Allow MediaPortal to run as a non-Administrator users (without granting Permissions)

[palswim]

Started on: 2007-12-06
last update: 2007-12-06

Summary:
MediaPortal requires Full Control on a least some of the files and folders in the installation directory. Instead, use the User Profiles (and "All Users" profile) to store data.

Area:
MediaPortal installation/configuration/administration

Description:
On my Media PC, I have created a limited (non-Administrator) user to use MediaPortal and play media. Basically, the user has this and only this function to perform. The user has access to all of the files he would need to play if he used Windows Explorer to play the media.

But MediaPortal uses its installation directory to store data. It took a while for me to figure out why I kept receiving warnings and errors while using it. But finally, I gave my user "Full Control" privileges in the MediaPortal directory and then MediaPortal worked like a charm. The problem is: I don't want my user to have full control anywhere in the "Program Files" directories. But in addition to purity in permissions, I don't want to user to have the ability to delete the MediaPortal software, which he will have with Full Control. So, whoever wants to use my Media Center (roommates, etc.), knowingly or unknowingly can delete the MediaPortal software.

Another approach I tried involved figuring out exactly which files MediaPortal wants to change during normal operation. I gave my user full control on the "logs" directory and some of the XML configuration files. But when I installed an update to MediaPortal, it again gave me errors and the like, meaning it either re-set the permissions or added new files to which it needs access. So, I also don't want to hunt down on which files I need to set permissions.

The improvement I would love to see would distinguish three types of options: Global, Default, and User. Global options would apply to every instance of MediaPortal with any user (Administrator or not) would run. MediaPortal would read the Global options from the "All Users" profile. Default options also would reside in the "All Users" profile, and any option that a specific user has not set would come from the Default option value. User options would exist in the specific user's profile and would only apply to MediaPortal instances which the specific user runs. (Also, MediaPortal would probably keep logs in the user profile as well.)

We could further separate the options into Local (system-specific) and Roaming (Windows Vista uses these terms; XP uses "%USERPROFILE%\Application Data\" for Roaming and "%USERPROFILE%\Local Settings\Application Data\" for Local), but I don't know if we need to do that. Regardless, Windows has decent-to-use APIs for determining all of these directories.

As far as how a user would configure these options, I haven't completely thought this through. Perhaps, we could keep the "Configuration.exe" from the MediaPortal installation directory and have that configure the Global and Default options. Only a user who has write access to the "All Users" profile (access to the MediaPortal data directory, at least) could use this application (other users receive an error if they try to run it). Then, we could have another executable (or a switch to pass into "Configuration.exe" - "-user [username]" perhaps, and default to current user if the user omits the "[username]"). This application would only change User options.

All this implementation suggesting runs secondary to the core issue, which is: Non-Administrators should have the ability to run MediaPortal without special permissions.


Regardless, MediaPortal has served my needs very well and I really appreciate the product. I know how development on free software goes, and if I happen upon some free time, I will try to contribute some code. Keep up the good work guys!

[infinityloop]

I am using MediaPortal 0.2.3.0 on an VISTA Ultimate system with the default user and UAC on.
no problems so far by the limited rights.

[palswim]

I run MediaPortal on XP Pro. I just uninstalled everything (I had two MediaPortal entries in my Add/Remove Programs) and reinstalled MediaPortal 0.2.3.0. And when I tried to run it with my non-privileged user, it didn't display and crashed when I tried to close it (with Alt+F4). Then, I gave my user "Full Control" permissions on the MediaPortal directory and everything worked smoothly.

What do the permissions look like in your Vista MediaPortal installation directory?

[infinityloop]

Originally Posted by palswim

I run MediaPortal on XP Pro. I just uninstalled everything (I had two MediaPortal entries in my Add/Remove Programs) and reinstalled MediaPortal 0.2.3.0. And when I tried to run it with my non-privileged user, it didn't display and crashed when I tried to close it (with Alt+F4). Then, I gave my user "Full Control" permissions on the MediaPortal directory and everything worked smoothly.

i had a chat with the team.

seems like we do not support limited user accounts under WindowsXP.
we will have a look at it, but i can not promise that this will change.

[palswim]

Originally Posted by infinityloop

seems like we do not support limited user accounts under WindowsXP.

Do you support limited accounts in Vista? If so, how does that work (or how does Vista deal with it differently than XP)?

[palswim]

Sorry to resurrect an old thread, but you mentioned that you didn't support limited user accounts in Windows XP. Do you support limited user accounts in Windows Server 2003? I think both Windows versions handle user accounts in a similar fashion, but I don't know all of the intricate details. But I have considered upgrading my box to Server 2003, and while an answer to this won't make my decision, it may help spur me to action if I do decide to upgrade.

[schlurch]

i recently switched to MP after hasseling too much with mce2005 for
the last two years.
i am very happy with it, even if i know that developing such a complex
piece of soft needs a high amount of professional work. you all
for that.

but that the team won't support running MP with limited user accounts
on XP is not the right decision imho.
even though i dunno use vista i am happy to hear that MP runs smoothly
on that system with a limited user account.

i solved this issue for me with giving all MP-related files full control for the
user with limited rights. not perfect but better than work only with administrator
privileges.

[infinityloop]

1. changing this now, at the current point of development (RC-phase) is way too risky
2. if we do this change after 1.0, then we would need an developer who is interested to do this.