Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there an equivalent of set uid for windows(XP)? The 'run as' option requires admin password each time it runs. I want users to be able to run that particular executable without knowing admin password. I'm very much new to windows area. :(

share|improve this question
    
Do you really need to do that? Perhaps there is another way, like changing permissions for registry branch or directory... –  Taras Chuhay Jun 23 '09 at 13:05
    
There is this software(ANSYS to be precise) which runs properly only if it is run with admin privileges. :( –  Akilan Jun 23 '09 at 16:24
add comment

4 Answers 4

up vote 4 down vote accepted

See here: http://serverfault.com/questions/16886/is-there-an-equivalent-of-su-for-windows

Essentially, the architecture of the OS prevents doing what you'd like w/o storing credentials. Yes, you can store them "encrypted", but if the user isn't supposed to have to type anything (like, say, a password) whatever "encryption" you use to store the credentials will have its key stored right along side such that it can be "decrypted" (really encoded / decoded) at the time the user accesses it.

Getting Windows NT operating systems to create an access-token as another use w/o specifying their password requires calling undocumented native-mode APIs. The RunAsEx project will do that, but it could break in future releases of Windows.

share|improve this answer
add comment

runas (at least on xp sp3) has option "/savecred" - it asks for password the first time and then it uses stored one (even after reboot).

share|improve this answer
add comment

There's Encrypted RunAs and a free alternative CPAU. Although I wouldn't use those until absolutely necessary.

share|improve this answer
    
I should've refused to administer windows systems. ;-) –  Akilan Jun 23 '09 at 9:28
add comment

There is a special program for these purposes - Admilink.

It creates an special encrypted link to targeted file (I test in only with .exe files) - you need to do this action only once. When you click on link - program (Admirun.exe) automatically starts the program in link with the special rights (Rigths depends of selected User during link creation process - you can use admin account or domain account name etc).

Restrictions: During link creating process (only once) you need to have admin account.
Admirun.exe must be presented in your Windows folder (module included in Admilink).
All documentation on Russian :). Teach russian or ask me for additional help

P.S. It's FREE for non-comercial use.
P.P.S It has lots of additional functions

share|improve this answer
    
This tool doesn't get around the fundamental problem that the credential has to be stored in order to documented APIs. You describe the file this tool creates as "encrypted", but it's actually encoded. The password has to be accessible in cleartext, meaning that the file this tool creates contains, in effect, the plaintext password. –  Evan Anderson Feb 17 '10 at 14:44
    
Password ISN't stored IN CLEAR TEXT. It's really encrypted. How is it work? I read documentation - "admilink module generates encrypted key=user+domain+password. Key tied to concrete executable file. Without this file Admirun module won't be able to decrypt". I think the ploy is in algorithm - algorithm in this case is used as password. As as resume author said what Admilink guarantee: 1. User will able to run ONLY targeted programm with targeted rights 2. User won't be able to know the password from link 3. User won't be able to run another program using substitution of executable –  user35115 Feb 18 '10 at 5:15
3  
@user35115: The OS requires admin credentials (the clear text password) to run something as an admin. If the link doesn't require admin credentials to run it must be storing the admin credentials in a form which is recoverable to clear text. Evan argues that this is effectively clear text (ie not secure). Yes it's encrypted, but then the encryption key must be stored in an accessible way; so it becomes effectively useless. –  Draemon Dec 6 '10 at 15:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.