Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Up until now, I've always disabled UAC. Now, I'd like to play by the book and leave it on.

My test case is getting mkdir c:\program files\foo to work. When I run it (my user is an admin), I get Access is denied.

So, do runas /user:boom\administrator "mkdir c:\program files\foo", hoping this will help. I am prompted for a password. I hit ENTER, and get

RUNAS ERROR: Unable to run - mkdir c:\program files\foo 1327: Logon failure: user account restriction. Possible reasons are blank passwords not allowed, logon hour restrictions, or a policy restriction has been enforced.

Fine, I try to setup a password for the administrator user. I look it up in the users tab in task manager or in User Accounts --> Manage another account, and it's not there.

How should I proceed? Is trying to run mkdir under administrator is even the right track? Should I try to run it under SYSTEM?

As a side note, I also tried installing Sudo for Windows, but couldn't get it to work, nor could I find a simple "hello world" tutorial for it (This is the issue I ran into).

Update - OK, I found cmd.exe and right-clicked "run as Administartor", and was then able to change the password by running a privileged taskmgr from it. Still, when I run runas /user:administrator "mkdir foo" and type the password I get the same error. This is a brand new laptop, not connected to a domain, and the admin password is not blank.

Update 2 - This is Win 7 64 bit professional, and I want to do this all from the command line. My goal is to create a simple "sudo.bat" script.

share|improve this question
What edition of Windows 7 is this? – Ƭᴇcʜιᴇ007 Sep 1 '11 at 15:08

If you logged in account is an "administrator" then you should be able to right-click cmd.exe, "Run AS Administrator", Hit "OK" to UAC, and from there the mkdir should work in Program Files without any further prompting.

If you are not a admin user, and/or open the cmd in the regular user context (not "As Administrator"), then you'll be denied access to Program Files (as you have found).

Are you sure the error you're getting (once you are successfully using a known Administrator account/ password) with RunAs is the SAME error ("1327: Logon failure: user account restriction") and not "2: The system cannot find the file specified."?

Because I get error 2 when I try to RunAs MkDir (as an admin) because Mkdir is NOT an executable file (it's a system command), and that's all RunAs can launch.

You can use CMD.EXE in combination with RunAs, and then feed it the mkdir command. This is tricky due to nested double quotes, but in the end you should be able to use:

runas /user:administrator "cmd /C \"mkdir \"c:\\program files\\foo\"\""

From any command prompt (administrator or not) to pull off what you want.

(The extra backslashes are escape characters)

share|improve this answer
Yeah, I'm sure - I'm getting 1327 errors. – ripper234 Sep 1 '11 at 16:02
Then you are getting the password wrong, or your (actual) "Administrator" account is disabled. You should be able to check this via Start->Computer->Right-Click->Manage->Local Users and Group->Users. This may not work as-is on Home versions of 7, but you have yet to let us know what edition you're using. :) – Ƭᴇcʜιᴇ007 Sep 1 '11 at 16:06
The account was disabled, thanks! Now I just have to figure out how to make cmd /c not start in c:\windows\system32. (If I use a relative instead of absolute path as the argument to mkdir, it actually creates c:\windows\system32\foo) – ripper234 Sep 1 '11 at 16:16
Side note to his comment: If you are NOT running as admin but have the admin login you can Ctrl+Shift+right click on the cmd icon and Run as different user and provide credentials for the admin account to gain elevation. – Jeff F. Sep 1 '11 at 16:19
@ripper234 Yeah, when a CMD is opened as Administrator that's the path they get. You can use absolute paths as in my example, or perhaps chain a CD\WantedStartPath && Right before the mkdir? Something like runas /user:administrator "cmd /K \"cd \foo && md bar\"" – Ƭᴇcʜιᴇ007 Sep 1 '11 at 16:37

Try using PsExec, from sysinternals. Command like:

psexec -i -d -s cmd.exe

would run command line with System Account privileges.

share|improve this answer
Would it require a password? If not, then the whole point is moot - I want to be prompted for a password in order to escalate privileges, just like sudo in linux. – ripper234 Sep 1 '11 at 12:30
Windows uses current logon credentials and will not prompt as long as you are logged in. There is no elevation password like there is for Linux(users being sodoers). You either have rights to elevate or you don't. – Jeff F. Sep 1 '11 at 16:13

The easiest way is to:

  • open your Start menu

  • type cmd in the search, then press Ctrl+Shift+Enter

  • Accept the UAC prompt (this effectively is the same as running su)

  • type mkdir "c:\program files\foo"

share|improve this answer
I want to create a "sudo.bat" script that allows me to do this from the command line. – ripper234 Sep 1 '11 at 16:24
Ah, Ok, should have said that sooner :) – Jeff F. Sep 1 '11 at 16:41
F - What, can't you read my mind from over there? ;) – ripper234 Sep 1 '11 at 16:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .