2

Background

I have some Windows XP virtual machines that are used to run some low-trust software. Domain accounts assigned to be used on these machines are forbidden from accessing files shares or logging into any other computer.

However, with domain accounts (unlike local accounts), a user will not be prompted to log-in into an alternative account to access protected file shares, so I must repeatedly log-in and out which has become a usability problem.

Question

Is their any user-friendly way for a domain user to temporarily assume another user's access rights?

I've tried the run as feature, but it is still quite inconvenient.

Edit: I am hoping for something that

  • is similar to the Windows UAC in which it automatically "knows" an alternative account is needed and prompt for it. For this to be practical, a list of programs that require alternative account can be provided.
  • automatically fills the user name of the alternative account. Again this can be predefined in the list.
  • includes a way to "elevate" parts of explorer (like UAC does) so I can gain temporary access to a protected folder. This can be a context menu item that opens a new explorer window or file manager.
  • works on programs lunched from any process as opposed to just explorer. (Optional)
  • preserves the current user's profile just as sudo for windows does (Optional, new in Edit 3)
  • can be easily deployed through group policy.

Edit 2: To summarize: I am trying to create a more generic version of UAC that could allow programs to temporarily obtain higher (but not necessarily administrator) access by impersonating a different account. It has to work with older OSes that does not have UAC as well.

Edit 3: Current solution: It turns out you can create a GUI Run As shortcut simply by ticking the "Run as Administrator" box in the properties of the GUI. The system will not actually checking if the new user is Administrator or not.

But I am still waiting for one that could satisfy all the requirements.

Improve this question
3
  • 2
    Nope. UAC does not use another account; it elevates the privileges of the current account.
    – murisonc
    Aug 4, 2011 at 1:00
  • 1
    @murisonc UAC will allow you to elevate to another account if the current one is not an administrator.
    – billc.cn
    Aug 4, 2011 at 1:32
  • Update: found this today: ShellRunas. It has a /netonly option that allows a different option to be used to remote access, which kind of solves my original problem.
    – billc.cn
    Sep 7, 2011 at 14:53

2 Answers 2

Reset to default
2

I think you are seeking a sudo equivalent on windows. Not sure if it is good but you could try to have a look at sudo for windows

It doesn't change the user and profile and you don't need to type the new group/username.

Improve this answer
1
  • This seems to be a step closer to a domain-based UAC. Thanks a lot for the link.
    – billc.cn
    Aug 4, 2011 at 3:13
2

Q: How to temporarily impersonate another user in Active Directory?

A: Run As

What's inconvenient about using Run As that you're imagining there's a more convenient alternative to?

Q: Is their any user-friendly way for a domain user to temporarily assume another user's access rights?

A: Run As

What's un-user friendly about using Run As that you're imagining there's a more user friendly alternative to?

Improve this answer
6
  • See my edit :) I know there may not be any existing solution, but I am considering writing some code to do it. I just need to know difficult it would be and whether it will be worth it.
    – billc.cn
    Aug 4, 2011 at 1:31
  • 2
    The only thing I can think of is to create a Run As enabled shortcut for the program(s) that you want the user to run with elevated rights.
    – joeqwerty
    Aug 4, 2011 at 2:55
  • Yes, I guess that will solve part of the problem, but How do I create such shortcut?
    – billc.cn
    Aug 4, 2011 at 3:07
  • 1
    Here's a sample: technet.microsoft.com/en-us/library/cc781769(WS.10).aspx
    – joeqwerty
    Aug 4, 2011 at 3:11
  • Right, this asks for the password in a command prompt which is a bit inconvenient. I will try to use sudo for window first and see if it can get me anywhere. If not, I will have to find the API that runas is using and write some kind of GUI wrapper for it.
    – billc.cn
    Aug 4, 2011 at 3:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .