0

Is there an option to ensure windows 10 automatically starts loading the Admin account without granting the user access to it? Essentially transferring the state of the admin account from not loaded, to loaded, whilst keeping it locked.

My XY-Problem: I'm trying to automatically run a program from an admin account right after startup. Without automatically giving access to the admin account at startup. So I would like to run the admin account in the background whilst staying locked.

My current solution is to run a .vbs script placed in the startup folder of the admin account that automatically locks the admin account after startup, but that is still a small security risk, people can delete that startup script before it has run, right after automatic sign in of the user account.

There are 2 users on the windows 10: user0 (admin) and user1 (non-admin)

A lot of similar solutions are provided, however, these all entail the password being typed in, or grant access to the admin account through the automatic sign in.

  • This is a case of telling us what your solution is to a problem, and then asking how to implement your solution rather than telling us the problem and asking how to solve the problem. You have an end goal here and it isn’t to have an admin account logged in in the background. – Appleoddity Dec 9 '17 at 17:30
  • You can look at it like that, where I have a problem implementing my solution. I have been taught mentioning your XY-Problem is good practice. It can convey boundary conditions and if someone has other suggestions it could be useful, also to other people stumbling across the same problem, And my core problem is not being able to automatically signing in/loading/running the Admin (in the background) whilst it remains locked. – a.t. Dec 9 '17 at 20:48
4

Imagine if you asked the question about a physical door instead of an account password.

Can I go through a door that is locked?

No. The best thing to do is to not ask such a silly question.

But I really want the door to be locked, except in this one specific scenario!

No. If something is locked, it's locked, for all scenarios or none.

The typically preferred way to run software as another user, in Microsoft Windows, is to use the "Runas" feature. From the command line, you can use the "Runas" command. From the (File) Explorer program, you can hold the Shift key down and right-click to use the GUI. These methods require interaction.

Other solutions involve downloading third party programs, like SudoWin (named after the wonderful "sudo" program built into many Unix platforms). Such software may install a service to help with these things.

There is one more possible option, which may seem not-very-straightforward, but is commonly recognized as the most convenient available option. Use Task Scheduler. Task Scheduler can elevate, and ask you for a password when the task is created, and then the task can be run by a non-elevated user. This may be a way to help get one account to run as another account.

However, if you want the account to be usable, I would imagine it may need to be unlocked. Giving the account a sufficiently complex password should prevent unauthorized usage, thereby giving you the security that you seek. Marking the account as being entirely unable to authenticate may provide further help in the goal of preventing unauthorized usage, but like a locked door, may also have a side effect of also affecting the desirable usage. I'm not familiar with any sort of built in functionality to support having you declare a desired "exception" that will work, and with Microsoft Windows being closed source software, sometimes the most sensible approach to using this software is to just accept the limitations of the way it was designed (or try alternate software -- in this case, a different operating system).

  • I appreciate your suggestions, the Task Scheduler seems a way to have something run behind a different door, automatically, whilst maintaining the the door closed, after the first opening. That's also where I believe the clear analogy could use some nuance, since the goal is to keep the door shut, in stead of opening the door at a specific time. Activating a light in the room, when a car enters the driveway, whilst the house door remains closed, after setting up the system, seems a more accurate analogy. Apparently there are multiple programs to make it happen, so thank you for the options! – a.t. Dec 9 '17 at 15:21

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.