Security roles for Developers

[David Bailie]

Hi all,

I was wondering what local security groups a developer needs to belong
to in order to be able to write, test and debug VB, C# and ASP.net on
Windows XP?

The groups that are in question are Debugger Users and VS Developers. I
wanted to know if a .NET developer has to be in both, or either (not all of
our VS.NET users use the debugging capabilities.

Also, does a VS.NET developer need to be a Local Admin?

Thanks in advance.

David

[Dominick Baier]

In general - all VS.NET debugging is done through a gatekeeper mechanism called "Machine Debug Manager" - the mdm requires you to be a) local admin or b) member of the debugger users group.

this will work for console apps, winforms a.s.o.

a exception is, when you want to debug applications which are running in different security contexts (asp.net, nt services, enterprise services) you need to have admin privileges (even SeDebugPrivilege won't help).

When you don't want to run with admin privs you have to start the app you want to debug under the same security context as you are running (asp.net -> processmodel under IIS5, app pool identity under IIS6, es -> interactive user or nt services -> identity).

The VS Developers groups grants rights for non-admins to create vdirs and web applications in IIS

to summarize:

Apps that run in your context : Debugger Users

Apps that don't run in your context : Admin



---
Dominick Baier - DevelopMentor
[url]http://www.leastprivilege.com[/url]

nntp://news.microsoft.com/microsoft.public.dotnet.framework.aspnet.security/<#IOK3R48EHA.3616@TK2MSFTNGP11.phx.gbl>

Hi all,

I was wondering what local security groups a developer needs to belong
to in order to be able to write, test and debug VB, C# and ASP.net on
Windows XP?

The groups that are in question are Debugger Users and VS Developers. I
wanted to know if a .NET developer has to be in both, or either (not all of
our VS.NET users use the debugging capabilities.

Also, does a VS.NET developer need to be a Local Admin?

Thanks in advance.

David



[microsoft.public.dotnet.framework.aspnet.security]

[Carlos J. Quintero [.NET MVP]]

"David Bailie" <dbailie@ernexinc.com> escribió en el mensaje
news:%23IOK3R48EHA.3616@TK2MSFTNGP11.phx.gbl...

> does a VS.NET developer need to be a Local Admin?

Absolutely not. VS.NET developers should not be admins. I switched to non
admin some months ago and you can develop normally. Here you have some
resources:

The Non-Admin blog - running with least privilege on the desktop
[url]http://weblogs.asp.net/aaron_margosis/[/url]

Developing Software in Visual Studio .NET with Non-Administrative Privileges
[url]http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dv_vstechart/html/tchDevelopingSoftwareInVisualStudioNETWithNon-AdministrativePrivileges.asp[/url]

Developing as non-Admin with VS.NET 2003
[url]http://cyberforge.com/weblog/aniltj/articles/254.aspx[/url]

How To Use the ASP.NET Utility to Encrypt Credentials and Session State
Connection Strings
[url]http://support.microsoft.com/default.aspx?scid=kb;en-us;329290[/url]

Item 9: How to develop code as a non-admin
[url]http://www.informit.com/content/images/0321228359/samplechapter/brown_ch.pdf[/url]

> The groups that are in question are Debugger Users and VS Developers. I
> wanted to know if a .NET developer has to be in both, or either (not all
> of our VS.NET users use the debugging capabilities.

I don´t remember about the Debugger Users group (the answer is in the docs
above) but I remember that the VS Developers group makes the ASP.NET wizard
to create ASP.NET solutions much happier. Otherwise you have to create IIS
virtual folders first and I experienced some problems. So, I am in both
groups.

--

Carlos J. Quintero

MZ-Tools 4.0: Productivity add-ins for Visual Studio .NET
You can code, design and document much faster.
[url]http://www.mztools.com[/url]

[Dominick Baier]

for development you don't need admin rights - for debugging - yes!



---
Dominick Baier - DevelopMentor
[url]http://www.leastprivilege.com[/url]

nntp://news.microsoft.com/microsoft.public.dotnet.framework.aspnet.security/<eo9YK1J9EHA.1404@TK2MSFTNGP11.phx.gbl>

"David Bailie" <dbailie@ernexinc.com> escribi? en el mensaje
news:%23IOK3R48EHA.3616@TK2MSFTNGP11.phx.gbl...

> does a VS.NET developer need to be a Local Admin?

Absolutely not. VS.NET developers should not be admins. I switched to non
admin some months ago and you can develop normally. Here you have some
resources:

The Non-Admin blog - running with least privilege on the desktop
[url]http://weblogs.asp.net/aaron_margosis/[/url]

Developing Software in Visual Studio .NET with Non-Administrative Privileges
[url]http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dv_vstechart/html/tchDevelopingSoftwareInVisualStudioNETWithNon-AdministrativePrivileges.asp[/url]

Developing as non-Admin with VS.NET 2003
[url]http://cyberforge.com/weblog/aniltj/articles/254.aspx[/url]

How To Use the ASP.NET Utility to Encrypt Credentials and Session State
Connection Strings
[url]http://support.microsoft.com/default.aspx?scid=kb;en-us;329290[/url]

Item 9: How to develop code as a non-admin
[url]http://www.informit.com/content/images/0321228359/samplechapter/brown_ch.pdf[/url]

> The groups that are in question are Debugger Users and VS Developers. I
> wanted to know if a .NET developer has to be in both, or either (not all
> of our VS.NET users use the debugging capabilities.

I don?t remember about the Debugger Users group (the answer is in the docs
above) but I remember that the VS Developers group makes the ASP.NET wizard
to create ASP.NET solutions much happier. Otherwise you have to create IIS
virtual folders first and I experienced some problems. So, I am in both
groups.

--

Carlos J. Quintero

MZ-Tools 4.0: Productivity add-ins for Visual Studio .NET
You can code, design and document much faster.
[url]http://www.mztools.com[/url]




[microsoft.public.dotnet.framework.aspnet.security]