2

I am trying to use runas in a PowerShell function to serve as a poor man's sudo, but runas doesn't seem to actually give me admin access. For example, I get an access denied when running:

runas /user:admin "cmd /K mkdir C:\Windows\System32\mydirectory"

Also, if I open vim and try to write a file to System32, it gives me an error when I save:

runas /user:admin "C:\Program Files (x86)\Vim\vim74\gvim.exe C:\Windows\System32\mynewtextfile.txt"

I don't think it's a credentials issue, because I can do non-admin tasks like write files to the desktop, and my password seem to work ok. I checked in the "Computer Management" tool in the Administrative Tools, and "admin" is in the "Administrators" group. What am I missing? I am on Windows 7 Pro.

3
  • 1
    Here runas is not a powershell function. If in powershell, try > @powershell saps -credential yourdomain\admin cmd '/K mkdir C:\Windows\System32\mydirectory' -verb runas. – chingNotCHing Jan 9 '17 at 3:42
  • Thanks, Start-Process/saps is what I ended up using. What does the @powershell syntax do? – xdhmoore Jan 9 '17 at 4:42
  • Nevermind, I found it. – xdhmoore Jan 9 '17 at 4:53
0

Following my investigation in Windows 10, the following commands WORK:

Elevation:

saps -Verb RunAs "cmd" -Arg "/K mkdir C:\Windows\System32\mydirectory"

Switching users:

saps -Verb RunAsUser "cmd" -Arg "/K mkdir C:\Windows\System32\mydirectory"

The following commands DO NOT WORK:

  • runas /user:admin "cmd /K mkdir C:\Windows\System32\mydirectory" – This does not result in elevation of privileges
  • saps -Credential admin "cmd" -Arg "/K mkdir C:\Windows\System32\mydirectory" – This does not result in elevation of privileges
  • New-Item -Credential admin "C:\Windows\System32\mydirectory" – The FileSystem provider does not support alternative credentials except for New-PSDrive cmdlet.
0

I found the following info in the get-help -full start-process documentation:

# Starts a PowerShell process with "Run as Administrator" permissions.

PS C:>start-process powershell.exe -verb runas

The best I can tell, runas.exe can change your user but will not elevate your permissions. However, based on the above quote, powershell's Start-Process process can be used to do this, so I ended up doing the following in my sudo function, which seems to be working well enough:

$MY_PROFILE_TMP="$Env:TMP\my_profile_tmp";
Function Init-TMP() {
   #Make sure my personal tmp directory exists
   if (!(Test-Path $MY_PROFILE_TMP)) {
      mkdir $MY_PROFILE_TMP | Out-Null
   }
}

Function As-Admin() {
   Init-TMP

   #Create unique temp filenames to capture stderr and stdout
   $GUID=New-Guid
   $ADMIN_OUT="$MY_PROFILE_TMP\$($GUID)_OUT.txt"
   $ADMIN_ERR="$MY_PROFILE_TMP\$($GUID)_ERR.txt"

   #Remove temp files if for some anomoly or error they already exist
   rm -ErrorAction Ignore $ADMIN_OUT
   rm -ErrorAction Ignore $ADMIN_ERR

   #Start powershell with elevated permissions and write to the tmp out and error files
   #Without the &{}, invalid commands like `sudo dinosaur` don't get
   #captured to the error file
   Start-Process powershell "& { $args } 2>$ADMIN_ERR > $ADMIN_OUT" -Verb runas -Wait -WindowStyle Hidden

   #Write to the current console the out and error results from the elevated process
   #TODO ideally, we'd read from these as a stream  so the order would be correct...
   cat $ADMIN_ERR -Delimiter None | Write-Error
   cat $ADMIN_OUT

   #Remove the temp files
   rm -ErrorAction Ignore $ADMIN_OUT
   rm -ErrorAction Ignore $ADMIN_ERR
}

#Make an alias "sudo"
New-Alias -Name sudo -Value As-Admin
2
  • How are we supposed to use this lengthy script? And why "Start-Process powershell"? From the question, it is other commands that are supposed to start, not PowerShell. – user477799 Jan 9 '17 at 5:46
  • It is used semi-similarly to *nix sudo: sudo "mkdir C:\Windows\System32\followthewhiterabbit". Start-Process is used because, as chingNotCHing mentioned, it's -Verb runas option gives you elevated permissions that the exe runas does not. My goal is to run powershell commands (including functions), so I use Start-Process to start an elevated powershell to run my commands. The script is long because originally when using runas I couldn't find a better way to capture the output other than writing to a tmp file. With Start-Process perhaps there is a better way. – xdhmoore Jan 9 '17 at 6:05
-1

Do you have UAC on? If so, are you running the PowerShell script from an elevated prompt?

The runas command is subject to the UAC restrictions of its parent command window. If you didn't invoke the runas command from an elevated prompt, the user won't have elevated credentials even if it's an administrative account.

Unfortunately, this is just how UAC works. The only difference is that a CLI application (such as runas) cannot prompt for elevation when it needs to the way a GUI program can. There is no Windows equivalent to the sudo command in *NIX operating systems.

2
  • This is not a solution to the problem. It is what we already know from the question. – user477799 Jan 9 '17 at 5:41
  • Yes, UAC is on. .No, I am not running from an elevated prompt. – xdhmoore Jan 9 '17 at 5:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.