I have some Windows XP virtual machines that are used to run some low-trust software. Domain accounts assigned to be used on these machines are forbidden from accessing files shares or logging into any other computer.
However, with domain accounts (unlike local accounts), a user will not be prompted to log-in into an alternative account to access protected file shares, so I must repeatedly log-in and out which has become a usability problem.
Is their any user-friendly way for a domain user to temporarily assume another user's access rights?
I've tried the run as feature, but it is still quite inconvenient.
Edit: I am hoping for something that
- is similar to the Windows UAC in which it automatically "knows" an alternative account is needed and prompt for it. For this to be practical, a list of programs that require alternative account can be provided.
- automatically fills the user name of the alternative account. Again this can be predefined in the list.
- includes a way to "elevate" parts of explorer (like UAC does) so I can gain temporary access to a protected folder. This can be a context menu item that opens a new explorer window or file manager.
- works on programs lunched from any process as opposed to just explorer. (Optional)
- preserves the current user's profile just as sudo for windows does (Optional, new in Edit 3)
- can be easily deployed through group policy.
Edit 2: To summarize: I am trying to create a more generic version of UAC that could allow programs to temporarily obtain higher (but not necessarily administrator) access by impersonating a different account. It has to work with older OSes that does not have UAC as well.
Edit 3: Current solution: It turns out you can create a GUI Run As shortcut simply by ticking the "Run as Administrator" box in the properties of the GUI. The system will not actually checking if the new user is Administrator or not.
But I am still waiting for one that could satisfy all the requirements.