How to Run Windows Processes with Limited Privileges

The most frequent recommendation for running software of dubious origin is to do it in a virtual machine. If the Windows installation has to go up in flames, at least let it be inside a contained environment. Another option is to create sandboxes with tools like Sandboxie, now free. Finally, there is the possibility of limiting the privileges of a process, or rather, forcing it to work without access to administrator resources. Our ally to achieve that is RunWithRestrictedRights, a small program that is difficult to configure but easy to use.

In these days, almost any program requests elevated privileges to function correctly. Enabling such privileges is not complicated (a right-click on the secondary button is enough to see the option), but the truth is we always run a risk, no matter how small it seems. 9 out of 10 vulnerabilities in Windows can be contained using user profiles without administrator privileges, which gives us an idea of its potential for damage if they fall into the wrong hands.

Alternatives to virtual machines and sandboxes

The first alternative is a virtual environment. A whole instance of Windows that serves as a sacrifice for malicious elements, and in the worst case, you only have to return the image to a previous state. The second is a sandbox, something similar to Sandboxie. The third is to limit the privileges of the executable on the metal, and that's when RunWithRestrictedRights comes in, a small program distributed by Core Technologies.

Configuring RunWithRestrictedRights

The configuration requires some previous steps. Basically, the profile needs to be able to adjust memory quotas for a process and replace a process-level token. This is achieved through the local group policies (gpedit.msc) by entering "Computer Configuration - Windows Settings - Security Settings - Local Policies - User Rights Assignment", and in the aforementioned permissions, add the "Administrator" users and your profile's. Restart the system to apply the changes. (Editor's note: If you use a Home edition of Windows and gpedit.msc is not available, you will need to find a way to enable it, or locate the relevant Registry keys.)

Using the command line

If everything goes well, the rest is a matter of opening a command prompt with elevated privileges, going to the folder where RunWithRestrictedRights is stored, and using the command "RunWithRestrictedRights.exe", followed by the process to limit. The text will indicate that the program ran with medium integrity, and its corresponding PID. The most important switches are -l and -p, which further reduce the amount of rights. From here on, it depends on each process. Some will work fine, and others will throw errors of all kinds.

RunWithRestrictedRights is not exactly a tool for novices, but if you ever need to constrain a process and restrict its use of elevated privileges, it should serve you well.

Official download

Official site and download: Click here