Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Background

I have some Windows XP virtual machines that are used to run some low-trust software. Domain accounts assigned to be used on these machines are forbidden from accessing files shares or logging into any other computer.

However, with domain accounts (unlike local accounts), a user will not be prompted to log-in into an alternative account to access protected file shares, so I must repeatedly log-in and out which has become a usability problem.

Question

Is their any user-friendly way for a domain user to temporarily assume another user's access rights?

I've tried the run as feature, but it is still quite inconvenient.

Edit: I am hoping for something that

  • is similar to the Windows UAC in which it automatically "knows" an alternative account is needed and prompt for it. For this to be practical, a list of programs that require alternative account can be provided.
  • automatically fills the user name of the alternative account. Again this can be predefined in the list.
  • includes a way to "elevate" parts of explorer (like UAC does) so I can gain temporary access to a protected folder. This can be a context menu item that opens a new explorer window or file manager.
  • works on programs lunched from any process as opposed to just explorer. (Optional)
  • preserves the current user's profile just as sudo for windows does (Optional, new in Edit 3)
  • can be easily deployed through group policy.

Edit 2: To summarize: I am trying to create a more generic version of UAC that could allow programs to temporarily obtain higher (but not necessarily administrator) access by impersonating a different account. It has to work with older OSes that does not have UAC as well.

Edit 3: Current solution: It turns out you can create a GUI Run As shortcut simply by ticking the "Run as Administrator" box in the properties of the GUI. The system will not actually checking if the new user is Administrator or not.

But I am still waiting for one that could satisfy all the requirements.

share|improve this question
2  
Nope. UAC does not use another account; it elevates the privileges of the current account. –  murisonc Aug 4 '11 at 1:00
1  
@murisonc UAC will allow you to elevate to another account if the current one is not an administrator. –  billc.cn Aug 4 '11 at 1:32
    
Update: found this today: ShellRunas. It has a /netonly option that allows a different option to be used to remote access, which kind of solves my original problem. –  billc.cn Sep 7 '11 at 14:53

2 Answers 2

Q: How to temporarily impersonate another user in Active Directory?

A: Run As

What's inconvenient about using Run As that you're imagining there's a more convenient alternative to?

Q: Is their any user-friendly way for a domain user to temporarily assume another user's access rights?

A: Run As

What's un-user friendly about using Run As that you're imagining there's a more user friendly alternative to?

share|improve this answer
    
See my edit :) I know there may not be any existing solution, but I am considering writing some code to do it. I just need to know difficult it would be and whether it will be worth it. –  billc.cn Aug 4 '11 at 1:31
2  
The only thing I can think of is to create a Run As enabled shortcut for the program(s) that you want the user to run with elevated rights. –  joeqwerty Aug 4 '11 at 2:55
    
Yes, I guess that will solve part of the problem, but How do I create such shortcut? –  billc.cn Aug 4 '11 at 3:07
1  
Here's a sample: technet.microsoft.com/en-us/library/cc781769(WS.10).aspx –  joeqwerty Aug 4 '11 at 3:11
    
Right, this asks for the password in a command prompt which is a bit inconvenient. I will try to use sudo for window first and see if it can get me anywhere. If not, I will have to find the API that runas is using and write some kind of GUI wrapper for it. –  billc.cn Aug 4 '11 at 3:20

I think you are seeking a sudo equivalent on windows. Not sure if it is good but you could try to have a look at sudo for windows

It doesn't change the user and profile and you don't need to type the new group/username.

share|improve this answer
    
This seems to be a step closer to a domain-based UAC. Thanks a lot for the link. –  billc.cn Aug 4 '11 at 3:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.