Games and Security don't mix

I have set-up a small home network (2 machines, printer,
hub) with XP and several games. Some games require Admin
rights to a.) install (can live with that) and b) Run.

I don't want the kid's profiles to have Admin rights just
to play games as some personal home accounting resides on
the same machine.
Have tried a Run As profile, but denying the profile local
login rights means it cannot execute the game (weird).
Any ideas?

Games are notorious for "requiring" administrative rights. IMHO, this is
the result of lazy/ignorant game programmers who are under pressure to
release their games on time and under budget, but don't have a deep
understanding of the security ramifications of their actions (e.g. requiring
admin access).

I can see three possible courses of action:

----------------------------------------------------------------------------
---------------
1. Figure out what the game is trying to do, and render non-admins able to
do those things.
----------------------------------------------------------------------------
---------------
Usually, games fail because they're trying to access objects (files,
registry keys, or other parts of the system) that non-admins can't access.
If you can figure out what those objects are, and grant the players access
to those objects, the game will probably work.

The bad news is that this essentially results in you reducing your security
(because although the game now runs as a less-privileged user, that user is
now effectively more powerful). It's still a better trade-off than making
the players Admins, though, because there are lots of things those users
still can't do.

More bad news is that it's often difficult to figure out what files or
registry keys the game is trying to access, so it can be an uphill battle to
gather the objects anyway.
----------------------------------------------------------------------------
---------------
2. Make the players Power Users
----------------------------------------------------------------------------
---------------
This may solve the above problem simply because Power Users have access to
most system objects. It's still a degradation in security, but not nearly
as much as making them Admins.

----------------------------------------------------------------------------
---------------
3. Quarantine the Games
----------------------------------------------------------------------------
---------------
Both of the above are obviously degradations of security. If you're
unwilling to reduce your security, the last option is to dedicate one or
more quarantined machines to gaming with the expectation that because
they're running without security, they may get damaged. Fortunately,
though, you can probably restore such machines without much trouble, just
because they don't have any essential data on them.


My advice: before you do any of the above, go to the game's website and poke
around its community (publishers, developers, and other fans)-- sometimes
people are able to come up with a comprehensive list of what permissions
need to be granted to which objects, thereby making option #1 above much
easier. Sometimes people are able to get fixes from the game developers so
that the game doesn't do whatever it does to require Admin at all, which
would negate the whole problem.

Good Luck!
-Dave

--
This message is provided "AS IS" with no warranties, and confers no rights.
This message originates in the State of Washington (USA), where unsolicited
commercial email is legally actionable (see
http://www.wa.gov/ago/junkemail).
Harvesting of this address for purposes of bulk email (including "spam") is
prohibited unless by my expressed prior request. I retaliate viciously
against spammers and spam sites.

"KenE" wrote in message
...
I have set-up a small home network (2 machines, printer,
hub) with XP and several games. Some games require Admin
rights to a.) install (can live with that) and b) Run.

I don't want the kid's profiles to have Admin rights just
to play games as some personal home accounting resides on
the same machine.
Have tried a Run As profile, but denying the profile local
login rights means it cannot execute the game (weird).
Any ideas?