Sat, Apr 23 2005 22:33
bradley
How to run Quickbooks under user mode
I finally got around to documenting the needed changes to get Quickbooks running under usermode.
Quickbooks in usermode for Stand alone machines
Quickbooks in usermode using Group policy
http://www.threatcode.com gives you the exact official supported info but keep in mind that QUICKBOOKS 2007 now supports non admin rights.
The process is basically that you use tools like Filemon, Regmon and Inctrl5 to identify those 'sticking' places in the file permissions and registry. Now you have to open them up.
Unfortunately you have to open up ClassesRoot unless you want to spend the rest of your life wacking the heck out of that thing since Intuit uses guid keys in that section. (I have included the new and improved instructions that only opens up exactly what is needed) If you want to see the printout of regmon's report on Quickbooks [this is the Enterprise version being attempted to be run in user mode] you can see this spreadsheet here.
Steve Friedl helped to distill that down to basically two file permissions and two reg keys:
I personally think it shouldn't be as hard as this to run in user mode around Quickbooks. A consultant emailed me that they had installed QB Enterprise version and their customer didn't want to run with the Salesmen with local Admininstrator rights on their computers [bravo for a company wanting to ensure their desktops are part of the security fabric of their network] and when the Consultant contacted Intuit, Intuit's support said the “fix” to not run with local adminstrator rights was to:
“connect a member server to the SBS system. Then put QB's data there, with no Active Directory running on the member server. “
Yup, you heard that right... they suggested a member server with 'no AD' as the fix for running without administrator rights.
First off, why in the world would you not want a server or a workstation stuck firmly in active directory, to ensure you have control of that server, and secondly, how in the world do they think that installing this on a member server is going to solve the desktop issue of permissions and user rights?
I love this KB article where it says the issue of user mode is a top support issue and don't you worry your little head because you are only making them 'standard users' [aka power users... you know...that category of users that the security folks call “admin lite”]. You remember that lovely KB article that I love to point out that says: A member of the Power Users group may be able to gain additional rights and permissions on your computer, and may be able to gain complete administrative credentials. A member of the Power Users group may also be able to expose your computer to other security risks, such as running a virus or running a Trojan horse program.
Remember what it says at the bottom?
That's right class, that Quickbooks Enterprise 2005 program is not certified to run on Windows 2000 in the year 2005. Maybe it's going to take legislation over Personal Identity Information before vendors 'get security', because honestly, it's accounting applications that seemingly are the worst.
One more note... due to how QB is 'all over' the ClassesRoot tree, if you want to have a QB that will allow auto updates you either have to open up ClassesRoot or spend the rest of your life editing that registry. Bottom line folks, Quickbooks, in my opinion, is written in an insecure manner. But until WE the marketplace start demanding that they change it, it will continue to be done in this manner.
Oh and I have to fess up on two blonde things I did. In order to do the screen shots for the standalone PC I wanted to do it on a 'virgin laptop' so I took my tablet PC and flipped my normal operating account into user mode. Then I proceeded to somehow forget the 'real' Administrator's password. Oh yeah.. cute, huh! Not to fear though, I just downloaded the reset cdrom burned in the iso image to make a bootable cdrom, booted from the cdrom and reset the password. Now for the other blonde thing I did. Notice this how-to isn't on the www.threatcode.com web site? Yeah... while I have the domain parked, I forgot to renew the site with webhost4life. Oh well, it will be back online probably Monday when their accounting department opens back up.
Filed under: Security