Launch Admin

Launch Admin (http://sourceforge.net/projects/launch-admin) is a tool for Windows XP/2K3 that allows users logged in with a limited user account (LUA) to perform administrative tasks conveniently. It is for users who want the security of a LUA account combined with the power to make “on demand” administrative changes.

Launch Admin adds an icon to the system tray and allows for routine actions, such as opening the Control Panel, to be performed within the administrative context. It can be configured to prompt for an administrator's password before each action.

Background

Limited user accounts on Windows can be awkward to use because administrative changes require the LUA user to log off/switch user and for an administrator to log on. Alternatively, Windows XP and 2K have the secondary logon “RunAs” service which can launch a program in the context of a different user. However, the profile of the RunAs administrative user, rather than the logged in LUA user, is used in this case.

To solve this problem, Aaron Margosis wrote the "MakeMeAdmin" utility (available here). This tool works by temporarily promoting a limited user to an administrator. The secondary logon service is used to open, by default, a command prompt in the context of the logged on user but with administrative privileges. MakeMeAdmin requires two passwords: the first to promote the LUA user, using an administrator's account, and then the password of the LUA user to open a new command prompt using “RunAs”. However, this process of entering passwords can become repetitive if the command prompt is closed after each administrative change is made. This is the reason for Launch Admin.

Requirements

Windows XP or Windows Server 2003 using a Limited User Account (LUA).

Notes

(1) Launch admin requires the separate process flag of Windows explorer to be enabled. To configure this, change the DWORD registry entry at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SeparateProcess to 1.

For more information, see http://blogs.msdn.com/aaron_margosis/archive/2004/07/07/175488.aspx.

(2) To configure Launch Admin to start with the "Require Password" option enabled, change the DWORD registry entry at HKEY_CURRENT_USER\Software\LaunchAdmin\RequirePasswordOnStartup to 1.

(3) The use of “PrivBar”, written by Aaron Margosis and available here, is recommended because it allows explorer windows with administrative and LUA rights to be differentiated.

How to Use Launch Admin

Firstly, you need to be logged in with a limited user account (LUA) under Windows XP. Then

(1) Open a command prompt using “MakeMeAdmin”.

(2) From this command prompt, run the LaunchAdmin.exe binary.

(3) You can now close the command prompt window. Launch Admin will continue to run in the system tray.

(Alternatively, the “MakeMeAdmin” _Prog_ variable may be modified to invoke LaunchAdmin.exe directly. In this case Step (2) is unnecessary.)

Donations

Donations are welcome! To contribute please visit http://sourceforge.net/donate/index.php?group_id=168760.

Acknowledgement

Launch Admin makes use of the CSystemTray class, developed by Chris Maunder, which is available at http://www.codeproject.com/shell/systemtray.asp

Downloading

The binary and source code for Launch Admin can be downloaded at http://sourceforge.net/projects/launch-admin

Author

Launch Admin is written by Patrick Rynhart.