Getting rid of shared sign in accounts

[jmak]

We have quite a lot of specialist equipment where a Windows PC is controlling it and the software is installed in a user context. Some of these are set up by the equipment suppliers.

 

The expectation is that all users login to the same account, which obviously didn't meet our security requirements.

 

Is there any concept of a single account that multiple users have authority to use, similar to the way a shared mailbox works?

[TechMonkey]

You could set it up as a Kiosk, with only the single piece of software allowed to run and everything else locked down. Not sure how the software will like that though.

[dmj]

Is there any concept of a single account that multiple users have authority to use, similar to the way a shared mailbox works?

You're describing something very common in Unix/Linux systems.

 

You might be able to do something like a shortcut to

 

[color=#202124][font=&amp]runas /user:USERNAME “C:\path\to\Program.exe”[/font][/color]

Edited December 5, 2023 by dmj

[jmak]

You could set it up as a Kiosk, with only the single piece of software allowed to run and everything else locked down. Not sure how the software will like that though.

I don't think that will work for this scenario unfortunately.

[penfold]

Not quite used in relation to specialist equipment. But when we had an issue with software running because it needed to be run as "admin", we installed the software and then ran it to check where it was trying to access. It turns out there were a few folders and registry places it needed to read for it to run. Once we had that, we setup GPP to allow read access to specific groups who would be logging in to specific machines. If the user was not in the correct group or machine was not in the correct OU then the software didn't run. Move them into the correct groups and it was fine. Took some time to get he settings, but then it was more secure than giving out admin rights. Maybe you can see where the software is failing to see if it is permissions based?

 

Otherwise, an easier solution maybe to contact the supplier and inform then that you need the installation to be available for all users and see if they can provide you with the installation media/instructions to install per machine rather than a single user?

[dmj]

If my suggestion doesn't work off the bat you might need to give the logged in users permission on the service account home directory and registry.

[DavR]

This may not be the route you want to, or are able, to take, but my first thought would be to looking at getting the software reinstalled in the computer, rather than user context, if necessary with its own service account.

 

I am aware this might not work in all scenarios, though!

[jmak]

This may not be the route you want to, or are able, to take, but my first thought would be to looking at getting the software reinstalled in the computer, rather than user context, if necessary with its own service account.

 

I am aware this might not work in all scenarios, though!

I think we're going to need multiple solutions - it's quite a complicated environment. Also, users have been used to doing whatever is easiest for them and never pushing back on suppliers. Some of the equipment has clearly had a lot more thought spent on the hardware than the software. And some of the equipment is critical, but comes from an era when security was prioritised less.

 

Management is onside, but there's a lot to do.

[DavR]

I think we're going to need multiple solutions - it's quite a complicated environment.

 

It sounds like it! I guess it's going to be case by case solution for each instance.

 

Best of luck with it all. Even with management support, no-one likes the IT guy when they're telling them to change "the way it's always been" for security reasons!