« Deep packet-inspection technology used by NSA | Main | Errors in spreadsheets are pandemic »

Implementing least privilege in Windows applications

As pointed out by the ISC's Handler's Diary, and further to the ZDNet article reporting that Microsoft considers taking admin rights from employees (link posted last Wednesday), Microsoft published Standard User Analyzer, a tool that "helps developers and IT professionals diagnose issues that would prevent a program from running properly without administrator privileges.  On Windows Vista, even administrators run most programs with standard user privileges by default, so it is important to ensure that your application does not have administrator access as a dependency.

Using the Standard User Analyzer to test your application can identify the following administrator dependencies and return the results in a graphical interface:

  • File access
  • Registry access
  • INI files
  • Token issues
  • Security privileges
  • Name space issues
  • Other issues"
Standard User Analyzer runs on Windows XP, Windows Vista and Windows Server 2003, and requires
Microsoft Application Verifier, which "helps developers identify potential application compatibility, stability, and security issues."

About

This page contains a single entry from the blog posted on May 26, 2006 11:47 PM.

The previous post in this blog was Deep packet-inspection technology used by NSA.

The next post in this blog is Errors in spreadsheets are pandemic.

Many more can be found on the main index page or by looking through the archives.