8

I'm trying writing a batch file that needs to run some commands using a local admin account (start/stop a service) and some commands using the logged in user (copy files from the user directory) and I'm encountering problems. I have tried the following commands:

runas with /savecred

runas /user:(PC name)\(admin username) /savecred "net stop \"(service name)\""
runas /user:(PC name)\(admin username) /savecred "sc stop \"(service name)\""

When using /savecred I am not prompted for a password. Instead a command prompt window briefly flashes up and disappears. I am not able to tell what is in this window. The service is not stopped.

runas without /savecred

runas /user:(PC name)\(admin username) "net stop \"(service name)\""
runas /user:(PC name)\(admin username) "sc stop \"(service name)\""

These commands do prompt me for a password but then exhibit the same behaviour as the above commands - a command prompt window briefly pops up and the service is not stopped.

Ideally I would like to save the password for the session as I will need to run more commands with the details.

Is this possible and if so, what am I doing wrong?

  • add the "pause" command at the end to stop it cfrom closing – Martin Jan 23 '14 at 11:31
  • I already have a pause at the end of my batch file but the commands are launching another command prompt - I don't know how to stop that disappearing. – Stu Jan 23 '14 at 11:34
  • try to direct output to a file, and see if it prints something to it: "runas /user:(PC name)(admin username) "net stop \"(service name)\"" >> log.txt" – Martin Jan 23 '14 at 12:13
  • I have to run the command with the /savecred option otherwise the prompt for the password appears in the log file. If I run runas /user:(PC name)\(username) /savecred "net stop \"(service name)\"" >> log.txt nothing is output to the log file. – Stu Jan 23 '14 at 13:57
  • Check out Rob van der Woude's batch debugging page: robvanderwoude.com/battech_debugging.php. Most importantly, download LOGBATCH.BAT, and run it as such: LOGBATCH.BAT yourbatch.bat any_parameters_your_batch_needs and it will create a log file containing every command/action performed by yourbatch.bat Let us know what you see there. – JSanchez Jan 23 '14 at 17:21
11

You can add the following to your script and it will force it to run elevated. No need to download anything.

:: BatchGotAdmin
:-------------------------------------
REM  --> Check for permissions
>nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system"

REM --> If error flag set, we do not have admin.
if '%errorlevel%' NEQ '0' (
    echo Requesting administrative privileges...
    goto UACPrompt
) else ( goto gotAdmin )

:UACPrompt
    echo Set UAC = CreateObject^("Shell.Application"^) > "%temp%\getadmin.vbs"
    echo UAC.ShellExecute "%~s0", "", "", "runas", 1 >> "%temp%\getadmin.vbs"

    "%temp%\getadmin.vbs"
    exit /B

:gotAdmin
    if exist "%temp%\getadmin.vbs" ( del "%temp%\getadmin.vbs" )
    pushd "%CD%"
    CD /D "%~dp0"
:--------------------------------------
  • All this does is print Requesting administrative privileges... to the screen until it timesout. – The Muffin Man Jun 2 '14 at 21:47
  • @The Muffin Man. Add your commands at the end of the batch file and it will execute them after elevation. – pelms Aug 13 '14 at 15:15
  • 1
    this method is excellent. it requires no additional dependencies (like psexec). – William Oct 19 '15 at 14:45
  • Got into an infinite loop with that script... – JackTheKnife Nov 25 '16 at 18:45
0

split your batch file into two. The part you want to run as admincmd paste to system32. The part you want to run in normal cmd paste it in regular folder, & from here call the second batch file which is there is system32. This way the second part always runs in admincmd. I've tried it & it works for me.

0

If you don't mind third party software, you can try run as password runasspc. It will save your password into an encrypted file. Password need not be exposed in the batch file.

0

The "Runas" command will not "sudo" your command.

To do this from a batch file, you need to "elevate" the commands you are spawning. Download the Elevate Powertoy scripts.

http://technet.microsoft.com/en-us/magazine/2008.06.elevation.aspx

Launch your commands as:

runas /user:(PC name)\(admin username) /savecred "elevate.cmd net stop \"(service name)\""

or

runas /user:(PC name)\(admin username) /savecred "elevate sc stop \"(service name)\""
  • I have tried the following 3 commands: runas /user:$PcName\$Username /savecred "elevate.cmd sc stop \"$ServiceName\"", runas /user:$PcName\$Username /savecred "elevate.cmd net stop \"$ServiceName\"", runas /user:$PcName\$Username /savecred "elevate.cmd net stop $ServiceName" and each of them returns this error: RUNAS ERROR: Unable to run - elevate.cmd net stop alfrescoTomcat -2147467259: Unspecified error – Stu Jan 27 '14 at 10:00
  • 3 line batch file that will run command elevated: github.com/kasajian/pseudo – zumalifeguard Jun 19 '15 at 16:28
0

What I use is the following code:

::#################################################################################################################################
:: Elevate this script                                                                                                            #
::#################################################################################################################################

(
    :: Check Admin rights and create VBS Script to elevate
    >nul fsutil 2>&1 || (

        :: Very little red console
        mode con cols=80 lines=3 
        color cf

        :: Message
        title Please wait...
        echo.
        echo                         Requesting elevated shell...

        :: Create VBS script
        echo Set UAC = CreateObject^("Shell.Application"^)>"%TEMP%\elevate.vbs"
        echo UAC.ShellExecute "%~f0", "%TEMP%\elevate.vbs", "", "runas", 1 >>"%TEMP%\elevate.vbs"
        if exist "%TEMP%\elevate.vbs" start /b >nul cscript /nologo "%TEMP%\elevate.vbs" 2>&1
        exit /b
    )

    :: Delete elevation script if exist
    if exist "%~1" >nul del /f "%~1" 2>&1
)

pushd "%~dp0"

.... your code ....

popd

Put it after your @echo off and remarks.

0

Simplified answer (addition to user325534) if you only need to start working in some directory with evevated access:

@echo off

set MyWorkDir=D:\dev\

echo Requesting administrative privileges...

echo Set UAC = CreateObject^("Shell.Application"^) > "%temp%\getadmin.vbs"
echo UAC.ShellExecute "cmd", "/C start /D %MyWorkDir% cmd", "", "runas", 1 >> "%temp%\getadmin.vbs"

"%temp%\getadmin.vbs"
0

This code allows the cmd to ask for the user password. The user must type their password and then the executable.bat will be run as administrator

main.bat

@echo off
color 1f
Title Main
Goto start
:Start
runas /user:%username% executable.bat
pause

executable.bat

all code that runs as administrator

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.