Windows XP : Launching Applications - Creating Application-Specific Paths & Restricting Program Launches for Users

Running a Program as a Different User

Some applications—especially installation programs—might fail because the current user account has insufficient privileges to support some program operations. Similarly, a user account might have privileges that are too high to safely run a program. For either case, you can run a program as a different user with any of the following techniques:

• Use the Run As menu command— Right-click the executable file and then click Run As in the shortcut menu. In the Run As dialog box, activate The Following User and then choose a user from the User Name list. Enter the user’s Password and click OK.

• Prompt for a user— Create a shortcut to the executable file, right-click the shortcut, and then click Properties. In the Shortcut tab, click Advanced and then activate the Run with Different Credentials check box. Click OK. When you launch the shortcut, Windows XP will display the Run As dialog box so that you can choose a user.

• Use RUNAS command-line tool— You use RUNAS at the command prompt to specify the username, and Windows XP then prompts you to enter the user’s password. Here’s the basic syntax (type RUNAS /? for the complete list of switches):

     RUNAS /user:domain\user program

  /user:domain\user	The user name under which you want the program to run. Replace domain with either the computer name (for a standalone or workgroup machine) or the domain name.
  program	The full path and filename of the application. You need only use the file’s primary name if the application resides within the current folder, the %SystemRoot% folder, the %SystemRoot%\System32 folder, or a folder in the PATH variable.

Creating Application-Specific Paths

Application-specific paths enable you to launch almost any 32-bit application simply by typing the name of its executable file, either in the Run dialog box or at the command prompt. You don’t need to spell out the complete pathname. This pathless execution is handy, but it doesn’t work in the following two situations:

• 16-bit applications— These older programs don’t store the paths to their executables in the Registry.

• Documents— You can’t load a document just by typing its filename in the Run dialog box or at the command prompt unless the document is in the current folder.

To solve both these problems, and to handle the rare case when a 32-bit application doesn’t create its own application-specific path, you can edit the Registry to add a path to an executable file (an application-specific path) or to a document (a document-specific path).

In the Registry Editor, open the following key:

HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths

The App Paths key has subkeys for each installed 32-bit application. Each of these subkeys has one or both of the following settings:

Default— This setting spells out the path to the application’s executable file. All the App Paths subkeys have this setting.

Path— This setting specifies one or more folders that contain files needed by the application. An application first looks for its files in the same folder as its executable file. If it can’t find what it needs there, it checks the folder or folders listed in the Path setting. Not all App Paths subkeys use this setting.

To create an application-specific path, select the App Paths key, create a new subkey, and assign it the name of the application’s executable file. For example, if the program’s executable filename is OLDAPP.EXE, name the new subkey OLDAPP.EXE. For this new subkey, change the Default setting to the full pathname of the executable file.

You create document-specific paths the same way. (However, the document’s file type must be registered with Windows XP.) In that case, though, the Default setting takes on the full pathname of the document. Again, if you want to load the document just by typing its primary name, make sure that the new App Paths subkey uses the .exe extension.

Restricting Program Launches for Users

Windows XP has several group policies that enable any member of the Administrators group to restrict the usage of Windows programs for each logged-on user. For example, you can prevent users from running the System Configuration Utility, a program that—in the wrong hands—can do much damage to a system. You can also prevent users from accessing the command prompt (where they could start unauthorized programs) or the Registry Editor.

In the Group Policy editor, select User Configuration, Administrative Templates, System. There are five policies: