StripMyRights

The StripMyRights was designed to be a small tool which runs applications with reduced rights. If you for instance is logged on as Administrator or another user with administrative privileges on your Windows computer, you can use StripMyRights to run for instance Internet Explorer, Outlook or other programs with the rights of an ordinary user.

In this way the security risk of being logged on with elevated privileges may be reduced.

The utility is based on the ideas of the DropMyRights tool from Microsoft, but with several features added.

If you are using a Windows computer logged on as an administrator, you are taking a risk. Especially if running Web browsers like Internet Explorer or email clients like Outlook. To lower the risk, it would be nice to be able to start Internet Explorer, Outlook and other potential risk-exposing applications in an ordinary user context.

With Windows 2000 you had to use the RunAs command, which is cumbersome. With Windows XP Microsoft introduced the API calls SaferCreateLevel and SaferComputeTokenFromLevel, which allows one to create a token with reduced rights to be used when starting new processes.

StripMyRights.exe [/D] [/DW] [/L N|C|U] {exefile} [arguments]

As the DropMyRights utility, one can choose to start new processes with one of three trust levels:

/L N - Normal user (default) Allows programs to execute as a user that does not have Administrator or Power User access rights. Software can access resources accessible by normal users. /L C - Constrained user Software cannot access certain resources, such as cryptographic keys and credentials, regardless of the access rights of the user. /L U - Untrusted user Allows programs to execute with access only to resources granted to open well-known groups, blocking access to Administrator and Power User privileges and personally granted rights. (This trust level will very seldom work with real applications...)