Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

One thing that's annoyed me for a great while about administrating a Windows domain is trying to work primarily from a limited user account. Much of what I do on my workstation on a day to day basis doesn't require admin rights, so I prefer to run as a limited user for security reasons. The problem, of course, are all those times when I have to do something as a domain admin.

With Windows Vista "fast user switching" finally worked for machines in a domain, but I have a few problems with it: 1) Switching is slow, 2) About one out of five times, switching user accounts will cause Vista to forget my display settings to the point where they cannot be restored without a restart. Fun stuff.

Often times I only need a file browser to run with elevated privileges, and it appears as though there's no way to run an Explorer instance in this manner (via Runas). It also appears that browsing files via IE is now just running an Explorer process, and is thus limited in the same way.

I've been running FreeCommander via Sysinternals ShellRunas for this purpose, and it works. It's just not a good experience.

I would kill for something closer to sudo. Am I completely missing something obvious?

share|improve this question
    
I may be being dumb here, but wouldn't UAC help you out here? –  Rowland Shaw Oct 22 '09 at 16:20
    
Perhaps it could... unfortunately it breaks a vertical app that I absolutely must run on this machine. –  Boden Oct 22 '09 at 17:43

7 Answers 7

You are doing the right thing running as a limited account.

I solve this problem by doing rdesktop to another system (usually a server), and logging in as the domain admin.

Fast user switching is a good method, but if it is causing you headaches, then....

share|improve this answer
    
I remote in to servers. But when I have to transfer files from my workstation or just set some permissions quickly, it sure would be nice if I could just open a share as an elevated user. –  Boden Oct 22 '09 at 17:50

You can run Explorer under another user context, but you have to kill the existing Explorer first to do it, and it's really pretty ugly. If you really want to try it, open a command-prompt with "RunAs" and your domain administrator account. From that command prompt, use "Task Manager" to kill the existing "Explorer.exe" and then start a new one. You'll get an elevated "Explorer.exe" running as the domain administrator account.

It's really an ugly hack, though, so I wouldn't do it in practice.

share|improve this answer
    
Thanks for this. I'll take your advise and not do it :) Maybe Windows 7 will help me since some of my problems here are directly related to Vista (e.g. wonky user switching). –  Boden Oct 22 '09 at 17:46
    
Win7 is perfect for this, I haven't had to pull out any of my runas tricks since moving to it. –  atom255 Oct 22 '09 at 18:02

I run into this all the time.

If you're looking to do a quick/simple permissions change or copy/rename/delete, just do a runas on notepad or mmc and use the file open dialog box to make the changes.

alt text

You can browse to whatever folder you want, right-click for properties/permissions, copy and paste. One thing to note is that the view won't refresh right away, hit F5 after renaming/ moving a file etc.

share|improve this answer
    
Ha! Very clever! I'll try this for a few days and see if I can get used to it. –  Boden Oct 22 '09 at 18:17

I have a script that would launch runas then something else (e.g. MMC) elevated.

Set objShell = CreateObject("Shell.Application")
app = wscript.arguments(0)
args = ""
for i = 1 to (WScript.Arguments.length - 1)
   args = args + wscript.arguments(i)
next
objShell.ShellExecute app, args, "", "runas"

If you hate the constant prompt for creds, perhaps using something that can take creds instead of runas ... but then storing creds in a script exposure plus perhaps eroding the benefit of running as lower account.

share|improve this answer
    
Thanks. The problem however is running things like Explorer, for which this won't work. BTW, you should check out ShellRunas. –  Boden Oct 22 '09 at 17:45

I used to do this runas and Internet Explorer in Windows XP. You can then browse files inside the IE window. I have not had the need to try this in Windows Vista though.

share|improve this answer
    
Yeah, it's no longer possible. –  Boden Oct 22 '09 at 17:51
    
Starting with IE 7 you can't browse the file system. If you copy over the IE6 exe you can still do a runas on that however and it works. –  atom255 Oct 22 '09 at 18:00

if remote desktop is enabled, you can use RDP to connect to localhost with alternater creds. the problem is, that this loads the whole user session and a lot of unneeded stuff for just using one program.

EDIT: i haven't tried this with vista (or xp). i am using server 2008 as my workstation and it works great under it.

share|improve this answer
    
Can you elaborate on this? I get an error: "You are already connected to the console of this computer." –  Boden Oct 22 '09 at 17:48
1  
I don't think this would work for something other than server. XP at least locks the console when you connect via RDP, it's still a single user OS. –  atom255 Oct 22 '09 at 17:59

Do your runas on this:

explorer.exe /separate

The separate is an undocumented flag but it launches it in a separate process window (AKA it will not check for an existing explorer shell before launching)

share|improve this answer
    
I've tried this in the past, and it doesn't work on Vista. –  Boden Oct 22 '09 at 20:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.