How ToIf you're a “show-me” kind of person, watch the webcast of Aaron Margosis's session from TechEd 2005: “TechNet Webcast: Tips and Tricks to Running Windows with Least Privilege ” (from Other Resources)
Allow Users To Manage File and Print SharesBy default, the ability to manage file and print shares is granted only to members of the Administrators, Power Users, and Server Operators groups. See the blog post “How to allow users to manage file and print shares without granting other advanced privileges” for how to fix this using the TweakUI power toy (from Aaron Margosis).
Change The TimeSee “Changing the system date, time, and/or time zone” for details on how to give a User account full access to the Date and Time applet (from Aaron Margosis's blog).
Change Privileges Without Logging Off and On AgainIt's a common misconception that to change privileges you have to log out of your current logon session and back into a new one with different privileges. In fact, there are some Useful Tools such as RunAs and MakeMeAdmin, that enable you to do most administration tasks while logged on interactively under a LUA account. RunAs requires a second user account and runs the specified process under this alternate account. MakeMeAdmin temporarily adds your LUA account to the local Adminstrators group. Both require you to provide an adminstrator account and password to perform administrator tasks.
Fix A Program That Requires Admin PrivsMostly you just have to pay a little more attention to how your programs are installing themslves, and occasionally go back and fix programs that don't follow the MS rules. The gist of those rules are: - After install, don't write to %systemdrive%/Program Files or %windir%
- After install, don't write to HKEY_LOCAL_MACHINE
Oh, there's a couple of others (see Developing As Non Admin), but 90% of the programs that don't work right as a non-admin are breaking one of these two rules. In either case, it's easy enough to fix prgrams that break these rules - just adjust the permissions on the appropriate files or registry keys. You can sniff these out with FileMon and RegMon from sysinternals.com (free!), usually in 10 minutes or less. Problem solved (from “Windows admins, give up your privs!”). Sometimes (only if the license agreement permits reverse engineering,) you can fix a program to work well under a non-Admin account. See my example here: http://www.leeholmes.com/blog/CrackingSoftwareToRunAsNonAdmin.aspx - Lee Holmes
Make Ctrl-C Work in a RunAs Command ShellTo interrupt a running process in a command shell spawned from RunAs or MakeMeAdmin, you have to use Ctrl-Break instead of Ctrl-C (from Aaron Margosis's blog).
Make The Calculator and Character Map Remember Their SettingsThe calculator and character map are very old applets that normally save their settings in the Windows folder. See “Remembering Calculator and Character Map Settings” for how to fix this (from Aaron Margosis's blog).
Manage Your Power SettingsSee “Managing Power Options as a non-administrator” for how to give a User account full access to the Power Options applet (from Aaron Margosis's blog).
Tell If You Have Administrator PrivilegesSee Am I Local Admin for how to work out this out with varying numbers of mouse clicks - or just run the PrivBar
Use Windows Update as a Non-AdministratorThe current versions of Windows Update (and Microsoft Update) do not work when invoked through RunAs - the desktop shell needs to be admin for these to work. Workarounds (from Aaron Margosis) - Use Automatic Updates instead (or an enterprise solution), or
- Log out, log back in as local Administrator, run Windows Update, log back out again
| 