Setting apps for admin access?

Hi,

Windows 8.1 Home

This is an odd one, at least to me. The current versions of iTunes
require administrative access in order to download purchased items. Why
they did that is a puzzler, but running as admin is the only thing that
enabled the downloads to succeed. I do not want to have to "run as
administrator", since non-admin users can't do that without the
password, which pretty much defeats the concept of security. Is it
possible to set admin. access for an individual app (e.g. iTunes) when
accessed via a user (non-administrator's) account?

--
Best regards,

Neil

Neil wrote:
Hi,

Windows 8.1 Home

This is an odd one, at least to me. The current versions of iTunes
require administrative access in order to download purchased items. Why
they did that is a puzzler, but running as admin is the only thing that
enabled the downloads to succeed. I do not want to have to "run as
administrator", since non-admin users can't do that without the
password, which pretty much defeats the concept of security. Is it
possible to set admin. access for an individual app (e.g. iTunes) when
accessed via a user (non-administrator's) account?


"If iTunes repeatedly prompts you to authorize your computer"

https://support.apple.com/en-ca/HT203160

I guess we can't hope to have them explain in English
why all that is necessary. There are certainly a
few "bone headed" suggestions there. Disabling UAC
to solve an application design issue, isn't exactly
all that clever. It's like saying you should
remove your seatbelt, so you can exit the
vehicle easier - through the windshield.

Paul

Neil wrote:
Hi,

Windows 8.1 Home

This is an odd one, at least to me. The current versions of iTunes
require administrative access in order to download purchased items. Why
they did that is a puzzler, but running as admin is the only thing that
enabled the downloads to succeed. I do not want to have to "run as
administrator", since non-admin users can't do that without the
password, which pretty much defeats the concept of security. Is it
possible to set admin. access for an individual app (e.g. iTunes) when
accessed via a user (non-administrator's) account?


Fyi...if you are using Win8.1 the first account you created on first use
(retail install or OEM pre-install) was an Admin account. Ensure you
authorize the computer and purchase items from that account. Standard
accounts will then function to play purchased music.


--
....winston
msft mvp consumer apps

....winston‫ wrote:
Neil wrote:
Hi,

Windows 8.1 Home

This is an odd one, at least to me. The current versions of iTunes
require administrative access in order to download purchased items. Why
they did that is a puzzler, but running as admin is the only thing that
enabled the downloads to succeed. I do not want to have to "run as
administrator", since non-admin users can't do that without the
password, which pretty much defeats the concept of security. Is it
possible to set admin. access for an individual app (e.g. iTunes) when
accessed via a user (non-administrator's) account?


Fyi...if you are using Win8.1 the first account you created on first use
(retail install or OEM pre-install) was an Admin account. Ensure you
authorize the computer and purchase items from that account. Standard
accounts will then function to play purchased music.



Do you understand the need for an Admin account ? ?

Why is that necessary ?

Paul

On 10/31/2015 3:41 AM, ...winston‫ wrote:
Neil wrote:
Hi,

Windows 8.1 Home

This is an odd one, at least to me. The current versions of iTunes
require administrative access in order to download purchased items. Why
they did that is a puzzler, but running as admin is the only thing that
enabled the downloads to succeed. I do not want to have to "run as
administrator", since non-admin users can't do that without the
password, which pretty much defeats the concept of security. Is it
possible to set admin. access for an individual app (e.g. iTunes) when
accessed via a user (non-administrator's) account?


Fyi...if you are using Win8.1 the first account you created on first use
(retail install or OEM pre-install) was an Admin account. Ensure you
authorize the computer and purchase items from that account. Standard
accounts will then function to play purchased music.

The admin account on this computer is only used for administrative
purposes. The other accounts are user accounts, and there is no problem
making _purchases_ from iTunes with those accounts. You just can't
download those purchases without admin access, which is puzzling. Since
there are no restrictions for downloading from other sources, why should
iTunes be any different when the risk is the same either way?

I was told by the "genius" that it was possible to set admin access for
a single app in Win8.1, but "he didn't know how" to do it, so I thought
I'd ask here, since I've never heard of such a capability in any version
of Windows.

--
Best regards,

Neil

On 10/30/2015 11:53 PM, Paul wrote:
Neil wrote:
Hi,

Windows 8.1 Home

This is an odd one, at least to me. The current versions of iTunes
require administrative access in order to download purchased items.
Why they did that is a puzzler, but running as admin is the only thing
that enabled the downloads to succeed. I do not want to have to "run
as administrator", since non-admin users can't do that without the
password, which pretty much defeats the concept of security. Is it
possible to set admin. access for an individual app (e.g. iTunes) when
accessed via a user (non-administrator's) account?


"If iTunes repeatedly prompts you to authorize your computer"

https://support.apple.com/en-ca/HT203160

I guess we can't hope to have them explain in English
why all that is necessary.

Probably because there isn't a good explanation in any language why this
should be necessary. It's not like one is installing an app when they're
just downloading the music that they've purchased. If Apple is concerned
about the security risks of the media they sell, they should tackle that
on their end.

There are certainly a
few "bone headed" suggestions there. Disabling UAC
to solve an application design issue, isn't exactly
all that clever. It's like saying you should
remove your seatbelt, so you can exit the
vehicle easier - through the windshield.

I think Apple has put a bullet in their foot. It would be less risky to
just give the user account admin level. I'm not doing that, either.

--
Best regards,

Neil

Neil wrote:

I was told by the "genius" that it was possible to set admin access for
a single app in Win8.1, but "he didn't know how" to do it, so I thought
I'd ask here, since I've never heard of such a capability in any version
of Windows.


Auto-elevation is available to Windows applications,
but not to user programs, if I understand what is
written here.

https://technet.microsoft.com/en-us/...09.07.uac.aspx

The first account you create on your Windows install,
is made a member of the Administrators group. You could
try making each user account a member of the Administrators
group. There are also more restrictive power groups to
add a user to. Such as a Backups group, which allows
a limited user to run backup software such as Macrium.
The purpose of that, is the Backup group permission
allows a user to read files for the purposes of backing
them up. Rather than for general access.

You can set a tick box on an application to request
manual elevation, but I presume this would present
a UAC prompt ?

http://www.tekrevue.com/tip/always-r...administrator/

And if you consider that tick box
to be a "hint", apparently Microsoft also requests
elevation for programs that have certain keywords in
the name, rather than just consulting a manifest file
to determine what elevation level to apply. Applications
can have an internal manifest, an external manifest file,
as well as Windows doing stuff based on the application
name containing keywords ("...setup...").

http://superuser.com/questions/24631...doesnt-need-it

http://superuser.com/questions/10297...h-admin-rights

*******

I think it would be better to start with an exact
error message, because at least one iTunes problem
relates to the setting up of an iTunes account,
and not checking the email account for the
verification message, then attempting to download
content. A bogus "administrator" message is presented,
when in fact all that is wrong is the account
setup procedure was not finished by the user.

So before bashing the controls on the application,
I'd want to make sure that some response is not
being improperly interpreted. (It's an "Apple"
message rather than a "Windows" message.)

*******

Any time an iTunes problem comes up, I keep
coming away from the thread feeling "these people
don't know how to write Windows software". I own
both Macs and PCs here, and when it comes to their
own software, they seem to have a clue. But
so many things they do with their Windows version
just give me a continual vague uneasy feeling.
Plenty of developers seem to write good Windows
software, and Apple isn't one of them. And
it's almost as if they want the experience to be
miserable, rather than it being an accident.

Paul

On 10/31/2015 3:33 PM, Paul wrote:
Neil wrote:

I was told by the "genius" that it was possible to set admin access
for a single app in Win8.1, but "he didn't know how" to do it, so I
thought I'd ask here, since I've never heard of such a capability in
any version of Windows.


Auto-elevation is available to Windows applications,
but not to user programs, if I understand what is
written here.

https://technet.microsoft.com/en-us/...09.07.uac.aspx

First, thanks for digging into this. It certainly has a lot of
implications, and after reading through these pieces, I'm not convinced
that it is a good idea to implement any of them for iTunes.

[...]
I think it would be better to start with an exact
error message, because at least one iTunes problem
relates to the setting up of an iTunes account,
and not checking the email account for the
verification message, then attempting to download
content. A bogus "administrator" message is presented,
when in fact all that is wrong is the account
setup procedure was not finished by the user.

So before bashing the controls on the application,
I'd want to make sure that some response is not
being improperly interpreted. (It's an "Apple"
message rather than a "Windows" message.)

There is no Windows UAC flag requesting administrative access to allow
the program to make changes to the computer. All that happens is an
Apple-generated pop-up message about "authorization" with a suggestion
to check the status of the network connection. Going through the
Apple-recommended procedures results in a loop, returning to the same
pop-up. Only running as administrator works.

I have some idea of what iTunes is doing that would require admin
privileges, but I have yet to confirm my suspicions. The bottom line is
that iTunes is merely downloading media content, making systemic changes
should not be required.


*******

Any time an iTunes problem comes up, I keep
coming away from the thread feeling "these people
don't know how to write Windows software". I own
both Macs and PCs here, and when it comes to their
own software, they seem to have a clue. But
so many things they do with their Windows version
just give me a continual vague uneasy feeling.
Plenty of developers seem to write good Windows
software, and Apple isn't one of them. And
it's almost as if they want the experience to be
miserable, rather than it being an accident.

Paul

I wouldn't be at all surprised if your notion turns out to be correct.
I've also had both Macs and PCs for decades, and realize that nothing is
even close to being perfect. But, Apple's tactic of writing Windows
software with this type of conceptual flaw will not sell me more Apple
products.

--
Best regards,

Neil

"Neil" wrote:
On 10/30/2015 11:53 PM, Paul wrote:
Neil wrote:

Windows 8.1 Home

This is an odd one, at least to me. The current versions of iTunes
require administrative access in order to download purchased items.
Why they did that is a puzzler, but running as admin is the only thing
that enabled the downloads to succeed. I do not want to have to "run
as administrator", since non-admin users can't do that without the
password, which pretty much defeats the concept of security. Is it
possible to set admin. access for an individual app (e.g. iTunes) when
accessed via a user (non-administrator's) account?

"If iTunes repeatedly prompts you to authorize your computer"

https://support.apple.com/en-ca/HT203160

I guess we can't hope to have them explain in English
why all that is necessary.

Probably because there isn't a good explanation in any language why this
should be necessary. It's not like one is installing an app when they're
just downloading the music that they've purchased. If Apple is concerned
about the security risks of the media they sell, they should tackle that
on their end.

I wouldn't be surprised to find that the original design used the program
directory (or perhaps some other system folder, like C:\Windows\Temp) as a
staging point for the download, and nobody responsible for the program
bothered to notice the consequences when UAC was introduced in Vista and the
system folders went off-limits for routine writing.

Sadly, it's not just consumer applications that are guilty of that
stupidity. The Remedy help desk ticket manager - used in many large
enterprises - by default used the program folder (in C:\Program Files) to
hold the current user's working files. I read the riot act to the Remedy
developers over that point, but never saw any changes to that problem. (My
POE no longer uses Remedy, although not for that reason.)

Joe

On 11/2/2015 8:56 PM, Joe Morris wrote:
"Neil" wrote:
On 10/30/2015 11:53 PM, Paul wrote:
Neil wrote:

Windows 8.1 Home

This is an odd one, at least to me. The current versions of iTunes
require administrative access in order to download purchased items.
Why they did that is a puzzler, but running as admin is the only thing
that enabled the downloads to succeed. I do not want to have to "run
as administrator", since non-admin users can't do that without the
password, which pretty much defeats the concept of security. Is it
possible to set admin. access for an individual app (e.g. iTunes) when
accessed via a user (non-administrator's) account?

"If iTunes repeatedly prompts you to authorize your computer"

https://support.apple.com/en-ca/HT203160

I guess we can't hope to have them explain in English
why all that is necessary.

Probably because there isn't a good explanation in any language why this
should be necessary. It's not like one is installing an app when they're
just downloading the music that they've purchased. If Apple is concerned
about the security risks of the media they sell, they should tackle that
on their end.

I wouldn't be surprised to find that the original design used the program
directory (or perhaps some other system folder, like C:\Windows\Temp) as a
staging point for the download, and nobody responsible for the program
bothered to notice the consequences when UAC was introduced in Vista and the
system folders went off-limits for routine writing.

Sadly, it's not just consumer applications that are guilty of that
stupidity. The Remedy help desk ticket manager - used in many large
enterprises - by default used the program folder (in C:\Program Files) to
hold the current user's working files. I read the riot act to the Remedy
developers over that point, but never saw any changes to that problem. (My
POE no longer uses Remedy, although not for that reason.)

Although iTunes uses a folder in C:\Music\iTunes for downloads, for some
reason it sets the folder properties to read-only afterwards. I suspect
that admin privileges are required (and certainly should be, if they're
not) to enable an app to alter folder properties. The question is why
iTunes would do such a thing, since it does not require admin privileges
for the *user* to alter those folder properties.

--
Best regards,

Neil

On 11/3/2015 6:56 PM, Paul wrote:
[...]
Neil wrote:
Although iTunes uses a folder in C:\Music\iTunes for downloads, for
some reason it sets the folder properties to read-only afterwards.
[...]
One other detail, is the C:\Music\iTunes bit. I can find
references to people using that when moving their music,
but more of the documentation refers to the material
as being in C:\users\username tree instead. Where you
own that folder, and so a program you start, would have
matching permissions.

[...]

You are right, the \Music\iTunes and its sub-folders are in the
c:\users\username tree. Perhaps others have "shortcut" that location in
the same manner that I did? ;-)

--
Best regards,

Neil

Neil wrote:
Hi,

Windows 8.1 Home

This is an odd one, at least to me. The current versions of iTunes
require administrative access in order to download purchased items. Why
they did that is a puzzler, but running as admin is the only thing that
enabled the downloads to succeed. I do not want to have to "run as
administrator", since non-admin users can't do that without the
password, which pretty much defeats the concept of security. Is it
possible to set admin. access for an individual app (e.g. iTunes) when
accessed via a user (non-administrator's) account?

The admin account started some time ago - iirc Win7 era in iTunes
version 11. The requirement isn't all Windows or iTunes...the Store is
the vehicle that requires the admin pre-requisite and computer
authorization for purchase and download of media content.



--
....winston

Ken1943 wrote:
On Wed, 4 Nov 2015 08:51:16 -0800, "...winston"
wrote:

Neil wrote:
Hi,

Windows 8.1 Home

This is an odd one, at least to me. The current versions of iTunes
require administrative access in order to download purchased items. Why
they did that is a puzzler, but running as admin is the only thing that
enabled the downloads to succeed. I do not want to have to "run as
administrator", since non-admin users can't do that without the
password, which pretty much defeats the concept of security. Is it
possible to set admin. access for an individual app (e.g. iTunes) when
accessed via a user (non-administrator's) account?

The admin account started some time ago - iirc Win7 era in iTunes
version 11. The requirement isn't all Windows or iTunes...the Store is
the vehicle that requires the admin pre-requisite and computer
authorization for purchase and download of media content.

If I have a problem, I right-click on the exe file security
Compatibility Check box for run as admin. This can also be done with
the shortcut. It has been a very long time since I needed to do that.


Ken1943

If elevation meets the iTunes Store constraint for admin account
privilege on an authorized iTunes device with an iTunes signed on
account to purchase content then you should be good to go.


--
....winston

On 11/4/2015 12:34 PM, ...winston wrote:
Ken1943 wrote:
On Wed, 4 Nov 2015 08:51:16 -0800, "...winston"
wrote:

Neil wrote:
Hi,

Windows 8.1 Home

This is an odd one, at least to me. The current versions of iTunes
require administrative access in order to download purchased items. Why
they did that is a puzzler, but running as admin is the only thing that
enabled the downloads to succeed. I do not want to have to "run as
administrator", since non-admin users can't do that without the
password, which pretty much defeats the concept of security. Is it
possible to set admin. access for an individual app (e.g. iTunes) when
accessed via a user (non-administrator's) account?

The admin account started some time ago - iirc Win7 era in iTunes
version 11. The requirement isn't all Windows or iTunes...the Store is
the vehicle that requires the admin pre-requisite and computer
authorization for purchase and download of media content.

If I have a problem, I right-click on the exe file security
Compatibility Check box for run as admin. This can also be done with
the shortcut. It has been a very long time since I needed to do that.


Ken1943

If elevation meets the iTunes Store constraint for admin account
privilege on an authorized iTunes device with an iTunes signed on
account to purchase content then you should be good to go.

That doesn't solve the problem of non-admin users (lacking the admin
password) being able to d/l their media purchases. If it weren't for the
"Apple genius" suggesting that elevation could be accomplished on
individual app basis under Win8.1, I wouldn't have expected a solution.

--
Best regards,

Neil

Ken1943 wrote:
On Wed, 4 Nov 2015 09:34:06 -0800, "...winston"
wrote:

Ken1943 wrote:
On Wed, 4 Nov 2015 08:51:16 -0800, "...winston"
wrote:

Neil wrote:
Hi,

Windows 8.1 Home

This is an odd one, at least to me. The current versions of iTunes
require administrative access in order to download purchased items. Why
they did that is a puzzler, but running as admin is the only thing that
enabled the downloads to succeed. I do not want to have to "run as
administrator", since non-admin users can't do that without the
password, which pretty much defeats the concept of security. Is it
possible to set admin. access for an individual app (e.g. iTunes) when
accessed via a user (non-administrator's) account?

The admin account started some time ago - iirc Win7 era in iTunes
version 11. The requirement isn't all Windows or iTunes...the Store is
the vehicle that requires the admin pre-requisite and computer
authorization for purchase and download of media content.

If I have a problem, I right-click on the exe file security
Compatibility Check box for run as admin. This can also be done with
the shortcut. It has been a very long time since I needed to do that.


Ken1943

If elevation meets the iTunes Store constraint for admin account
privilege on an authorized iTunes device with an iTunes signed on
account to purchase content then you should be good to go.

I don't use iANTHING


Ken1943

Then your ealier comment may not apply to the op's iTunes question or
mine which was specific to iTunes.

--
....winston