How to prompt a user for run-as credentials when double-clicking an icon?

Question

I am running a kiosk type system where the user has almost zero permissions. I want to place an icon on their desktop that would run a specific program as their Active Directory credentials. I am familiar with SysInternals ShellRunAs, but it would require a right-click which means retraining users. Could I accomplish the same thing by having them double-click on the icon that they would get a prompt for username/password and then execute the program as that?

Answer 1

If PowerShell is an option for you, a PowerShell script can prompt for credentials and then use those credentials to start a process.

Start-Process -FilePath "C:\Windows\notepad.exe" -Credential (Get-Credential)

The user sees this prompt, and then the process is started.

Answer 2

You can modify the shortcut to use the command-line RunAs utility. For example, here's the target of a shortcut that will try to open a specific folder in explorer as the user BillyBob:

C:\Windows\System32\runas.exe /user:BillyBob "Explorer.exe F:\Projects"

The /user argument can also accept domain credentials (either hard-coded, or using the %USERDOMAIN% environment variable:

C:\Windows\System32\runas.exe /user:%USERDOMAIN%\BillyBob "Explorer.exe F:\Projects"\BillyBob "Explorer.exe F:\Projects"

The username can be an assigned to the %username% environment variable:

C:\Windows\System32\runas.exe /user:%username% "Explorer.exe F:\Projects"

Or, with both the domain and username coming from the environment:

C:\Windows\System32\runas.exe /user:%USERDOMAIN%\%username% "Explorer.exe F:\Projects"

Once the shortcut is opened, a cmd.exe window will show asking for the password of the specified account:

If you need the user to enter a username, then things get a little hackish and you have to put this in a .bat file:

@Echo Off

set INPUT=
set /P INPUT=Username: %=%
C:\Windows\System32\runas.exe /user:%INPUT% "Explorer.exe F:\Projects"

Answer 3

ShellRunAs doesn't strictly require a right-click; it can be (and in fact is) called as an ordinary tool with the original program given in the command-line – just like the built-in runas but graphical.

shellrunas notepad foo.txt

This could be used in a shortcut.