RunAs commandline syntax?

[Dennis]

Can someone please direct me to complete commandline
syntax (& examples) for the 'RunAs' command?
I need to execute some processes from within the User
Login Script and/or batchfiles which require Administrator
rights while executing under a general User
profile/login. Can the Administrator's 'secret_password'
be concealed in any way, or referenced in another file?
Thanks for help.

[Torgeir Bakken (MVP)]

Dennis wrote:

Hi

Some Runas wrapper utilities or alternatives that might help you:
http://groups.google.com/groups?selm=3FE0B42C.773CA875%40hydro.com

--
torgeir
Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of the 1328 page
Scripting Guide: http://www.microsoft.com/technet/scriptcenter

[Al Dunbar [MS-MVP]]

"Torgeir Bakken (MVP)" <Torgeir.B...@hydro.com> wrote in message
news:3FE6830B...@hydro.com...

> Dennis wrote:
>
> > Can someone please direct me to complete commandline
> > syntax (& examples) for the 'RunAs' command?
> > I need to execute some processes from within the User
> > Login Script and/or batchfiles which require Administrator
> > rights while executing under a general User
> > profile/login. Can the Administrator's 'secret_password'
> > be concealed in any way, or referenced in another file?

In case this is not obvious from the google hits Torgeir provided, NO, you
cannot obscure the administrator's password with ANY kind of reliability if
you are using plain old runas. In fact, don't even think of trying to use it
for your particular purpose.

The other available solutions all have merits, but you had best do a threat
risk analysis before implementing any of them.

/Al

[emahuni]

Dennis wrote on 12/21/2003 21:54 ET :
> Can someone please direct me to complete commandline

> syntax (&amp; examples) for the 'RunAs' command?

> I need to execute some processes from within the User
> Login Script and/or batchfiles which require Administrator
> rights while executing under a general User
> profile/login. Can the Administrator's 'secret_password'
> be concealed in any way, or referenced in another file?
> Thanks for help.
>

http://technet.microsoft.com/en-us/magazine/2008.06.elevation.aspx

that's yo answer. The set of scripts and so forth offered in this post is just
exactly what i needed to elevate my batch job to full administrative rights.
Man
it was a pain to find that on the net.

It can elevate virtually every exec.

My main problem wasn't self-elevation request though, i had worked around
that.
My minor problem was how to make a batch script request for an administrator
token in windows vista or 7.
My main problem was like this:
I created a batch file say &quot;c:tempbatch.cmd&quot;, which would at some
time
require a full admin token in windows 7. This script has dependency files that
it uses that are located in the same folder. If I ran it from an elevated
commandline by typing &quot;batch&quot; it worked fine (of course i was
testing
it) within the host shell itself. However, if I ran it by right clicking the
batch job in explorer, and choosing &quot;run as administrator&quot; like a
novice... then all hell broke loose.
cmd.exe starts the batch file in C:windowssystem32. It doesn't change the dir
back to where the run as administrator command was initiated: i.e. c:temp

This ended up in the batch job missing all its dependencies etc and not
working
properly. I had workarounds that worked but were tiresome and i didn't like
them, too many uncertainties in the way.... too many bugs therefore and for
non-power users... not practical.

So I wanted a way to run the batch as admin from where it is currently
located.
But it didn't work with this guy's scripts as i expected. MS made an error
that
she's not fixing or even identifying there. cmd.exe is the script host here,
which starts where it is located (c:windowssystem32) and forgets about its
guest's location (c:temp). under normal (ristricted) circumstances cmd.exe
doesn't forget, it switches to that dir first before running the script to
make
sure a transparent process occurs.

My work around was passing the current dir to the batch script as a parameter:
elevate c:tempbatch.cmd %CD%
and then use that para to change to that dir in the batch job:
CD /D %1%
Which works greatly. I was just not paying attention to the fact that you can
pass parameters to batch scripts and this guy gave me an epiphany. check the
link for info on elevate...

http://technet.microsoft.com/en-us/magazine/2008.06.elevation.aspx