August 08, 2006

Work around for "Threat Analysis & Modeling v2" tool least privilege install bug

So with help from Dan Sellers and Talhah Mir over at Microsoft, I finally figured out and fixed a problem I have been having with Microsoft's latest version of the "Threat Analysis & Modeling v2" tool.

It seems that a good portion of the comboboxes in the application were "blank". And it was making it impossible to complete production threat models since all the critical components needed weren't available.

Ends up, its an issue with installing the tool in a least privilege environment. And a rather funny one at that. The tool itself was written properly to handle least privilege by loading the data needed in the comboboxes from an AppLists.xml file, located in <user home directory>\Application Data\Microsoft\TAM\Temp\. Problem was, it EXPECTS that the user installed it and has the file.

In my case, I installed the tool with an administrator account, expecting it to work for both domain and nondomain limited user accounts on my laptop. There WAS a proper AppLists.xml located in that admin's directory. However, on the least privilege accounts, a default empty one was created when the original XML file could not be found. The result... all the blank comboboxes I was seeing.

The fix was simply to copy the properly populated AppLists.xml file from the admin account into the least privilege account. Walla. It all works now.

Posted by SilverStr at August 8, 2006 11:27 PM | TrackBack
Comments

That would be Voila. It's spelled strangely because it's French.

Posted by: Anthony Mills at August 9, 2006 07:28 AM