Allowing a Non-Admin User to Start the EkranServer Service (by Configuring the User Permissions)
NOT AVAILABLE IN SAAS
To allow a non-admin user to start the EkranServer service, by configuring the required permissions for this user, as follows:
1. Log in as an administrator.
2. Press the Windows + R keys, and then enter "secpol.msc" in the Run window, and click the OK button.
3. The Local Security Policy window then opens.
4. In the Security Settings folder, expand the Local Policies folder, and then click on the User Rights Assignment folder (see the screenshot below).
5. In the main (right-hand) pane displaying the Policy list, find each of the following 4 policies:
• Act as part of the operating system
• Impersonate a client after authentication
• Log on as a service
• Replace a process level token
6. For each of these 4 policies, do the following:
• Right-click on the policy, and select Properties.
• In the Properties pop-up window that opens, click the Add Users or Group button.
• In the Select Users, Computers, Service Accounts, or Groups pop-up window that opens, in the Enter the object names to select field, search for the required user (i.e. the non-admin user that you want to allow to start the EkranServer service) by entering the username (or part of the username), and then click the Check Names button, add the required user, and click OK in all the pop-up windows.
NOTE: Any changes made to the user permissions of an account only take effect the next time the owner of the account logs in.
7. Press the Windows + R keys, and then enter "regedit" in the Run window, and click the OK button.
8. In Registry Editor that opens, allow the non-admin user to perform specific actions, by granting them the Full Control permission for the following 3 registry keys:
• To write events to the EventLog:
- Navigate to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Ekran System registry key, right-click on it, and select Permissions.
- In the Permissions for Ekran System pop-up window that opens, click the Add button.
- In the Select Users, Computers, Service Accounts, or Groups pop-up window that opens, in the Enter the object names to select field, search for the required user (i.e. the non-admin user that you want to allow to start the EkranServer service) by entering the user name (or part of the user name), and then click the Check Names button, and add the required user, and then click the OK button to close this popup window.
- In the Permissions for Ekran System pop-up window, select the user that you added, and then select the checkbox to allow the Full Control permission for them, and click the OK button to close this popup window.
• To write to the registry: Allow the non-admin user the Full Control permission for the HKEY_LOCAL_MACHINE\SOFTWARE\EkranSystem registry key (in a similar way as above).
• To read from and write to the registry: Allow the non-admin user the Full Control permission for the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY registry key (in a similar way as above).
9. Allow the non-admin user to perform specific actions, by granting them the Full control permission for the following 2 directories:
• To write events to the ServerLogs:
- Navigate to the C:\Program Files\Ekran System\Ekran System\ServerLogs directory, then right-click on it, and select Properties.
- In the ServerLogs Properties pop-up window that opens, select the Security tab, and then click the Edit button.
- In the Permissions for ServerLogs pop-up window that opens, click the Add button.
- In the Select Users, Computers, Service Accounts, or Groups pop-up window that opens, in the Enter the object names to select field, search for the required user (i.e. the non-admin user that you want to allow to start the EkranServer service) by entering the user name (or part of the user name), and then click the Check Names button, add the required user, and then click the OK button to close this popup window.
- In the Permissions for ServerLogs pop-up window, select the user that you added, and then select the checkbox to allow the Full control permission for them, and then click the OK button in both pop-up windows to close them.
• To use certificate-based encryption: Allow the non-admin user the Full control permission for the C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys directory (in a similar way as above).
If, after following the steps above, the access issues are not resolved for the non-admin user, the Process Monitor (Procmon) application can be used to check for any denied access, by doing the following:
1. Open the Process Monitor application.
2. Open the Process Monitor Filter (e.g. by clicking on the Filter icon on the toolbar in the top left), and then specify the conditions "Process Name is EkranServer.exe", and click the Include > Add > OK buttons.
3. Click the Clear button on the toolbar to clear the events.
4. Open the EkranServer service properties, and select Take No Action.
5. Restart the EkranServer service.
6. In Process Monitor, exclude all results except those with Access Denied, by right-clicking on a result and selecting Exclude in the context menu.
7. Grant the required permissions for each directory / registry key.