Newbie - Q2002 / Windows Xp

Hi Chris,

This message hopefully is read by Quicken Developers/Support personnel as well as it contains a fail bit of technical materials.

I am currently evaluating Quicken 2004 Personal (Verson 9.3.0) for a friend to be used in Windows XP (Pro SP2). The reason I use this is because that is all I can lay my hands on for testing.

I believe Quicken 2004 Personal *does not conform* to Windows 2000 File Security Specification,

Users reguiring Power Users privilege or higher can write to this directory. Orindary users can only read from it.

This immediately indicates Quicken 2004 fails this basic test.

Most Windows XP users essentially turn off the Windows security by running in an account with Administrator's right. This is dangerous and defeats the operating system's security model. In a corporate environment, users normally are not given such a high privilege.

Does anyone know if the newer version pass the security test?

I went through a more elaborate test by making full use of the Windows XP's security model and I suggest Quicken Developer should so as well (that's the environment how I develop programs). Step for setting this up can be found in

I log into XP Pro as an ordinary user (Joe), a member of the users group, and then I run the installation using the "RunAs" command as the Administrator. This is very normal in any installation process as installation needs a fairly high privilege. In fact, Quicken's installation fails with InstallShield error if run in Joe's account.

Installation proceeds without trouble. Strange to see why Quicken requires a system reboot. After all it is just an application like Words, etc.

Anyway, after reboot, I log in as Joe again and Quicken fails to fire up. It did not even give any explanation. QW.exe fires up and silently dies away. You can verify this with ProcExp.exe or even the Task manager.

Once again I had to use the "RunAs" to execute Quicken in the Administrator account. Strange and this clearly indicates Quicken is NOT CONFORMING to Windows security model. If Quicken needs to write data belonging to the user, it should be using the Windows profile area (\Documents and Settings\\Application Data or \Documents and Settings\\My Documents\....). See Windows 2000 Resource Kit for recommendations and guidelines.

One suspicion I have is that Quicken is writing cache or dynamic information directly into "\Program Files\Quicken 2004\" area and one needs to be a member of power users or higher.

Like many commercial programs, like Palm's Desktop and Visual Basic 6, after

I hope newer version of Quicken has addressed this short coming.

In brief, if you turn off the Windows XP security (ie running as a member of administrators group) then Quicken will work for you. But do not count on this in a much more restrictive environment.

If you are not allowed to be elevated to be a member of power users or upwards, use the following hack with your administrator's cooperation. Get the administrator to grant you almost full control to the directory "\Program Files\Quicken 2004" and its sub-directories. Make sure you do not create any data file in this directory; you should create it under your "My Documents" area for protection.

Rover

I reported exactly the same a couple of days ago, and stated that Quicken needs admin privileges to run, which is true if one installs Quicken like you and I did (i.e. using RunAs or logging in as administrator.)

That was also the question I asked about Quicken 2005, a couple of days ago, i.e. does it finally run without requiring admin or power users privileges.

What is claimed elsewhere is that if one's adds oneself to the admin group, install Quicken, then remove oneself from that group, one can then run quicken without special privileges. This may be the result of who ends up as the owner of the files/folders, but I haven't had the time to verify with it (but I will, whenever I have another hour or two to blow uninstalling and installing Quicken to check it out.)

I'm not sure what Quicken's EULA claims in respect of being used on one computer, or one user on one computer, but if it says one computer only, installing via the trick of adding oneself to the admin group temporarily, may block every other user of that machine to use Quicken, and I will try to verify that too, (and read the EULA :-))

-- HASM

Running as admin allows the app to set up a bunch of registry keys in HKCU that SHOULD have been set up ahead of time (in HKLM). Basically Intuit has decided to keep up with the Win32 changes that came with NT4 in '96. There were posts in this usenet group in '00 from Intuit Program Mgrs (or something like that) that acknowledged the issue but said most users were still using Win9x, and they would go to the expense until justified. WinXP comes out, and they wait over 3 years to address the issue.

Basically, Intuit doesn't respect its customers, and it shows. By making people run as admin, they have put every single one of those PCs at risk of spyware.

Lawrence

MCSE

....snip...

I have Q05, and I don't see any quicken related keys in HKCU except possibly relating to the internet connection.

The only thing that should go in HKLM is what affects ALL USERS. Preferences maintained on a per-user basis belong in HKCU.

Basically Intuit has

Did you mean "decided NOT to keep up?" What they actually have in Q05 is rather funny. The data is still stored in QUICKEN.INI (which now lives under \Documents and Settings\All Users) and some user specific prefrences in QUSER.INI (with an instance in each users Docs and Settings tree). The .INI files go back to Windows 3.1.

This is a bad idea because QUICKEN.INI contains a lot of preferences that really should be user specific, but they are not.

I don't know what OS you are running, but as an MCSE you should know better: Create a local group called QuickenUsers, give it Write (Full Control?) permission to C:\Documents and Settings\All Users\Application Data\Intuit\Quicken\Config and put users in there that you trust to use Quicken. The security risk is low; they can only mess with the quicken configuration, and you can back that up.

The QDATA.* files are (I think) stored by default in the user's profile, or at least can be moved there. I had already moved mine there so I couldn't tell whether the upgrade to Q05 would have done it. I suppose one could claim that the design is that all users work on the same file, or that all users have their own files. I.E, decide what it means for Quicken to be a multi-user program. (Remember, we're only talking about a few users who share a standalone workstation; this wouldn't fly in a domain...)

There appears to be a file created for each user in their own Docs & Settings tree called QUSER.INI that holds the recent file and recent backup lists. Obviously the user can access that.

Intuit really needs to bite the bullet and bring this thing up to date to comply with MS guidelines.