gets logged in, ZEN policies restrict
    them to what they can and cannot do on the local machine. Since they
    need elevated rights to the registry (for whatever reason), they use
    the "Administrator" account and are members of the "Administrator"
    group on the local machine.
    I simply don't understand it...When I use DLU (on workstations mind
    you), I have the following for the policy...
    ================================================== =======
    Enable DLU
    Manage Existing User Account (if any)
    Use eDirectory Credentials
    Nothing underneath for the username, but they are members of "Users"
    ================================================== =======
    His configuration is as follows...
    ================================================== =======
    Enable DLU
    Manage Existing User Account (if any)
    Username: Administrator
    Member of: Administrators, Users
    ================================================== =======
    He tells me that with this config when a student logs in, they
    automatically use the local "administrator" account. That's what I
    don't get.
    My config makes a new user on the workstation if they haven't logged
    into the machine before. I thought at times it would be handy to make
    3 accounts locally, such as "Staff" "Student" and "Administrator" for
    instance, but didn't realize this config he talks about could make it
    happen. Can it? I still don't get it at this point. I'm reading my
    manuals and what-not and am not yet convinced.
    What I'm hung up on is the password syncing. If I am logging in as
    "bbinder" with a password of "hello" (NDS credentials) but the local
    "administrator" password is "goodbye", why wouldn't it prompt me for
    the administrator password since it's not the same as mine? There
    isn't an "existing account" to manage in his config. This (I assume)
    means it uses the account specified in the name field you can type in.
    In his case, this is "administrator" as typed in above. But since the
    passwords aren't the same, how does it use the local "administrator"
    account? Does it overwrite the password? Does it create a new
    administrator account and call it "administrator.001" ??? Not quite
    getting it yet.
    Anyone want to try and help me with this? Some people think there
    would be some big benefits by having everyone use the local
    "administrator" account, for instance because it has full rights to
    the registry and file system. Plus, GP's will still be in effect, so
    they would be locked out of the parts of the workstation you want to
    lock them out of anyway.
    Other advantages would include a "pre-made" user profile that has
    already been secured and populated with the various things deemed
    acceptable by the company's/school's policies.
    Also, no delay on login when a new local account has to be created.
    Since they are all using the same account being specified in the
    policy, it would be nice and fast to login to.
    Finally, no more prompting new users to enter in their names and
    initials when MS Office apps run for the first time under a user
    account. Maybe this could be avoided with a policy, but this would
    suffice as well.
    Sorry it's so long, but I appreciate any help you guys can offer to
    clear this up for me.
    Brian

    Craig,
    I'm sorry - I thought I replied on this post but I didn't.
    Just wanted to say thanx for taking the time to explain this to me.
    Brian
    On Fri, 20 Aug 2004 10:46:44 GMT, Craig Wilson
    <[email protected]> wrote:
    >DLU simply changes the "Administrator" accounts password in this instance.
    >
    >How do you know what the current "Administrator's Password"? You don't
    >and you just pray DLU or something does not break.
    >
    >Instead of using the "Administrator's Account", just use any other name of
    >an account that does not exist like "SQUAREPANTS".
    >
    >DLU will create the account and put it in the administrators group.
    >All users will share the same profile so you get all the benefeits of the
    >other system, without the risk of losing access to the box.
    >
    >I actually never give user's local admin rights nor do I have user's share
    >profiles, but .............

  • Windows server 2003 local administrator password

    hi,
    I have forgot local administrator password on windows 2003 server. There is no other user to login. Please suggest how to reset password of local administrator. or any other way.
    Thanks in advance.

    You can use the DART tool from the MDOP and use the
    locksmith to reset the password.
    or
    http://home.eunet.no/~pnordahl/ntpasswd/
    http://www.petri.co.il/forgot_administrator_password.htm

  • How to add first log on user to local administrator group

    Hi All,
    When first time user log in to system, i need to add that particular user to local administrator group?
    How to achieve it using vbscript?
    Thanks
    Divakar

    It is also now against federal law in the US, Canada and, I believe, the UK. 
    In the US HIPAA and the federal network security act (???) and Sarbanes-Oxley all prohibit users running as Admins.   This may not specifically affect your
    installation but it does show how important this is.
    There is NEVER a good reason to make a user an administrator.  It is only lack of technical know how that leads to this scenario.  Any vendor product that
    requires this is not a safe product to use in a corporate network.  Malware specifically looks for this as an attack vector.
    I spent three years arguing with Inuit to get there software to work.  Every time they said you have to run as an admin I told them it would never be.  We
    were always able to find a way.  Now QuickBooks installs as a standard user with no issues.
    It can be done.
    ¯\_(ツ)_/¯
    It is also now against federal law in the US, Canada and, I believe, the UK. 
    In the US HIPAA and the federal network security act (???) and Sarbanes-Oxley all prohibit users running as Admins.   This may not specifically affect your
    installation but it does show how important this is.
    There is NEVER a good reason to make a user an administrator.  It is only lack of technical know how that leads to this scenario.  Any vendor product that
    requires this is not a safe product to use in a corporate network.  Malware specifically looks for this as an attack vector.
    I spent three years arguing with Inuit to get there software to work.  Every time they said you have to run as an admin I told them it would never be.  We
    were always able to find a way.  Now QuickBooks installs as a standard user with no issues.
    It can be done.
    ¯\_(ツ)_/¯

  • How to unlock local administrator accounts

    Hi all,
    I have a XP machine that is a member of Win2008 domain and the local
    administrator account is locked out
    whenerver i restart xp machine automaticaly locked out admin accounts.
    how to unlock the xp or windows 7 machines local admin accounts over gpo.
    Regards,
    Udaiyar

    How to unlock local administrator account
    Using CMD (Adminstrator)First
    you’ll need to open a command prompt in administrator (Ctrl + X + A in Windows 8).
    Then, run the following command to unlock the account.
    net user administrator /active:yes
    Then, log out and you’ll now see the Administrator account as a choice.
    To lock this account again, type
    the following command:
    net use administrator /active:no
    http://www.suctips.com/2014/02/how-to-enable-local-administrator.html

  • How to reset windows 2008 R2 Local Administrator password

    Hi Team,
    I have forget windows 2008 R2 local admin password, the server is not in domain , is it any way to reset local administrator password.
    Regards,
    Triyambak
    Regards, Triyambak

    When your Windows Server 2008 R2 computer is still accessible, you can reset or change your administrator password with ease by the following steps.
    Step 1: Log in your Windows Server 2008 R2 computer through the administrator account.
    Step 2: Click on “Start” on the lower left corner of your screen, and hit “Control Panel”, and then doubt-click on "User Account".  
    Step 3: Choose “Make changes to your user account”, and then click on “Change your password”.
    Step 4: Now you will be asked to enter your current password, type in it.
    Step 5: Enter your new password and retype it to confirm your new password. You are optional to type in a word or phrase as the hint of the new password. It is highly recommended. 
    Another tip, Using a password recovery tool to recover WIndows server 2008 administrator password
    This is a universal WIndows password recovery method which can fix any Windows system password issue.
    1. Get Windows Password Rescuer and install it on another computer.
    2. Burn password reset disk into USB or CD/DVD device with Windows password recovery.
    3. Boot Windows server from password reset USB or CD disk
    4. Reset forgotten Windows server 2008 local or domain admin password without data loss.
    Detailed steps: http://www.wimware.com/how-to/reset-windows-server-2008-password.html
    I also have seen a way that users can use a Windows server 2008 install CD to reset the administrator password, you could search and have a try.  

  • How to run local host web application in win 7 64 bit with oracle database?

    Hi all,
    Hope doing well,
    sir i am running my local host web application with oracle database in win 7 32 bit. it's working fine.
    but when i am running the same thing in win 7 64 bit. it's showing login error.
    not going to home page even i checked with this published file open in visual studio it's working fine.
    how to run it correctly?
    thanks in advance.

    The number of times you have been asked to post sufficient details for your questions, we would expect you to have got the message by now... but clearly not.
    952646 wrote:
    but when i am running the same thing in win 7 64 bit. it's showing login error.What error? You haven't posted an error. There are millions of possible errors in computing and you're expecting people to guess which one.
    not going to home page even i checked with this published file open in visual studio it's working fine.
    how to run it correctly?No code, no database version, no details...... = NO HELP.
    When are you going to learn.

  • Exchange Management Console require workstation local administrative rights to run?

    Does launching the Exchange Management Console require local administrative permissions?  
    I understand I need Exchange permissions to perform Exchange tasks, but I am wondering what permissions are required just to run the Management Console?
    Jason Meyer

    Hi,
    If you just want to launch the EMC, you need not require any special permission.
    However, if you want to modify anything, you should assign the corresponding permission to the appropriate user.
    I recommend you refer to the following articles to understand the permission in exchange:
    http://technet.microsoft.com/en-us/library/dd351175(v=exchg.150).aspx
    AD Domain Rights Needed to Manage Microsoft Exchange 2010
    Hope this helps!
    Thanks.
    Niko Cheng
    TechNet Community Support

  • How can we change local administrator password in 500 machines in a domain from a centralized location?

    How can we change local administrator password in 500 machines in a domain from a centralized location?

    This was moved out of the Profile forum.
    You should ask this question at
    www.answers.microsoft.com.
    Or I can move it into another forum if you'd like.
    Thanks!
    Ed Price a.k.a User Ed, Microsoft Experience Program Manager (Blog,
    Twitter,
    Wiki)

  • I need help, How could I add Aliases to Local Administrator account via terminal commands???

    I need help, How could I add Aliases to Local Administrator account via terminal commands???
    I want to use commands to add alias for existing administrator account remotly by using ARD.
    Thanks.

    Hi,
    a Windows Domain Controller does not have any local user or groups. So you might add the user to the admin group at Domain level.
    B RGDS,
    Gregor
    Edited by: Gregor Gasper on Jan 9, 2009 1:44 PM

  • SCCM 2012 - How to add domain id to local administrator group of all clients

    SCCM 2012 - How to add domain id to local administrator group of all clients
    Hi,
    i have a domain id sccmadmin which is a part of domain admins group too.
    Need to add this ID to the local administrators group of all clients. How do I do this? Please help!

    Hi ,
    you need to choose the second option .
    First option will remove all the domains users from the local administrator group available in all the PC'S .Then local administrator group will only have the users updated on the members list present in group policy.
    Note : Local admins accounts on the local administrators groups will not be removed.
    Second option will add the newly created group to the local administrator group in all the PC'S and it will not remove the existing members in the local administrators group.
    Step 1 : Just try to create one new group for SCCM management .
    Step 2 : Then add the SCCM account to that group.
    Step 3 : Then please create a new group policy on that just choose the second option.On that option just add the newly created group to be an member of administrator group in all the PC'S
    Why i have asked you to create a new group ?
    Because in second option , we don't have a option to add a individual user .
    Once you have created a group policy it will like below snap.
    As an additional i will tell how to find the newly created group policy is applying to computer objects or not ans also i will tell you how to force update the group policy 
    1.gpresult /r ----> To find the which group policy is applying on user and computer object .
    2.rsop.msc ----> There you can able to find the change has been applied or not .
    3.gpupdate /force -----> Forcefully updating the group policy in a client machine 
    4.In gpmc.msc there is one option called group policy results .That option will be used for centralized management to find the policies that are applied to a user and computer account.
    5.Just check the event viewer in all the PC'S for group policy related events.
    Most importantly you need to make sure all the computer accounts are placed in an ou ,where the newly created group policy is applying and also make sure that OU doesn't contain any inheritance block.
    Please feel free to reply me if you have any queries.
    Thanks & Regards S.Nithyanandham

  • Are local Administrator rights required to install or run the following pieces of software

    Hello,
    I was wondering if you would be able to assist me. I am currently cataloging various bits of software in use within our company and need to know if they a) require local administrator rights to install on a computer and b) require local administration rights to run after being installed.
    The pieces of software in question are:
    Blackberry Desktop Manager Version 4.3.0.15
    Blackberry Enterprise Server Version 4.1.3.18
    Any assistance gratefully received, or if you could point me in the direction of who I should be asking that would be great.
    Many Thanks,
    Phil Booth
    Group M
    IT Desktop Support technician.
    Phillip Booth
    GroupM
    Technical Support Engineer
    IT
    [email protected]
    Office: 0207 158 5995
    DID: 5995
    124 Theobald's Road London WC1X 8RX United Kingdom
    www.groupm.com

    Superb detail, thank you.
    (1) Download the Windows Installer CleanUp utility installer file (msicuu2.exe) from the following Major Geeks page (use one of the links under the "DOWNLOAD LOCATIONS" thingy on the Major Geeks page):
    http://majorgeeks.com/download.php?det=4459
    (2) Doubleclick the msicuu2.exe file and follow the prompts to install the Windows Installer CleanUp utility. (If you're on a Windows Vista or Windows 7 system and you get a Code 800A0046 error message when doubleclicking the msicuu2.exe file, try instead right-clicking on the msicuu2.exe file and selecting "Run as administrator".)
    (3) In your Start menu click All Programs and then click Windows Install Clean Up. The Windows Installer CleanUp utility window appears, listing software that is currently installed on your computer.
    (4) In the list of programs that appears in CleanUp, select any iTunes entries and click "Remove", as per the following screenshot:
    (5) Quit out of CleanUp, restart the PC and try another iTunes install. Does it go through properly this time?

  • How do I change a local install of NW 7 to a domain install (X64 & SQL)

    So I was following my notes and it said to log into the server under the administrator to install the NW7 platform. So I did but I logged in as the local Administrator and not the domain Administrator which I have now found this is wrong for our environment.
    I have almost a fully configured Development system and I really can't afford to uninstall and reinstall under the domain admin.
    From comparing a Domain install to a local install I see I need to
    if a have local users  pedadm & SAPServicePED (being PED is the system)
    I need to create domain users with these names and the same password
    create a NT Group SAP_PED_GlobalAdmin
    Add the domain group SAP_PED_GlobalAdmin to the new domain users
    On the server where the system is installed changed the
        SAPOsCol to use the domain  pedadm  account
        SAPPED_00 to use the domain SAPServicePED account
    In SQL Server add the 2 new domain accounts and make them both sysadmins and make their home database the system database (in this case PED)
    So at this stage all the Windows /SQL config is all done but how do I tell SAP to use the domain accounts and not the local account. I would suspect there is at least a database string her somewhere.
    Can anyone help with the last bit.

    Cheers
    In the end the missing parts where
    Delete old users from SQL Server (DO NOT DELETE THE SYSTEM USER FROM SQL SERVER)
    Add the new domain users to the local administrator group of the server running the SAP system.

  • Windows 7: Trust Relationship Error - Local Administrator Account Locked.

    I have 2 Windows 7 Professional machines that recently locked me out citing the "Trust Relationship between this workstation and primary domain failed".
     I assumed all I would have to do is log in as local administrator and remove it from the domain and then re-add it.  When I tried to log on, it told me that I have the password was incorrect - which I knew it wasn't.  After a
    few tries I got a different message that said that the account was locked.  No idea how this could have happened.  Every other local account was locked as well.
    I checked the AD on our 2003 server and I didn't see anything out of the norm.  The computers were in the correct OU, and were not disabled in anyway.  I searched online for a solution, but they all required me to be able to log on to the local
    admin, which is disabled.  
    I tried to boot to Safe Mode with a Command Prompt and typed in: net user administrator /active:yes .
     It told me that the change had been made, but when I reboot it still shows the local account as disabled.
    Any suggestions would be greatly appreciated.  
    Edit: It is Windows 7 Professional x64 

    I have had this issue twice as well. However I have been always been able to log in with local admin rights. removing then rejoining to domain seems to never get things back to normal for me. Once it is reset and joined back to the domain all software just
    seems to be missing but still there at the same time. Like Antivirus shows its installed in c:\program files but its not running. If I go to domain users start menu everything is missing but go into c:\program files and its all there. So every time I have
    seen this error a reimage is what I do seems to work a lot better than dealing with the head aches. Sorry I was not any help but that is my two cents.

  • Can't run programs installed under Administrator

    Our user DLU's run at the User level, so we install any extra software that isn't on our image using the local Administrator account. Sometimes users are prompted to enter the Administrator password just to run such software, but it seems to depend on the program.
    Virtual Apps are not always possible so I'm trying to understand the mechanics of why Users can run something installed under Administrator.

    If you want them to be able to install software, make them part of the
    administrators or power users group.
    Of course, what's gonna happen to them WHEN they install improper software
    (not IF, it is a WHEN).
    What software are you trying to install?
    You should probably look up the app @ the website www.appdeploy.com
    While not specific to ZCM, it has an incredible wealth of info on specific
    applications and how to deploy/package them
    >>> kfreise<[email protected]> 9/28/2010 8:02 AM >>>
    Most users are trying to install simple .exe files for browser addons
    and they are nearly attacking me for the rights to do this. There has
    got to be an easier way than trying to make a bundle each time some
    small install issue comes up.
    I just want my users to be able to install whatever they want. If they
    blow up their machine we can reimage it.
    kfreise
    kfreise's Profile: http://forums.novell.com/member.php?userid=46346
    View this thread: http://forums.novell.com/showthread.php?t=420981

Maybe you are looking for

  • Mid 2010 Macbook Pro Keeps Restarting

    Hello All, I am new to this discussion board and have a problem that I need help with. My computer has been restarting randomly for the past couple of months. At first it was maybe once every few days, now it's at least twice a day. Anybody else havi

  • JSTL: Using value of a variable in expression

    All, I am stuck on this problem and I hope someone here can help. This is a real tough one for me to explain but I'l try my best. I am try to have my includes a little more component oriented. So I wanted to use something like the following <c:import

  • Color profiles for I photo books

    Is there a desired color profile to use for printing books with i photo My images are currently adobe-rgb. jpegs brought in from CS When I print the images thru CS they look great. When i print them thru I photo book or the PDF they look very dark an

  • How can I save a PNG image in CMYK color.

    I want to put the image in InDesign, for a catalog. Then I want to print the catalog. So I need everything to be in CMYK color mode. Even this PNG image I modified in Ps Already tried but no success

  • Control animation with keyboard

    http://java.sun.com/products/java-media/2D/samples/suite/Image/DukeAnim-pi.html Is there anyway that one could control the movement of something like this (the walking thing) with wasd or the arrows??? Thomas