13

There are a several utilities to run as a different user (eg: runas, cpau, psexec) but all of them require the password for the respective user, even if you are already running with elevated privileges.

I'd like to achieve the following:

  1. I already have an elevated prompt (Administrator)
  2. I'd like to execute a command (eg: calc.exe) as john without typing/passing their password to the launcher utility.

For example, in Unix system you could just:

root@server:~# su - john
3

I use this all the time. It does take entering a credential the first time it's used (and when the password changes) but that's it.

runas /user:yourusernamehere /savecred "Your Executable Here"

If you save this command as part of a bat file you can create a shortcut that will launch this with administrative rights using a target like the following.

C:\Windows\System32\cmd.exe /c "C:\yourbatfilehere.bat"
  • 3
    Thanks for the tip, but unfortunately /savecred is not applicable in my case because 1) the user credentials may change AND 2) the commands to be executed are generated dynamically (so I'd have to type the password for each command). Also, this should run in background, without any user interaction. – Razvan Apr 26 '16 at 15:11
  • @Razvan you can wrap your commands in a script file so as long as the name is the same your comands can change easily. As to the credentials changing... you need to either pass fresh credentials our a cached copy. There isn't a third option. – Tim Brigham Apr 26 '16 at 15:16
3

Nope, not possible under Windows. You always have to enter a password at least once when running applications under a different user account. Even as an Administrator.

Prevents funny things to happen and enables clean auditing. If something happens under a user account users cannot blame administrators for doing it without their consent.

  • But is this a technical limitation? I could think of that maybe some relevant user files required for establishing a new session are encrypted using the user credentials so that's why it would be impossible to get a new session without providing the respective credentials (it's just a guess). – Razvan Apr 28 '16 at 9:40
  • I don't understand your comment. It's a technical limitation in the sense that Microsoft decided to plan Windows in the way that you cannot impersonate a user account without knowing its password. The why and how does not matter. Your only option is to enter the password or accept that you cannot impersonate any account without it. – Daniel Apr 28 '16 at 10:09
  • 1
    @Daniel could you provide some reference link for your claim that this is a deliberate, strategic decision? – ivan_pozdeev Jan 6 '17 at 10:04
  • Isn't there an ACL to allow this? – RandomInsano Dec 20 '17 at 16:57
3

In Windows, you can only do this if there is a current logon session of the user you are attempting to impersonate. This is due to the local group policy "Impersonate a client after authentication" allowing members of the Administrators group to do exactly that (Found under Local Policies > User Rights Assignments).

One tool I know that allows you to do this is Process Hacker 2. Run the tool as a local admin, and find a process that is running as the user you wish to impersonate. Right Click on it, select Misc > Run as this user..., you then type the binary path you want to run as that user, for example cmd. CMD would then open as that user without prompting for that user's password.

-3

If you put the .exe in their startup folder you may be able to run it as them.

  • 2
    elaborating: you aren't running it as them...you're getting them to run it for you. – KevinKTI Feb 14 '17 at 14:56
  • 2
    Since the user would put in their password when they login this doesn't seem to answer the question. – chicks Feb 14 '17 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.