Ask HN: 如何在没有本地管理员权限的情况下运行旧版 IE/ActiveX 客户端？
4 分•作者: Servant-of-Inos•5 个月前
我们目前维护着一个非常古老的客户端-服务器架构。服务器从大量传感器和控制器收集实时数据，并将其传输到一个旧数据库中，该数据库承受着持续的大量负载（每隔几秒钟写入一次）。
问题出在客户端。它非常古老，严格要求使用 Internet Explorer，并且严重依赖 ActiveX。如果标准域用户启动浏览器，数据将无法加载，浏览器会完全卡死。只有在以本地管理员权限运行时，它才能正常运行。
给用户本地管理员权限是一个巨大的安全风险，我们无法承担。目前，我有一个变通方法正在生产中使用，它使用任务计划程序来提升这个特定应用程序的权限，而无需给用户实际的管理员密码。我在这里记录了我们正在使用的具体方法：
https://www.hiddenobelisk.com/how-to-let-a-standard-domain-user-run-one-program-as-administrator-without-giving-admin-rights/#:~:text=least%20privilege.-,Approach%202%20%E2%80%94%20Running%20Applications%20with%20Administrative%20Privileges%20Using%20Task%20Scheduler,users%20can%20simply%20double%2Dclick%20the%20shortcut%20to%20launch%20the%20application.,-Changing%20the%20Shortcut
我最近在 r/sysadmin 上发起了一个讨论，试图找到一个更干净的解决方案：
https://www.reddit.com/r/sysadmin/comments/1rm6uv4/how_do_you_let_a_standard_domain_user_run_one/
那里的普遍共识是购买昂贵的企业级 PAM（特权访问管理）解决方案，或者深入研究 Procmon。目前，我正在根据该建议使用 Procmon 分析该软件，但到目前为止，我还没有能够让客户端在没有任务计划程序变通方法的情况下工作。
我向 HN 社区提出的问题：
1) 是否有任何可靠的开源 PAM 替代方案或 Windows 权限提升工具，可以有效地处理这种“每个应用程序”的场景？
2) 在处理恶意的 ActiveX 组件时，除了明显的“文件/注册表访问被拒绝”之外，我应该在我的 Procmon 捕获中寻找哪些特定的旧行为？
3) 在没有商业企业级工具预算的情况下，您如何隔离这种硬编码的旧需求？
查看原文
We are currently maintaining a very old client-server architecture. The server collects real-time data from a large number of sensors and controllers, transmitting it to a legacy database under continuous, massive load (writes every few seconds).<p>The problem is the client side. It’s ancient, strictly requires Internet Explorer, and heavily relies on ActiveX. If a standard domain user launches the browser, the data fails to load and the browser completely hangs. It only functions correctly if run with local administrator privileges.<p>Giving users local admin rights is a massive security risk we can't take. Currently, I have a workaround running in production using Task Scheduler to elevate just this specific application without giving the user the actual admin password. I documented the specific approach we are using here:
https://www.hiddenobelisk.com/how-to-let-a-standard-domain-user-run-one-program-as-administrator-without-giving-admin-rights/#:~:text=least%20privilege.-,Approach%202%20%E2%80%94%20Running%20Applications%20with%20Administrative%20Privileges%20Using%20Task%20Scheduler,users%20can%20simply%20double%2Dclick%20the%20shortcut%20to%20launch%20the%20application.,-Changing%20the%20Shortcut<p>I recently started a thread over on r/sysadmin trying to find a cleaner solution:
https://www.reddit.com/r/sysadmin/comments/1rm6uv4/how_do_you_let_a_standard_domain_user_run_one/<p>The general consensus there was to either buy an expensive enterprise PAM (Privileged Access Management) solution, or deep-dive with Procmon. I am currently analyzing the software with Procmon based on that advice, but so far, I haven't been able to make the client work without the Task Scheduler workaround.<p>My questions for the HN community:<p>1) Are there any reliable open-source PAM alternatives or privilege elevation tools for Windows that handle this "per-app" scenario effectively?<p>2) When dealing with hostile ActiveX components, are there specific legacy behaviors (beyond obvious file/registry Access Denied) I should be looking for in my Procmon captures?<p>3) How do you isolate this kind of hardcoded legacy requirement when there is zero budget for commercial enterprise tools?