4

Do I really need local admin permissions on my own laptop on order to access MMC to check/verify things like asset ownership for a certain object, group structure, etc ?

On the internet found contradicting information so I was wondering if there there is a possibility to access this information without them.

1

mmc.exe can be run with limited user permissions; this just prevents it from doing most of the things you might want it to do. For example, with non-admin permissions, you can edit your personal certificate store, but you will have read-only access to the system (machine) certificate store. Some snap-ins will be completely useless with limited permissions (for example, diskmgmt.msc, the Disk Management snap-in, requires connecting to the Virtual Disk Service and I don't believe you can do that without elevated privileges; try running the command-line equivalent diskpart.exe and if you don't elevate it'll return Access is denied).

Basically, it depends what the snap-in does. If it supports both user-specific and system-wide settings, there's a decent chance you'll be able to use it (for the current user only) without elevated privileges. If it makes changes to some data store directly (for example, by editing the registry or file system using the relevant APIs) or indirectly (for example, certificates are typically stored in the registry, even though you usually access them through crypto APIs that call the required registry APIs behind the scenes), then you can do whatever the ACLs on that data store permit your current user to do (for example, read-only access to system-wide certificates). On the other hand, if it makes some kind of inter-process communication, then you won't be able to use the snap-in at all if the IPC channel requires more privileges than you have. Similarly, if it requires an NT privilege (for example SeImpersonatePrivilege, which lets you tell the OS to pretend you're a different user), then of course you can't use it if you don't have that privilege.

0

The MMC snap in is part of the ADMIN console, so it inherently needs admin privileges. Otherwise, you would have a security hole as someone with user-level access could install malicious certs and you would have no way of knowing if your connections were secure.

  • 3
    I don't think this argument is water-tight: for example, if, when run as a low privilege user, the Certificates snap-in only showed your own account's certificates then there's no security issue. This is only a problem if you can edit the certificates of other accounts. Can you provide evidence that MMC actually does or does not work the way you describe? – Mike Ounsworth Feb 13 '18 at 14:37
  • @MikeOunsworth Agreed. It depends on what is being launched within the MMC. Natively no admin privileges are required. – user2320464 Apr 14 '18 at 23:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.