robert_mckee
asked on
Runas and explorer instance
Hello I am trying to do the runas command on any XP or 2000 machine. I have been using a command such as runas /user:domain\administrator
as this was clsoe to what I wanted but still did not work. I did not try the regedit response because I do not want to do that on every machine I want to use this command on. isn't there a easier way? Thanks!
as this was clsoe to what I wanted but still did not work. I did not try the regedit response because I do not want to do that on every machine I want to use this command on. isn't there a easier way? Thanks!
I dont think runas command line is available on Windows 2000 boxes. I is available only with shift+<right click>.
ASKER
Thanks JD and rmrustice! I tried your response JD and it did not work. rmrustice I am not sure what you are saying "I is available only with shift+<right click>" . So the question is still up for grabs with a Point increase! Maybe Leew knows?
robert_mckee-
I have another idea. Open up My Computer (or any explorer instance) and click Tools > Folder Options. Click the View tab and scroll down to 'Launch folder windows in a separate process.' If it is unchecked, check it. You will have to restart your computer for the changes to take effect. Then try to run the command again (both your way and the way I mentioned above).
I think that this may be the case because you are trying to open another window (with the server share) with different credentials than your normal logon. If Windows cannot launch another explorer.exe instance with different credentials, then it tries to process your command with your current credentials (which will fail).
BTW, I believe that the runas command actually is included in Win2K:
http://www.jsifaq.com/SUBF/Tip2500/rh2548.htm
Hope this helps.
JD
I have another idea. Open up My Computer (or any explorer instance) and click Tools > Folder Options. Click the View tab and scroll down to 'Launch folder windows in a separate process.' If it is unchecked, check it. You will have to restart your computer for the changes to take effect. Then try to run the command again (both your way and the way I mentioned above).
I think that this may be the case because you are trying to open another window (with the server share) with different credentials than your normal logon. If Windows cannot launch another explorer.exe instance with different credentials, then it tries to process your command with your current credentials (which will fail).
BTW, I believe that the runas command actually is included in Win2K:
http://www.jsifaq.com/SUBF/Tip2500/rh2548.htm
Hope this helps.
JD
I mean: you must hold shift and right click an icon in order to see the "Run As" option. You can try it on your start menu items.
Well. Im wondering why you want to do this. I think you want to install applications as administrator on your desktops. Am I right? There's a lot of ways for doing that. You can use Group Policy, or Scheduled Tasks.
ASKER
Thanks! Tried JD's way and get same results, get prompted for password and then nothing.
rmrustice: Thanks I was aware of the right click on icon, it is just that the command line seems to be easier because I work on different desktops/servers. Not only install apps but also to run admin apps as well, ADUC, DNS, view shares..etc.
rmrustice: Thanks I was aware of the right click on icon, it is just that the command line seems to be easier because I work on different desktops/servers. Not only install apps but also to run admin apps as well, ADUC, DNS, view shares..etc.
ASKER
As for JSI I tried all the ways mentioned and still no luck.
I have some nice tips. This will take some time to setup, but its free and works well.
Make a Scheduled Task and point it to an batch file on your netlogon share (can be anywhere). On the credentials, put an administrative account and password. Create a schedule configured to run from time to time (maybe on a 2 hours basis). When you want to install something on the network, just put it on the batch file. It will run as an administrator. If you want to run it only on some computers, you can call a external Windows Script file that filters which computer to run on. When the job is done, just remove the batch.
Remember: You can always publish applications using Active Directory so you can distribute it to your computers.
To run ADUC and other snap-ins:
Its acceptable to run those apps via runas, but you can just delegate access to some users if you need access from non-administrative accounts. You can delegate just the functions your users need.
Make a Scheduled Task and point it to an batch file on your netlogon share (can be anywhere). On the credentials, put an administrative account and password. Create a schedule configured to run from time to time (maybe on a 2 hours basis). When you want to install something on the network, just put it on the batch file. It will run as an administrator. If you want to run it only on some computers, you can call a external Windows Script file that filters which computer to run on. When the job is done, just remove the batch.
Remember: You can always publish applications using Active Directory so you can distribute it to your computers.
To run ADUC and other snap-ins:
Its acceptable to run those apps via runas, but you can just delegate access to some users if you need access from non-administrative accounts. You can delegate just the functions your users need.
ASKER
Sorry rmrustice but I do not see how a Scheduled Task running on a netlogon share is going to resolve what I am asking. I need more info to understand what you are saying.
This is what I was looking for, this is what I use for launching ADUC: "%windir%\system32\runas.e
This is what I was looking for, this is what I use for launching ADUC: "%windir%\system32\runas.e
For this part, i recommended using delegates. Its not safe to store administrative login info on a command line.
ASKER
Ok, for now I am just using this icon on my desktop. When I log into my machine my account does not have admin previledges so that is why I am wanting this information on how to create icons that launch certain apps that need admin rights. When I am on a server I log on as admin. Sorry if this was not understood up front.
So far I have not recieved any correct info and I am getting the feeling that this is not feasible from the command line. Thanks either way!
So far I have not recieved any correct info and I am getting the feeling that this is not feasible from the command line. Thanks either way!
We understood what you want. But I cant undertand why you want to do it this way. There are other ways for doing that. You can do it by delegating access to another user, or just right click and using Run As from the shortcut. Mapping a drive with an administrative account does not give you access to manage domain controllers with ADUC or other applet. With the proposed command, you will have full control on the destination folder, but will not have any other priviledges under applications. You should launch the applications directly using runas.exe, by command line or by right click.
You can use the same syntax, but call MMC.exe or a custom saved console instead of explorer.exe. On the console, you can add ADUC, DNS and others snap-ins.
To save your credentials, use the /savecred command line option.
You can use the same syntax, but call MMC.exe or a custom saved console instead of explorer.exe. On the console, you can add ADUC, DNS and others snap-ins.
To save your credentials, use the /savecred command line option.
ASKER
I was looking for a commandline solution. I was aware of the right click and the batch file solutions. Given that runas is a commandline command I did not think that it would be asking to much to use the runas and explorer together. I thought maybe I had forgotten a switch or was not typing it correctly that is why I asked the question.
ASKER
For the record I am only interested in a solution. I found this website that sheds light on the subject of the runas and explorer.exe. http://blogs.msdn.com/aaron_margosis/archive/2004/07/07/175488.aspx
I guess the bigger question is what are you trying to accomplish with this task?
If you just want to access a share with seperate credentials, simply use "net use" instead:
net use \\server\share * /user:Domain\Username
You will then be prompted for a password. Then simply do:
start \\server\share
And you will have the access of the user in the first step.
There is a cavaet as you can only have one connection to a server under one credential per login session. In other words, you will have to terminate any sessions to \\Server from the logged in session before running this command.
Also, later down on Aaron's blog, a user mentioned how you can use the '/separate' flag to accomplish the same task:
runas /user:Domain\Username "explorer.exe /seperate,\\server\share"
If you just want to access a share with seperate credentials, simply use "net use" instead:
net use \\server\share * /user:Domain\Username
You will then be prompted for a password. Then simply do:
start \\server\share
And you will have the access of the user in the first step.
There is a cavaet as you can only have one connection to a server under one credential per login session. In other words, you will have to terminate any sessions to \\Server from the logged in session before running this command.
Also, later down on Aaron's blog, a user mentioned how you can use the '/separate' flag to accomplish the same task:
runas /user:Domain\Username "explorer.exe /seperate,\\server\share"
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thanks SMFX and everyone else! This is what I am trying to do. When I am at a clients desktop and I do not want to log off and then logon as admin to install software. That is the immediate need that comes to mind. This way I get the install out of the way and see if the software runs correctly, unless I have to do a reboot. Yes I have used the net use command but I did not want to go back and use the net use command again with the delete switch to disconnect the drive or use explorer to right click the drive and disconnect that way. Whereas I just wanted to use the runas command and install software and walk a way. Thanks again SMFX your command works! I do not see where you mistyped anything though...?
sep*E*rate should have been sep*A*rate.
Glad it worked for you! Normally, I just do "runas /user:domain\username cmd.exe" and then just launch what I need from the new command prompt, but that's just me. Point and click can be faster on a lot of things.
Take Care,
-SMFX
Glad it worked for you! Normally, I just do "runas /user:domain\username cmd.exe" and then just launch what I need from the new command prompt, but that's just me. Point and click can be faster on a lot of things.
Take Care,
-SMFX
I toyed with this for a little bit and came across this. If you run the command correctly, it can work:
runas /user:Domain\UserName "explorer.exe \\ServerName\ShareName"
Note the quotes around the "explorer.exe share...". This allows the share name parameter to be passed to the new explorer.exe process.
Hope this helps.
JD