Some time ago (May 23 to be exact) I posted a query that resulted in this thread. It is only now that I have had the time to investigate this matter further.
I fully appreciate the security implications of allowing any user to use the full capabilities of WinPcap. However, in my environment (and maybe others) security is not a concern. The software that will be based on WinPcap will be used in student computer laboratories that will be fully quarantined from the outside world.
So to the results of my investigations:
1) Administrator access is required because of the use of value SC_MANAGER_ALL_ACCESS used in the dwDesiredAccess parameter of the OpenSCManager function.
2) That value is only required because of the call to the function OpenSCManager.
Could this be overcome by loading the npf.sys driver at boot time? I refer to the sections “Loading Device Drivers “and “Initializing Device Drivers “ in this Microsoft page.
This would probably mean that npf.sys would have to be installed via the Control Panel therefore a .inf file would be required to specify the required settings in the registry, which, according to this is not a job for amateurs.
Any and all comments, criticisms and / or assistance would be gratefully received.
Regards,
