Running SbieCtrl as a different Windows user

[Yyyyyy]

Hi,

I'm trying to run a program with lesser privileges than my own Windows user account (which is member of Administrators). In general I believe I'm achieving my goals, however I am unable to control that user's sandboxes. In particular, running `runas /savecred /user:Test1 "C:\Program Files\Sandboxie\SbieCtrl.exe"`, nothing happens and I'm unable to control the sandboxes. I suspect this is due to the lesser privileges that the user account has, but adding further privileges would defeat the purpose of the setup.

Can you offer any advice on how to approach the problem?

Best regards, Yyyyyy

[Barb@Invincea]

Hello Yyyyyy,

Please have a look at the drop rights option:
https://www.sandboxie.com/index.php?DropAdminRights

Regarding runas, maybe this can help:
viewtopic.php?f=11&t=24599

Regards,
Barb.-

[Syrinx]

SBIECtrl should be able to see and manage all boxes if ran under the current user with exceptions being those set up explicitly to be applied to specific user names under Enabled=
By intentionally running it as a standard user from an admin account you are preventing it from being able to access and modify things such as the admin instance of explorer which handles the notification area/tray etc. If however you were to run as a standard user and run as admin, SBIECtrl would show up and function normally.
Simply put, I'd leave it the way it is and focus on running your non-security related software as a standard user instead.

On another note related to using runas and sbiectrl...It still has a bug
Let's say I'm running as an admin user called CURRENT
C:\Sandbox\%USER%\%SANDBOX% is set by default
When using runas a different username path is used...eg I use runas to launch calc under sandbox for TESTUSER
If you set a sandbox to delete upon close the wrong %user% path will used. It will pass CURRENT for the rmdir instead of the TESTUSER path.
So when using runas on sandboxed apps and wanting to set to delete, currently you must remove the %user% variable or it will not attempt to delete the correct path but thinks all went well.