On my Windows 10 system, Alice is a developer/administrator and Bob is a standard user. Alice has written a set of programs for Bob to use (.bat files, and/or shortcuts that run .py files in python.exe). When Bob double-clicks these programs, they should run using Alice's (or some other elevated user's) filesystem permissions without Bob having to know that other user's password, or indeed do anything special beyond the initial double-click-to-launch. But at the same time, Bob should not be authorized to run anything else with altered permissions.

Here's a minimal example of the program I want to run, let's call it WhiteHat.bat:

:: This is WhiteHat.bat
@echo User %1 is running this program as %USERNAME%

All my research so far has pointed to runas. So for example, Alice prepares the following file in the same folder as WhiteHat.bat:

::This is RunWhiteHatAsAlice.bat
@runas /noprofile /user:%COMPUTERNAME%\Alice /savecred  "%~dp0WhiteHat.bat \"%USERNAME%\""

The first time Bob double-clicks RunWhiteHatAsAlice.bat, Alice is there to type in her password. Subsequently, Bob can double-click it without Alice present, and he will see:

User Bob is running this program as Alice

So far so good. But the problem is that Bob now seems to have permission to do anything as Alice. If he writes the following two files in his own home directory:

:: This is BlackHat.bat


:: This is RunBlackHatAsAlice.bat
@runas /noprofile /user:%COMPUTERNAME%\Alice /savecred  "%~dp0BlackHat.bat \"%USERNAME%\""

then he appears to be able to use the saved credentials (which Alice intended for use only to run WhiteHat.bat) to also run any arbitrary code in BlackHat.bat.

I guess, therefore, that runas is not the way to do what I want? Unless I have somehow missed the part of its documentation that explains how to limit the scope of what a user is allowed to do with saved credentials.

What is the appropriate way to do this?

Clarification: The real "white hat" application would of course cause changes to files on the filesystem (let's say it writes to TheData.txt). I do not want to simply give Bob write permission on TheData.txt. I want him to be able to change it, sure, but only according to the specific logic that is programmed into the batch/python files. I don't want him to be able to open it up in notepad and mess it up arbitrarily.

  • "therefore, that runas is not the way to do what I want? " - Correct. "What is the appropriate way to do this?" - Give execute and read permission on specific files. It isn't clear the reason elevated permission are required to run a python script. – Ramhound Feb 11 at 18:06
  • @Ramhound see added "clarification" paragraph – jez Feb 11 at 18:13
  • Have you tried to disable write permissions on the .bat file, which you have configured, to always run with elevated permissions? You are not supposed to be able to run any process with saved the credentials. Although, since you are saving them, that might be the reason the user isn't being prompted when they attempt to run as that same user again. This would be where the group policy which defines a whitelist of which applications can be run on the system should be used. of course, that means they can't run anything you have not specifically allowed. – Ramhound Feb 11 at 18:17
  • @Ramhound yes, I have verified that Bob is unable to write to WhiteHat.bat, RunWhiteHatAsAlice.bat or the directory they are in. But at the same time, it seems he can successfully run RunWhiteHatAsAlice.bat and his own RunBlackHatAsAlice.bat. – jez Feb 11 at 18:23

I guess, therefore, that runas is not the way to do what I want?

That would be correct. If you save the credentials for a specific user, Windows isn't going to prompt for those credentials, since you specified they should be saved.

What is the appropriate way to do this?

Use the Access Control List and only allow the permissions on the files in question the user requires. There really isn't a good way to allow a process to access the file but not the user since, on Windows, the permissions of the process are that of the user.

A possible workaround is to prevent the unprivileged user to open any text editor. However, if you have a determined user seeking to alter the data file, that might be a rabbit hole you want to avoid.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.