Allowing non-admin users to use certain programs without authenticating

I would like to allow certain programs to be run by non-admin users without forcing them to authenticate as an admin. Here is my example: I'm running Parallels Desktop with a VM to Windows. I want to allow my children to use this VM to access Windows programs. But, when starting a VM, the Mac OS requires an administrator to authenticate. Needless to say, I don't want my children to be administrators on the machine. I've been assured that this is not an issue related to how Parallels works (from the support team at Parallels). Instead, this is an issue with the Mac. i'm not sure one way or the other, but it seams useful to be able to (in general) allow non-admin users to use certain programs without forcing them to authenicate as administrators.
There is only one summary in the Mac help on allowing non-admin users to change the time zone settings by directly editing the /etc/authorization file. Does anybody know if this procedure would work for other programs?
Thanks!

If you know what the requested right is, that procedure can be applied to any right in an application with a graphic interface by duplicating and modifying entries. The contents of that file don't control usage of sudo in the Terminal.
(25922)

Similar Messages

MultiSim 9.0.41. Non-admin users unable to launch program without error messages.

I have installed MultiSim 9.0.41 has been installed on four workstations. The PCs reside within a local domain with ten users. The domain resides within the greater university domain, is technically not configured as a true subdomain, but it has access to university domain resources (such as the license server). We have SSO (remote profiles) functionality enabled.
MultiSim runs with without problems for admin users. We start having issues with nonadmin users. I series of pop-up messages appear when the program is launched:
"The Microsoft Jet database engine can not open the file C:\Program Files\Electronics Workbench\EWB9\database\mscomp_s.prd. It is already opened exclusively by another user, or you need permission to view its data."
"The Microsoft Jet database engine can not open the file C:\Program
Files\Electronics Workbench\EWB9\database\CPCOMP_S.PRJ. It is already
opened exclusively by another user, or you need permission to view its
data."
"Error loading library C:\Program
Files\Electronics Workbench\EWB9\PCBComponentEdit.dll, ('998') Invalid access to memory location."
"The Microsoft Jet database engine can not open the file C:\Program
Files\Electronics Workbench\EWB9\database\mscomp_s.prd. It is already
opened exclusively by another user, or you need permission to view its
data. Error Code:3051"
Solutions attempted (without success):
- Update program (no updates found via update manager or NI site)
- Run program as admin
- Give all users full permissions to program files (major security risk)
- Change "Directory for EWB Shared Components" to public shared drive. Interestingly, MultiSim shows the network drive as unwritable (though it clearly is).
Any ideas? Are there updates that fix this issue? Is this solved by the newest version? What do I need to do differently to ensure that user config files are saved in their roaming profiles vs. locally (note: I have already tried to correct the paths during install and post-install without success).
Thanks!
Message Edited by refriend on 05-22-2008 02:26 PM

Hi Refriend,
The error message indicates Multisim is not able to read/write to the database folder. Please have a look at the following knowledge base article for instructions to correct the database problem.
http://digital.ni.com/public.nsf/allkb/B06773CE511C7E588625720B00502B8E
Multisim 9, you need to setup the permission for the database manually but in version 10, this step is not required. As for saving user config file as part of the roaming profile, this option is not available. Multisim will always look in the locale drive for the config file and if one does not exist it will create one for that user and save it locally.
Tien P.
National Instruments

Allow Non-Admin Users Update Software Installed In Their Computers

Hello All;
At our location, we have several users who are not always in the office. In some instances, the imac or macbook pro ask for several updates such as Office 2011, and Adobe CS 5 and 6. And, the second issue, these users are not part of the administrator group or ever will be the administrator of their computers.
Is it possible to adjust the authorization file to allow non-admin users to run these sort of updates?
or
Is there a product on the market that can push updates to all these different programs?
Thanks Kindly

Is there a product on the market that can push updates to all these different programs?
Apple Remote Desktop, for one.

How to allow non-admin users to install software updates of Java, FLASH and Adobe Reader?

Hi all,
I have a company (+150 users) and I would like to allow users to update Java, FLASH and Adobe Reader only.
These software are already installed in the hosts, but there are updates of the program every week and it needs to be updated.
How can I give permissions to every user in the domain to do that? Just "Java, FLASH and Adobe Reader"
Remember that I dont want distribute software because they were installed.
I tried to enable "Enable user to patch evelated products" directive but it didn't work at my domain.
is it possible?

I have a method that works for FLASH player, but am trying to come up with a method for the other 2 myself. To automate flash player, I created a Policy and added the following:
Under Computer Config, Prefrences, Windows Setting, Files I created a new File Item.
I set Action = Replace, Created a Source File named mms.cfg* (more below) and have the destination file as systemroot%\System32\Macromed\Flash\mms.cfg (or %systemroot%\SysWOW64\Macromed\Flash\mms.cfg for x64)
I used notepad to edit the mms.cfg, and used the following in the body:
AutoUpdateDisable=0
SilentAutoUpdateEnable=1
AutoUpdateInterval=0
My non-admin users now update flash in the background silently and automatically.

Allowing non-admin users partial admin privileges

Hi All
I manage a number of Macs on a large corporate (PC-centric) network. Organisation policy prohibits giving users admin privileges. However, I want users to be able to do some admin tasks like installing software, but not to have admin privileges per se. The Parental Controls option for non-admin accounts does not offer sufficient functionality.
All the Macs are stand alone (not managed accounts), and are accessible via Apple Remote desktop. Few of the Mac users are command line savvy, so any solution has to be invisible, or via a simple gui.
Thanks in advance
Dave Mitchelll

Most software does not need to be in the Applications folder to run. Non-admin users can install most drag-and-drop software right inside their home folders and run the apps from there.

Allowing non-Administrator "Users" to use AEBS (1)

I'm getting tired of always having to "Authorize" other "Users" on my computer without Administrator Privilege when they wish to connect to my "Closed" AEBS. How can I work around this issue so all "Users" can conect to the AEBS?

It seems that I have originally stated the happenings incorrectly. It should been titled.
Allowing non-Administrator (or Standard) "Users" to use the Airport Card freely
I am both the 'Administrator' and the 'User' in this scenario.
I log in as the 'User', without "Allow user to Administer this computer" checked in System Preferences. This is for enhanced security while surfing at home and also when using open networks on the road. This way an Authentication by the Administrator is required every time when changes to Mac OS X are about to occur.
And, as far as I am aware, MY 'User' keychain has all the passwords I need to do what I need to do.
It's when I am logged in as the 'User' and I go to 'Turn Airport on' (in the Apple Menu) that I get the 'Authenticate' window asking me to "Type an Administrator's name and password to make changes to Mac OS X".
How do I get around having to 'Authenticate' every time 'User" needs to turn the Airport on?

Allows non admin users to add printers

We have some new MacBooks with Mavericks, but I can't figure out how to leave the printer & scanners system preference panel unlocked, so users can add printers wherever they go with their laptops. Is there a way to make it happen?

Follow the instructions for mobile users on this page:
Mac OS X v10.5.7 or later: Allowing managed users to add or delete printers

Allowing non-Administrator "Users" to use AEBS (2)

I'm getting tired of always having to "Authorize" other "Users" on my computer without Administrator Privilege when they wish to connect to my "Closed" AEBS. How can I work around this issue so all "Users" can conect to the AEBS?

The problem lies in that the password for the Airport Network is stored in your personal Keychain, not in the system keychaing (which is a shared keychain for all users) Here is how to resolve this:
1. Open Keychain Access (/Applications/Utilities/Keychain Access
2. In the bottom left corner of the Keychain Access window there should be a button that says Show Keychains. Press it. If it says Hide Keychains then do not press it.
3. In the left column of the window, you should now have 2 boxes, the top one showing "Keychains", the lower one showing "Category" (If not, press Show Keychains again.)
4. You should have at least 2 keychains listed int he top box. One ill be called System, and the other will be called either login, or your username. If you don't see the system keychain here, you need to go to the edit menu and choose Keychain List, click the little plus sign at the bottom of the box and locate your system keychain (/Library/Keychains/) Do NOT click the check box next to your keychain. This will share your keychain, and it is not something you want to do.
5. Now that you have the System Keychain and your keychain at the top of te window, click on your keychain. The right pane will now have a listing of the contents of your keychain. Locate the password for your Airport Network. It will have the "Applications" Icon (the "A" made up off the ruler, pencil and paintbrush" and will be named after the SSID of your airport netowrk (whatever your network is named) Unnder "Kind", it will say "AirPort network password"... NOT "AirPort base station password".
The base station password is the password you use to log into the base station to configure the network. Not what you want. Find the one that says "AirPort network password"
6. Drag this to the keychain named "System" in the left column.
Type in the password for your Keychain
Now... when you look at the system keychain you should see your airport netowrk listed there. Anybody should be able to access your airport netowrk from any account on your mac.
Hope that helps.

ColorSync and non-admin users

Is there a way to allow non-admin users to change ColorSync profiles for printers using the ColorSync Utility? Our non-admin users can launch the utility and see all the printers listed in the "Devices" section but the option to change the default profile for any particular printer is greyed out.
Thanks.

Kurt is far more expert on this than I am, so take his advice first.
Hi,
There are three things to consider...
#1. Profiles in use, like Fast User Switching being on and another User logged in, cannot be changed/edited.
#2. There are at least 2 locations for the .ICCs...
/Library/ColorSync/Profiles/Displays/
/Users/YourUserName/Library/ColorSync/Profiles/
Profiles in the 1st location cannot be edited. ICCs in the 2nd location could have copies made & the copies moved to another User's folder & Rights/Privileges changed accordingly.
#3. See what "Scope" Colorsync reports... I think it has to do whether all users was selected when installing drivers, not certain on that though.

Majority of reports missing for non admin users

I have followed the instructions here (SCCM 2012–Reporting in console for non-admins (Reporting User Role) v2) to allow non admin users the ability to view
reports in the console. So far, so good. However, when viewing the reports with the non admin user, only about 100 of the 400+ reports appear.
Am I missing something here?

The custom reporting one in the link I provided, and also modified versions of the following:
OS Deployment manager (removed rights to All driver related items (drivers and driver packages), Boot image packages (except read access), Operating system installation packages).
Application Administrator (removed Application>Approve; Distribition Point>Set Security Scope; Distribution Point Group>Set Security Scope; Global Condition>Set Security Scope)
The reports missing we care about primarily are Software ones (companies and products and files).

How to allow access to winrs for non-admin user?

I have Windows Server 2012 (and Server 2008, but it is next priority) to monitor it using txwinrm. txwinrm library internally is using WinRS protocol. I have to monitor it using least privileged user, but don't know how to configure access for him.
All I managed to do - is to configure remote Powershell session for my user, but it's look like that winrs and powershell sessions have different security descriptors:
Invoke-Command -ComputerName 192.168.173.206 -Credential (credential Administrator $pwd) -ScriptBlock { 2 + 2}
# gives 4
Invoke-Command -ComputerName 192.168.173.206 -Credential (credential lpu1 $pwd) -ScriptBlock { 2 + 2}
# gives 4
winrs -r:192.168.173.206 -u:Administrator -p:$pwd 'powershell -command "2+2"'
# gives 4
winrs -r:192.168.173.206 -u:lpu1 -p:$pwd 'powershell -command "2+2"'
# Gives Winrs error: Access is denied.
Configuration for my user is following:
(Get-Item WSMan:\localhost\Service\RootSDDL).value
# O:NSG:BAD:P(A;;GA;;;BA)(A;;GA;;;S-1-5-21-3231263931-1371906242-1889625497-1141)S:P(AU;FA;GA;;;WD)(AU;SA;GWGX;;;WD)
(Get-PSSessionConfiguration -name Microsoft.Powershell).SecurityDescriptorSddl
# O:NSG:BAD:P(A;;GA;;;BA)(A;;GA;;;S-1-5-21-3231263931-1371906242-1889625497-1149)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)
(In each security descriptor my user is given general access to protected object).
So what security descriptor should I set to make my winrs query work for non-admin user?

Hi Bunyk,
I can not recreate the erroe you posted, and please also post the screenshoot in your convenience.
I tested with a non-domain user but has the local admin permission of the remote computer, and this worked, before running the remote cmdlet in powershell, I also configured the TrustedHosts.
In addition, the access denied could be also caused to the Protocol Filtering on the remote server, for more detailed information, please refer to this thread:
winrs error:access is denied
I hope this helps.

Permission Error when copy files into cmsdk using NFS with non admin user

Hi All,
We are using CMSDK with NFS protocol and we have created different users with ACL to control different access for users.
When we copy files into cmsdk folders using one of the admin user this works fine, even a multiple copy works fine. But when we use any non admin user , some time copy commands works but some time it throw a permission deny error. and this is happening very intermittently.
when we use ftp protocol and ftp file it's all works fine for the both admin & non admin user. Is there any limitation in using CMSDK NFS protocol
Did any one encouter any similar issue. Any pointers would be of great help.
Thanks in advance
Regards,
Navin

Hi All,
We are using CMSDK with NFS protocol and we have created different users with ACL to control different access for users.
When we copy files into cmsdk folders using one of the admin user this works fine, even a multiple copy works fine. But when we use any non admin user , some time copy commands works but some time it throw a permission deny error. and this is happening very intermittently.
when we use ftp protocol and ftp file it's all works fine for the both admin & non admin user. Is there any limitation in using CMSDK NFS protocol
Did any one encouter any similar issue. Any pointers would be of great help.
Thanks in advance
Regards,
Navin

Giving Non-Admin User Admin Privileges to One Program

Aaron19 wrote:
Unfortunately updates don't erratic on when they come out.
Are erratic?
I'm assuming the updates happen with such frequency that requiring IT to install them is a major hassle. Your other option is to find a way to script the install and push it to the required workstations.

I thought I would come to the community and ask if there is any way to give a non-admin user admin rights to one program so that he can run updates. I looked into making an elevated shortcut which worked to no avail. Unfortunately updates don't erratic on when they come out. Was just curious if there is an ability to give the user who is having problems admin privileges to this program without an admin password.
This topic first appeared in the Spiceworks Community

Using mms.cfg file to enable Autoupdate for non-Admin users

I need help in getting this to work. So far it does not.
Adobe Flash for windows 17.0.0.23
Windows 7 Enterprise - 5000 systems
Users are not administrators on systems.
The Non admin user gets prompted with a screen ( we do not want any prompts)
Then the install fails because they are not an administrator.
My mms.cfg file:
AutoUpdateDisable=0
AutoUpdateInterval=1
SilentAutoUpdateEnable=1
How do I use this or any other method to have Adobe Flash update automaticly for all users including non-admins
and give no prompts?
What are the next steps. Is there an enterprise support site or method to use for mass distributions for Flash?
Please Get back to me today before 12:00 EDT 13 Apr 2015.
Gary Pearson
401-233-6898

Hi garyp81126656,
The current mms.cfg file configuration will perform either a notification update or a background update. There are a few options to update non-admin users:
Host the background update resources locally. When using the Adobe servers for background updates there is no way to disable notification updates. By hosting the background update resources locally users will never be prompted to update.
Disable updates and deploy Flash Player updates via SCUP, SMS, or Group Policy.
You can find the various deployment options are listed in Chapter 3 of the Flash Player Administrator's Guide. The Admin Guide also contains information to license Flash Player for distribution within your organization, which is a requirement for any of the deployment methods described in the Admin Guide. Additional information is available at An outline of Flash Runtime installation options
Maria

Allow non-admins to install software?

I find it rather tedious to have to type my password every time others want to install something on the computer (which is a shared computer, by the way). Is there any way to allow a non-admin user to install software, but not have other admin priveleges?

On the screen where you're prompted for the password, find and note down the requested right. Use a program such as TextWrangler to edit the /private/etc/authorization file so that all accounts have that right.
(59954)

Allowing non-admin users to use certain programs without authenticating

Similar Messages

Maybe you are looking for