Real Geek Forums  

Go Back   Real Geek Forums > Archives > Operating Systems > Windows Vista > Windows Vista Security
Run as instead of Run as Adminstrator Run as instead of Run as Adminstrator
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read

Notices
Ask Your Questions - Have a problem with your computer? We provide free technical support.

Reply

Run as instead of Run as Adminstrator

 

LinkBack Thread Tools Display Modes
Old 01-15-2007, 02:11 PM   #1 (permalink)
Default Run as instead of Run as Adminstrator
Hello,

Local admins only get the option to "Run as Admin" when using right-click,
which uses the account with admin rights they are logged in with. How can we
enable them to choose an alternative domain account with priviledges for
like running Exchange or AD admin tools on administrative workstations?

Thx!

Cheers
Guest
 
Posts: n/a
Reply With Quote  
Old 01-15-2007, 03:39 PM   #2 (permalink)
Default Re: Run as instead of Run as Adminstrator
Use runas executable from the command prompt.

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm


workinghard@news.postalias wrote:
Quote:
> Hello,
>
> Local admins only get the option to "Run as Admin" when using right-click,
> which uses the account with admin rights they are logged in with. How can we
> enable them to choose an alternative domain account with priviledges for
> like running Exchange or AD admin tools on administrative workstations?
>
> Thx!
>
> Cheers
>
>
Joe Richards [MVP]
Guest
 
Posts: n/a
Reply With Quote  
Old 01-15-2007, 04:11 PM   #3 (permalink)
Default Re: Run as instead of Run as Adminstrator
Yes, sure that works, making custom shortcuts etc ... but is there any way
to add it to the contect menu using the registry a lot of folks would
appreciate that.

Cheers


"Joe Richards [MVP]" <humorexpress@hotmail.com> wrote in message
news:OTwr3OMOHHA.780@TK2MSFTNGP03.phx.gbl...
Quote:
> Use runas executable from the command prompt.
>
> --
> Joe Richards Microsoft MVP Windows Server Directory Services
> Author of O'Reilly Active Directory Third Edition
> www.joeware.net
>
>
> ---O'Reilly Active Directory Third Edition now available---
>
> http://www.joeware.net/win/ad3e.htm
>
>
> workinghard@news.postalias wrote:
Quote:
>> Hello,
>>
>> Local admins only get the option to "Run as Admin" when using
>> right-click, which uses the account with admin rights they are logged in
>> with. How can we enable them to choose an alternative domain account with
>> priviledges for like running Exchange or AD admin tools on administrative
>> workstations?
>>
>> Thx!
>>
>> Cheers

Guest
 
Posts: n/a
Reply With Quote  
Old 01-15-2007, 07:33 PM   #4 (permalink)
Default Re: Run as instead of Run as Adminstrator
Not that I am aware of.

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm


workinghard@news.postalias wrote:
Quote:
> Yes, sure that works, making custom shortcuts etc ... but is there any way
> to add it to the contect menu using the registry a lot of folks would
> appreciate that.
>
> Cheers
>
>
> "Joe Richards [MVP]" <humorexpress@hotmail.com> wrote in message
> news:OTwr3OMOHHA.780@TK2MSFTNGP03.phx.gbl...
Quote:
>> Use runas executable from the command prompt.
>>
>> --
>> Joe Richards Microsoft MVP Windows Server Directory Services
>> Author of O'Reilly Active Directory Third Edition
>> www.joeware.net
>>
>>
>> ---O'Reilly Active Directory Third Edition now available---
>>
>> http://www.joeware.net/win/ad3e.htm
>>
>>
>> workinghard@news.postalias wrote:
Quote:
>>> Hello,
>>>
>>> Local admins only get the option to "Run as Admin" when using
>>> right-click, which uses the account with admin rights they are logged in
>>> with. How can we enable them to choose an alternative domain account with
>>> priviledges for like running Exchange or AD admin tools on administrative
>>> workstations?
>>>
>>> Thx!
>>>
>>> Cheers
>
>
Joe Richards [MVP]
Guest
 
Posts: n/a
Reply With Quote  
Old 01-15-2007, 11:16 PM   #5 (permalink)
Default Re: Run as instead of Run as Adminstrator
Certainly an option but I would way go for using the cmd prompt and
running runas there. Likely I could start up an admin tool faster that
way then someone could do it via the GUI anyway.


--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm


Jesper wrote:
Quote:
> Shoulda mentioned that you need to hard-code the username in there, and
> remove the one I put in which is a dummy test account.
>
> "Jesper" wrote:
>
Quote:
>> Actually, there is, sort of. I wrote a couple of shell add-ons for the old
>> command prompt here to get an elevated command prompt. The same process can
>> be used here. If you export this to a reg file and import it, you will get a
>> Run As this app on the context menu for executables
>> Windows Registry Editor Version 5.00
>>
>> [HKEY_CLASSES_ROOT\exefile\shell\cRunas]
>> @="Run As this app"
>>
>> [HKEY_CLASSES_ROOT\exefile\shell\cRunas\command]
>> @="runas.exe /user:ant\\jesperAD \"%1\""
>>
>> If you want the old command prompt here, you import this file:
>> Windows Registry Editor Version 5.00
>>
>> [HKEY_CLASSES_ROOT\Directory\shell\CmdHere]
>> @="Command Prompt Here"
>>
>> [HKEY_CLASSES_ROOT\Directory\shell\CmdHere\command]
>> @="cmd.exe /k cd \"%1\""
>>
>> Both of these will be running with the normal token for that user. In other
>> words, if you runas an admin in admin approval mode, you get a low admin
>> token. To get an elevated token you would need an app that can elevate
>> arbitrary processes on the command line. I wrote one of those for the Windows
>> Vista Security book, but it is not quite ready for prime time yet.
>>
>> "Joe Richards [MVP]" wrote:
>>
Quote:
>>> Not that I am aware of.
>>>
>>> --
>>> Joe Richards Microsoft MVP Windows Server Directory Services
>>> Author of O'Reilly Active Directory Third Edition
>>> www.joeware.net
>>>
>>>
>>> ---O'Reilly Active Directory Third Edition now available---
>>>
>>> http://www.joeware.net/win/ad3e.htm
>>>
>>>
>>> workinghard@news.postalias wrote:
>>>> Yes, sure that works, making custom shortcuts etc ... but is there any way
>>>> to add it to the contect menu using the registry a lot of folks would
>>>> appreciate that.
>>>>
>>>> Cheers
>>>>
>>>>
>>>> "Joe Richards [MVP]" <humorexpress@hotmail.com> wrote in message
>>>> news:OTwr3OMOHHA.780@TK2MSFTNGP03.phx.gbl...
>>>>> Use runas executable from the command prompt.
>>>>>
>>>>> --
>>>>> Joe Richards Microsoft MVP Windows Server Directory Services
>>>>> Author of O'Reilly Active Directory Third Edition
>>>>> www.joeware.net
>>>>>
>>>>>
>>>>> ---O'Reilly Active Directory Third Edition now available---
>>>>>
>>>>> http://www.joeware.net/win/ad3e.htm
>>>>>
>>>>>
>>>>> workinghard@news.postalias wrote:
>>>>>> Hello,
>>>>>>
>>>>>> Local admins only get the option to "Run as Admin" when using
>>>>>> right-click, which uses the account with admin rights they are logged in
>>>>>> with. How can we enable them to choose an alternative domain account with
>>>>>> priviledges for like running Exchange or AD admin tools on administrative
>>>>>> workstations?
>>>>>>
>>>>>> Thx!
>>>>>>
>>>>>> Cheers
>>>>
Joe Richards [MVP]
Guest
 
Posts: n/a
Reply With Quote  
Old 01-16-2007, 02:50 AM   #6 (permalink)
Default Re: Run as instead of Run as Adminstrator
No doubt an elevated command prompt is far faster when you need to run
several tasks. That's why I liked the idea of being able to right-click a
folder and open an elevated command prompt there.

"Joe Richards [MVP]" wrote:
Quote:
> Certainly an option but I would way go for using the cmd prompt and
> running runas there. Likely I could start up an admin tool faster that
> way then someone could do it via the GUI anyway.
>
>
> --
> Joe Richards Microsoft MVP Windows Server Directory Services
> Author of O'Reilly Active Directory Third Edition
> www.joeware.net
>
>
> ---O'Reilly Active Directory Third Edition now available---
>
> http://www.joeware.net/win/ad3e.htm
>
>
> Jesper wrote:
Quote:
> > Shoulda mentioned that you need to hard-code the username in there, and
> > remove the one I put in which is a dummy test account.
> >
> > "Jesper" wrote:
> >
Quote:
> >> Actually, there is, sort of. I wrote a couple of shell add-ons for the old
> >> command prompt here to get an elevated command prompt. The same process can
> >> be used here. If you export this to a reg file and import it, you will get a
> >> Run As this app on the context menu for executables
> >> Windows Registry Editor Version 5.00
> >>
> >> [HKEY_CLASSES_ROOT\exefile\shell\cRunas]
> >> @="Run As this app"
> >>
> >> [HKEY_CLASSES_ROOT\exefile\shell\cRunas\command]
> >> @="runas.exe /user:ant\\jesperAD \"%1\""
> >>
> >> If you want the old command prompt here, you import this file:
> >> Windows Registry Editor Version 5.00
> >>
> >> [HKEY_CLASSES_ROOT\Directory\shell\CmdHere]
> >> @="Command Prompt Here"
> >>
> >> [HKEY_CLASSES_ROOT\Directory\shell\CmdHere\command]
> >> @="cmd.exe /k cd \"%1\""
> >>
> >> Both of these will be running with the normal token for that user. In other
> >> words, if you runas an admin in admin approval mode, you get a low admin
> >> token. To get an elevated token you would need an app that can elevate
> >> arbitrary processes on the command line. I wrote one of those for the Windows
> >> Vista Security book, but it is not quite ready for prime time yet.
> >>
> >> "Joe Richards [MVP]" wrote:
> >>
> >>> Not that I am aware of.
> >>>
> >>> --
> >>> Joe Richards Microsoft MVP Windows Server Directory Services
> >>> Author of O'Reilly Active Directory Third Edition
> >>> www.joeware.net
> >>>
> >>>
> >>> ---O'Reilly Active Directory Third Edition now available---
> >>>
> >>> http://www.joeware.net/win/ad3e.htm
> >>>
> >>>
> >>> workinghard@news.postalias wrote:
> >>>> Yes, sure that works, making custom shortcuts etc ... but is there any way
> >>>> to add it to the contect menu using the registry a lot of folks would
> >>>> appreciate that.
> >>>>
> >>>> Cheers
> >>>>
> >>>>
> >>>> "Joe Richards [MVP]" <humorexpress@hotmail.com> wrote in message
> >>>> news:OTwr3OMOHHA.780@TK2MSFTNGP03.phx.gbl...
> >>>>> Use runas executable from the command prompt.
> >>>>>
> >>>>> --
> >>>>> Joe Richards Microsoft MVP Windows Server Directory Services
> >>>>> Author of O'Reilly Active Directory Third Edition
> >>>>> www.joeware.net
> >>>>>
> >>>>>
> >>>>> ---O'Reilly Active Directory Third Edition now available---
> >>>>>
> >>>>> http://www.joeware.net/win/ad3e.htm
> >>>>>
> >>>>>
> >>>>> workinghard@news.postalias wrote:
> >>>>>> Hello,
> >>>>>>
> >>>>>> Local admins only get the option to "Run as Admin" when using
> >>>>>> right-click, which uses the account with admin rights they are logged in
> >>>>>> with. How can we enable them to choose an alternative domain account with
> >>>>>> priviledges for like running Exchange or AD admin tools on administrative
> >>>>>> workstations?
> >>>>>>
> >>>>>> Thx!
> >>>>>>
> >>>>>> Cheers
> >>>>
>
Jesper
Guest
 
Posts: n/a
Reply With Quote  
Old 02-14-2007, 10:13 PM   #7 (permalink)
Default Re: Run as instead of Run as Adminstrator
Hi Joe,

If I try this logged in as a user who is a member of the Administrators
group, the RunAs command does NOT allow elevation. For example if I log
in as MACHINE\LocalAdmin (with UAC enabled) then start a command prompt
as "Administrator", then try to RUNAS gpmc and enter my domain admin
credentials, it's gives an error saying it can't elevate...

Joe Richards [MVP] wrote:
Quote:
> Certainly an option but I would way go for using the cmd prompt and
> running runas there. Likely I could start up an admin tool faster that
> way then someone could do it via the GUI anyway.
>
>
> --
> Joe Richards Microsoft MVP Windows Server Directory Services
> Author of O'Reilly Active Directory Third Edition
> www.joeware.net
>
>
> ---O'Reilly Active Directory Third Edition now available---
>
> http://www.joeware.net/win/ad3e.htm
>
>
> Jesper wrote:
Quote:
>> Shoulda mentioned that you need to hard-code the username in there,
>> and remove the one I put in which is a dummy test account.
>> "Jesper" wrote:
>>
Quote:
>>> Actually, there is, sort of. I wrote a couple of shell add-ons for
>>> the old command prompt here to get an elevated command prompt. The
>>> same process can be used here. If you export this to a reg file and
>>> import it, you will get a Run As this app on the context menu for
>>> executables
>>> Windows Registry Editor Version 5.00
>>>
>>> [HKEY_CLASSES_ROOT\exefile\shell\cRunas]
>>> @="Run As this app"
>>>
>>> [HKEY_CLASSES_ROOT\exefile\shell\cRunas\command]
>>> @="runas.exe /user:ant\\jesperAD \"%1\""
>>>
>>> If you want the old command prompt here, you import this file:
>>> Windows Registry Editor Version 5.00
>>>
>>> [HKEY_CLASSES_ROOT\Directory\shell\CmdHere]
>>> @="Command Prompt Here"
>>>
>>> [HKEY_CLASSES_ROOT\Directory\shell\CmdHere\command]
>>> @="cmd.exe /k cd \"%1\""
>>>
>>> Both of these will be running with the normal token for that user. In
>>> other words, if you runas an admin in admin approval mode, you get a
>>> low admin token. To get an elevated token you would need an app that
>>> can elevate arbitrary processes on the command line. I wrote one of
>>> those for the Windows Vista Security book, but it is not quite ready
>>> for prime time yet.
>>> "Joe Richards [MVP]" wrote:
>>>
>>>> Not that I am aware of.
>>>>
>>>> --
>>>> Joe Richards Microsoft MVP Windows Server Directory Services
>>>> Author of O'Reilly Active Directory Third Edition
>>>> www.joeware.net
>>>>
>>>>
>>>> ---O'Reilly Active Directory Third Edition now available---
>>>>
>>>> http://www.joeware.net/win/ad3e.htm
>>>>
>>>>
>>>> workinghard@news.postalias wrote:
>>>>> Yes, sure that works, making custom shortcuts etc ... but is there
>>>>> any way to add it to the contect menu using the registry a lot of
>>>>> folks would appreciate that.
>>>>>
>>>>> Cheers
>>>>>
>>>>>
>>>>> "Joe Richards [MVP]" <humorexpress@hotmail.com> wrote in message
>>>>> news:OTwr3OMOHHA.780@TK2MSFTNGP03.phx.gbl...
>>>>>> Use runas executable from the command prompt.
>>>>>>
>>>>>> --
>>>>>> Joe Richards Microsoft MVP Windows Server Directory Services
>>>>>> Author of O'Reilly Active Directory Third Edition
>>>>>> www.joeware.net
>>>>>>
>>>>>>
>>>>>> ---O'Reilly Active Directory Third Edition now available---
>>>>>>
>>>>>> http://www.joeware.net/win/ad3e.htm
>>>>>>
>>>>>>
>>>>>> workinghard@news.postalias wrote:
>>>>>>> Hello,
>>>>>>>
>>>>>>> Local admins only get the option to "Run as Admin" when using
>>>>>>> right-click, which uses the account with admin rights they are
>>>>>>> logged in with. How can we enable them to choose an alternative
>>>>>>> domain account with priviledges for like running Exchange or AD
>>>>>>> admin tools on administrative workstations?
>>>>>>>
>>>>>>> Thx!
>>>>>>>
>>>>>>> Cheers
>>>>>

--
Gerry Hickman (London UK)
Gerry Hickman
Guest
 
Posts: n/a
Reply With Quote  
Old 02-15-2007, 12:55 AM   #8 (permalink)
Default Re: Run as instead of Run as Adminstrator
same issue here. Can,t elevate with the RUN AS ADMIN command. What gives ?

Dan
Sudbury, Canada
Daniel Côté
Guest
 
Posts: n/a
Reply With Quote  
Old 02-17-2007, 09:08 PM   #9 (permalink)
Default Re: Run as instead of Run as Adminstrator
What if you launch the command prompt elevated and that is where you use
runas to fire gpmc...



--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm


Gerry Hickman wrote:
Quote:
> Hi Joe,
>
> If I try this logged in as a user who is a member of the Administrators
> group, the RunAs command does NOT allow elevation. For example if I log
> in as MACHINE\LocalAdmin (with UAC enabled) then start a command prompt
> as "Administrator", then try to RUNAS gpmc and enter my domain admin
> credentials, it's gives an error saying it can't elevate...
>
> Joe Richards [MVP] wrote:
Quote:
>> Certainly an option but I would way go for using the cmd prompt and
>> running runas there. Likely I could start up an admin tool faster that
>> way then someone could do it via the GUI anyway.
>>
>>
>> --
>> Joe Richards Microsoft MVP Windows Server Directory Services
>> Author of O'Reilly Active Directory Third Edition
>> www.joeware.net
>>
>>
>> ---O'Reilly Active Directory Third Edition now available---
>>
>> http://www.joeware.net/win/ad3e.htm
>>
>>
>> Jesper wrote:
Quote:
>>> Shoulda mentioned that you need to hard-code the username in there,
>>> and remove the one I put in which is a dummy test account.
>>> "Jesper" wrote:
>>>
>>>> Actually, there is, sort of. I wrote a couple of shell add-ons for
>>>> the old command prompt here to get an elevated command prompt. The
>>>> same process can be used here. If you export this to a reg file and
>>>> import it, you will get a Run As this app on the context menu for
>>>> executables
>>>> Windows Registry Editor Version 5.00
>>>>
>>>> [HKEY_CLASSES_ROOT\exefile\shell\cRunas]
>>>> @="Run As this app"
>>>>
>>>> [HKEY_CLASSES_ROOT\exefile\shell\cRunas\command]
>>>> @="runas.exe /user:ant\\jesperAD \"%1\""
>>>>
>>>> If you want the old command prompt here, you import this file:
>>>> Windows Registry Editor Version 5.00
>>>>
>>>> [HKEY_CLASSES_ROOT\Directory\shell\CmdHere]
>>>> @="Command Prompt Here"
>>>>
>>>> [HKEY_CLASSES_ROOT\Directory\shell\CmdHere\command]
>>>> @="cmd.exe /k cd \"%1\""
>>>>
>>>> Both of these will be running with the normal token for that user.
>>>> In other words, if you runas an admin in admin approval mode, you
>>>> get a low admin token. To get an elevated token you would need an
>>>> app that can elevate arbitrary processes on the command line. I
>>>> wrote one of those for the Windows Vista Security book, but it is
>>>> not quite ready for prime time yet.
>>>> "Joe Richards [MVP]" wrote:
>>>>
>>>>> Not that I am aware of.
>>>>>
>>>>> --
>>>>> Joe Richards Microsoft MVP Windows Server Directory Services
>>>>> Author of O'Reilly Active Directory Third Edition
>>>>> www.joeware.net
>>>>>
>>>>>
>>>>> ---O'Reilly Active Directory Third Edition now available---
>>>>>
>>>>> http://www.joeware.net/win/ad3e.htm
>>>>>
>>>>>
>>>>> workinghard@news.postalias wrote:
>>>>>> Yes, sure that works, making custom shortcuts etc ... but is there
>>>>>> any way to add it to the contect menu using the registry a lot of
>>>>>> folks would appreciate that.
>>>>>>
>>>>>> Cheers
>>>>>>
>>>>>>
>>>>>> "Joe Richards [MVP]" <humorexpress@hotmail.com> wrote in message
>>>>>> news:OTwr3OMOHHA.780@TK2MSFTNGP03.phx.gbl...
>>>>>>> Use runas executable from the command prompt.
>>>>>>>
>>>>>>> --
>>>>>>> Joe Richards Microsoft MVP Windows Server Directory Services
>>>>>>> Author of O'Reilly Active Directory Third Edition
>>>>>>> www.joeware.net
>>>>>>>
>>>>>>>
>>>>>>> ---O'Reilly Active Directory Third Edition now available---
>>>>>>>
>>>>>>> http://www.joeware.net/win/ad3e.htm
>>>>>>>
>>>>>>>
>>>>>>> workinghard@news.postalias wrote:
>>>>>>>> Hello,
>>>>>>>>
>>>>>>>> Local admins only get the option to "Run as Admin" when using
>>>>>>>> right-click, which uses the account with admin rights they are
>>>>>>>> logged in with. How can we enable them to choose an alternative
>>>>>>>> domain account with priviledges for like running Exchange or AD
>>>>>>>> admin tools on administrative workstations?
>>>>>>>>
>>>>>>>> Thx!
>>>>>>>>
>>>>>>>> Cheers
>>>>>>
>
>
Joe Richards [MVP]
Guest
 
Posts: n/a
Reply With Quote  
Old 02-19-2007, 08:05 PM   #10 (permalink)
Default Re: Run as instead of Run as Adminstrator
here is how to change that behavior

http://www.windowsconnected.com/blog...nistrator.aspx

josh
http://windowsconnected.com

"Daniel Côté" <d.cote04@sympatico.ca> wrote in message
news:eHoMPRKUHHA.4668@TK2MSFTNGP04.phx.gbl...
Quote:
> same issue here. Can,t elevate with the RUN AS ADMIN command. What gives ?
> Dan
> Sudbury, Canada
Josh Phillips
Guest
 
Posts: n/a
Reply With Quote  
Reply

Edit Tags
Tags
None

« Smartcard support in MS Windows Vista | spyware - msvcr71 and msvcp71 »
Thread Tools
Display Modes
Linear Mode Linear Mode

Posting Rules
You may not post new threads
You may post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


Similar Threads

Thread Thread Starter Forum Replies Last Post
Remote Adminstrator with a firewall Hubert Windows XP Work Remotely 7 07-16-2005 08:09 AM
Adminstrator A/c problem MartynB Windows XP Configuration & Management 0 01-12-2005 01:59 PM
adminstrator problem Richard Windows XP Help & Support 1 10-18-2003 06:05 PM
adminstrator password Michael Solomon \(MS-MVP-Windows Shell/User\) Windows XP Accessibility 0 07-18-2003 02:45 AM
ADMINSTRATOR AND ALL USERS DELETED Lia Windows XP Security & Administration 0 07-01-2003 12:32 AM


All times are GMT. The time now is 12:25 PM.

Contact Us - Real Geek - Archive - Top

Powered by vBulletin® Version 3.7.1
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Copyright © 2005 - 2007 RealGeek.com. All rights reserved.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48