Hacker News Reader

Comment by pjmlp | Hacker News Reader

Nice as a learning project, but RunAs is already supported at CLI and GUI level, since several versions.

For those without much Windows GUI-fu, shift-right click.

But it's extremely cumbersome from the CLI.

RunAs always asks for password for the Administrator account (not the account for the delegated account like sudo). I have admin access to my work PC, but not the Administrator password (since UAC grants me access). Also, running elevated programs always in separate windows, so you can't redirect their input/output. And CLI program disappear instantly (no time to read the output).

I have used elevate.exe (http://code.kliu.org/misc/elevate/) but sudo seems even better (supports redirecting input/output).

> I have admin access to my work PC, but not the Administrator password

I am not sure if I understand this. Does the machine have two different admin accounts, once of which you have access to?

In windows you can assign admin access to any account if you wish, kind of like sudo in unix. "Administrator" is a special account, basically like root in unix.

I am still confused. Can't you specify account name like so?

    runas /user:Administrator2

Yes, but you need the password then. With admin priviledges you can run "as admin" without needing to know the password. The privileged account still runs programs in normal mode (unprivileged), but can launch programs with elevated permissions.

So basically log in as admin and hope you don't press Yes on a UAC dialog by accident?

Sounds dangerous to me.

The dialog has been designed in a way so that’s almost impossible to press by accident, nor programmatically.

Specially dimmed background, characteristic sound, the dialog runs on a dedicated desktop i.e. you won’t see any apps nor the start menu. Also the default button is No i.e. you can’t accidentally press Yes with enter or space keys, you have to use a mouse.

runas request password. And I don't want to touch my mouse. Many of implementation doesn't handle stdin/stdout/stderr.

You can call 'runas' via an API at code level that allows you to specify a password. There's quite a few tools out there that do it. I used to host mine on my website but it caused all those website classification systems to classify my domain as 'hacking tools' so I had to remove it. :(

If you allow you to enter a password, you can use runas.exe which is provided by Microsoft.

RunAs.exe only allows you enter a password interactively. If you want to elevate with RunAs in a script and pre-specify the password[1], you can't do it.

[1] Yes, I know this is awful security, but sometimes you have no choice.

> You can call 'runas' via an API at code level that allows you to specify a password.

Wait, then where does the whole UAC thing comes from??

Reply on news.ycombinator.com