InfoWorld
Lead with Knowledge
HOME/ SITEMAP
SUBJECT INDEXES
App Development
Broadband
Business Intell.
Business News
Business Strategies
Careers & Mgmt
Collab. Software
Content Mgmt
CRM
Database
E-Business
End-User Apps
End-User Hardware
Enterprise Apps
Ethics
Government
Licensing
Middleware
Mobile Computing
Networking
Online Community
Operating Systems
Processors
Security
Servers
Storage
Telecomm.
Web Services
Web Technologies
Wireless
XSPs
NEWS
CTO ZONE
TEST CENTER
FEATURES
COMMUNITY
OPINIONS
RESEARCH
EVENT
WEBCASTS
ABOUT InfoWorld
ABOUT US
About InfoWorld
Services
Advertise
Contact us
Employment
WHITE PAPERS

Learn to secure your PCs from new and unknown hacker attacks.

Free IDC White Paper - Discover Secure File Sharing for the Enterpriseattacks.
SEARCH:  
Home  //  Article
Print Article    Email Article
Window Manager
Brian Livingston
Service Pack 1 for Windows 2000 stops the useful 'Run As' trick from working

MANY OF MY READERS are using Windows 2000, or thinking of upgrading to it. For these pioneers, I wrote in my Aug. 14 column that Windows 2000's recommended new Service Pack 1 has one significant glitch: SP1 disables network and Internet access if you're using a personal firewall product, such as ZoneAlarm or BlackICE, with security set on "High."

(Both firewall companies already have patches that restore their products' full functionality under Windows 2000 with SP1. To get the patches, see www.zonelabs.com/download_patch.htm or www.netice.com/html/blackice_defender_update.html.)

I've found a new wrinkle when installing SP1. The service pack disables Windows 2000's "Run As" trick with Windows Update. Fortunately, I'll show you how to get it back.

Some of you may be scratching your head, thinking, "What the heck is 'Run As'?"

Although the Run As feature is fully supported by Microsoft, it's a little-known trick that can be useful to a wide variety of Windows 2000 administrators. Let's take a minute to review what this feature does.

Microsoft built Run As -- or secondary logon -- into Windows 2000 to allow you to run your system more securely.

In a nutshell, users who have administrative privileges on a Windows 2000 machine shouldn't be logged on constantly as an administrator. Instead, you should create yourself a user account with more limited privileges. You then log on as administrator only when necessary to run programs that require administrative privileges.

You need these two accounts to protect your system. You might unintentionally run a malicious program that is a "Trojan horse" for a virus or zombie. Or you might visit a Web site that secretly launches a malicious program on your PC. If you're logged on with administrative privileges when either of these happen, the Trojan horse has full access to your PC. It can install software and access files with the same privileges you have as administrator.

But if you're logged on as a user with limited privileges, the Trojan horse will be more restricted. It might even trigger an error message to warn you something is amiss.

There's one problem with the two-user approach: People dislike taking the time to log off as an ordinary user, log back on as administrator, then log off and back on again.

The Run As trick allows you to log on to your Windows 2000 system as an ordinary user, but start at any time a single program with greater administrative privileges.

A good example is the Windows Update feature. This program typically appears on the Windows 2000 Start menu. Under Windows 2000, however, some aspects of Windows Update require administrative privileges.

To access Windows Update while logged on as an ordinary user, hold down the Shift key while right-clicking Windows Update in the Start menu. You should see "Run As ... " on the context menu that appears.

Click this item and you are presented with a dialog box that lets you log on with your administrative name and password. As long as the new program remains open, it runs with your administrative privileges, not the more restricted privileges of the user account.

The installation of Windows 2000 SP1 eliminates your ability to use Run As with Windows Update. Until Microsoft has a service pack to fix the service pack, here's how to work around the problem:

Step 1. Click the Start button, then hold down Shift as you right-click the menu item for Internet Explorer. Click Run As and run IE with administrative privileges.

Step 2. In IE, pull down the Tools menu, then click Windows Update from there.

This work-around suggests the power of Run As. For example, you can create a shortcut to the Computer Management console, then right-click while holding the Shift key to run any utility as an administrator.

For further details on how to use Run As in various scenarios, see support.microsoft.com/support/kb/articles/q225/0/35.asp.

For more information on how SP1 interferes with Run As, see support.microsoft.com/support/kb/articles/q268/0/21.asp.

Reader Andrew Hollister will receive a free copy of Windows 2000 Secrets for being the first to send me a tip I printed.


Brian Livingston 's latest book is Windows 2000 Secrets (IDG Books). Send tips to brian_livingston@infoworld.com. He regrets that he cannot answer individual questions.



RELATED SUBJECTS

Operating Systems
MORE >
SUBSCRIBE TO:    E-mail Newsletters  InfoWorld Mobile InfoWorld Magazine
Home  //  Article Print Article    Email Article
Back to Top
 ADVERTISEMENT
 

SPONSORED LINKS

Introducing Primus Quick Resolve. Click to download a fact sheet.
Download the J.D. Edwards CRM white paper. Visit jdedwards.com/crmpaper
Gateway: Your Reliable IT Provider of Business Technology Solutions
Learn to secure your PCs from new and unknown hacker attacks.
Get FREE Hurwitz Report: Control Your App Dev Costs with TogetherSoft!

SUBSCRIBE
E-mail Newsletters
InfoWorld Mobile
Print Magazine

Web-based training
ABOUT INFOWORLD  |  SITE MAP  |  EMPLOYMENT  |  PRIVACY  |   CONTACT US

Copyright 2001 InfoWorld Media Group, Inc.