On my Windows 10 system, Alice is a developer/administrator and Bob is a standard user. Alice has written a set of programs for Bob to use (
.bat files, and/or shortcuts that run
.py files in
python.exe). When Bob double-clicks these programs, they should run using Alice's (or some other elevated user's) filesystem permissions without Bob having to know that other user's password, or indeed do anything special beyond the initial double-click-to-launch. But at the same time, Bob should not be authorized to run anything else with altered permissions.
Here's a minimal example of the program I want to run, let's call it
:: This is WhiteHat.bat @echo User %1 is running this program as %USERNAME% @pause
All my research so far has pointed to
runas. So for example, Alice prepares the following file in the same folder as
::This is RunWhiteHatAsAlice.bat @runas /noprofile /user:%COMPUTERNAME%\Alice /savecred "%~dp0WhiteHat.bat \"%USERNAME%\""
The first time Bob double-clicks
RunWhiteHatAsAlice.bat, Alice is there to type in her password. Subsequently, Bob can double-click it without Alice present, and he will see:
User Bob is running this program as Alice
So far so good. But the problem is that Bob now seems to have permission to do anything as Alice. If he writes the following two files in his own home directory:
:: This is BlackHat.bat @echo User %1 is DELETING ALL FILES as %USERNAME% @pause
:: This is RunBlackHatAsAlice.bat @runas /noprofile /user:%COMPUTERNAME%\Alice /savecred "%~dp0BlackHat.bat \"%USERNAME%\""
then he appears to be able to use the saved credentials (which Alice intended for use only to run
WhiteHat.bat) to also run any arbitrary code in
I guess, therefore, that
runas is not the way to do what I want? Unless I have somehow missed the part of its documentation that explains how to limit the scope of what a user is allowed to do with saved credentials.
What is the appropriate way to do this?
Clarification: The real "white hat" application would of course cause changes to files on the filesystem (let's say it writes to
TheData.txt). I do not want to simply give Bob write permission on
TheData.txt. I want him to be able to change it, sure, but only according to the specific logic that is programmed into the batch/python files. I don't want him to be able to open it up in notepad and mess it up arbitrarily.