Is there an equivalent of set uid for windows(XP)? The 'run as' option requires admin password each time it runs. I want users to be able to run that particular executable without knowing admin password. I'm very much new to windows area. :(
4
-
Do you really need to do that? Perhaps there is another way, like changing permissions for registry branch or directory...– Taras ChuhayJun 23, 2009 at 13:05
-
There is this software(ANSYS to be precise) which runs properly only if it is run with admin privileges. :(– AkilanJun 23, 2009 at 16:24
-
Sure. You can get the equivalent of setuid root on WinXP by using something called a 'nop sled'. Works like a charm...– Parthian ShotAug 6, 2014 at 17:42
-
1If you are ok with mixing super-out-of date answers with active directory then there is! The Microsoft Elevated Privileges Application Launcher allows exactly this.– MitchFeb 5, 2017 at 9:53
Add a comment
|
4 Answers
See here: Is there an equivalent of SU for Windows
Essentially, the architecture of the OS prevents doing what you'd like w/o storing credentials. Yes, you can store them "encrypted", but if the user isn't supposed to have to type anything (like, say, a password) whatever "encryption" you use to store the credentials will have its key stored right along side such that it can be "decrypted" (really encoded / decoded) at the time the user accesses it.
Getting Windows NT operating systems to create an access-token as another use w/o specifying their password requires calling undocumented native-mode APIs. The RunAsEx project will do that, but it could break in future releases of Windows.
answered Jun 23, 2009 at 11:55
runas (at least on xp sp3) has option "/savecred" - it asks for password the first time and then it uses stored one (even after reboot).
There's Encrypted RunAs and a free alternative CPAU. Although I wouldn't use those until absolutely necessary.
There is a special program for these purposes - Admilink.
It creates an special encrypted link to targeted file (I test in only with .exe files) - you need to do this action only once. When you click on link - program (Admirun.exe) automatically starts the program in link with the special rights (Rigths depends of selected User during link creation process - you can use admin account or domain account name etc).
Restrictions:
During link creating process (only once) you need to have admin account.
Admirun.exe must be presented in your Windows folder (module included in Admilink).
All documentation on Russian :). Teach russian or ask me for additional help
P.S. It's FREE for non-comercial use.
P.P.S It has lots of additional functions
-
This tool doesn't get around the fundamental problem that the credential has to be stored in order to documented APIs. You describe the file this tool creates as "encrypted", but it's actually encoded. The password has to be accessible in cleartext, meaning that the file this tool creates contains, in effect, the plaintext password. Feb 17, 2010 at 14:44
-
Password ISN't stored IN CLEAR TEXT. It's really encrypted. How is it work? I read documentation - "admilink module generates encrypted key=user+domain+password. Key tied to concrete executable file. Without this file Admirun module won't be able to decrypt". I think the ploy is in algorithm - algorithm in this case is used as password. As as resume author said what Admilink guarantee: 1. User will able to run ONLY targeted programm with targeted rights 2. User won't be able to know the password from link 3. User won't be able to run another program using substitution of executable Feb 18, 2010 at 5:15
-
4@user35115: The OS requires admin credentials (the clear text password) to run something as an admin. If the link doesn't require admin credentials to run it must be storing the admin credentials in a form which is recoverable to clear text. Evan argues that this is effectively clear text (ie not secure). Yes it's encrypted, but then the encryption key must be stored in an accessible way; so it becomes effectively useless.– DraemonDec 6, 2010 at 15:02