Deployment PC: How to let TestStand write report files and database without letting the user edit them?

[JKSH]

My customer has been running a deployed TestStand application for several years. The application stores test results in both ATML report files as well as an SQL Server database (both configured via TestStand > Configure > Result Processing...)

So far, the operator has always logged in as an administrator.

Now, the customer wants to improve security and ensure that the operator can't edit/delete the ATML report files or modify the SQL Server database. He tried to do this by creating a new, restricted Windows user account -- the idea is that the operator logs in as a restricted user, and then they launch the TestStand Operator Interface using a Windows runas script to give it elevated permissions.

Unfortunately, this seemed to make TestStand unable to access the SQL database:

What is the proper way to let TestStand create report files and write to the database, but prevent the operator from accessing them?