0

I am having trouble understanding what is going on with "runas".

Situation:

  • CLIENT is W10 Pro joined & logged in to Active Directory Domain FOODOM.
  • USER is member of FOODOM and default Domain-User, nothing elevated.
  • MYADMIN is member of FOODOM and member of Organization-Admin, Domain-Admin, etc. A typical Domain-Admin User.
  • UAC is enabled.
  • FOODOM\USER is logged in on CLIENT.

Problem:

FOODOM\MYADMIN is not allowed to runas with admin rights: from inside FOODOM\USER's session:

runas /user:FOODOM\MYADMIN cmd fails with "The requested operation requires elevation"

Hoewever, the built in administrator account works:

runas /user:FOODOM\Administrator cmd -> ok

FOODOM\MYADMIN can successfully login on CLIENT. When logged in, MYADMIN can run things with Domain Admin priveledges local and remote.

Thoughts: Am I missing some flag? None of the adminiatrive users we usually use can successfully invoke runas except built in administrator...? I suspect it only works because the local workstation is mixing up FOODOM\Administrator with .\Administrator?

Edit:

As the comments seem to ignore the real question, here as clarification: I am aware of elevation issues with UAC and are refering to DOMAIN Administrator, not the local one. What is the reason domain\Administrator actually CAN circumvent runas elevation while domain\someAdmin can NOT? LDAP Flag? Delegation? if(username==*\administrator) { do.secretElevationHack(); } ?

New contributor
R. Bitrary is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
0

While you can run a command as elevated by right-click and choosing "Run As Administrator", this does not work for runas.

The reason is that runas was created before elevation was invented, so it has no switch for running an elevated command.

An alternative is to invoke the UAC dialogue by calling the VBScript ShellExecute function.

For example, to run a batch script (.vbs) with elevated permissions, use the flag runas:

Set objShell = CreateObject("Shell.Application")
objShell.ShellExecute "cmd.exe","/k echo test", "", "runas", 1
  • Thanks for your explanation.However, domain\administrator CAN successfully elevate. It seems only other admin user cannot. Is that a specific flag/group which is missing or is it a built in feature that runas only allows elevation if username==administrator? – R. Bitrary Mar 25 at 15:15
  • If the built-in Administrator account is enabled, and you shift-right-click the executable or script you want to run with elevated rights, then Administrator will show in the account list. That's about all you can do if you are not a local admin yourself, short of taking ownership of the executable or script in question, which will cause other issues. As explained by harrymc, "run as" was designed to allow standard users to run programs installed by/for other standard users on shared machines. You can reintroduce "run as" in right-click menu, but you may be disappointed with how it fares – Didier Mar 25 at 15:59
  • Doing runas to an administrator account requires elevation. Elevation API didn't exist at the time that it was programmed, so it doesn't know how to do that. – harrymc Mar 25 at 16:04
  • @harrymc that is not correct and exactly the key of my question: runas elevation IS available for "domain\administrator" but not for "domain\someAdmin". I am not talking about local\Administrator. I am aware of that. But why is "domain\Administrator" able to elevate? Has the default "domain\Administrator" some Flag one could set with adsi-edit? Is it an invisible delegation? Or is "runas" doing some bad trickery if username == administrator? – R. Bitrary Mar 25 at 18:32
  • An administrator is always able to elevate, unlike a standard user. Therefore runas any administrator is equivalent to elevation. Is that what you are asking? – harrymc Mar 25 at 18:38

Your Answer

R. Bitrary is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.