Bypass RunAs

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Dear All,

When a non-administrator wants to run an executable, Vista asks for an
adminstrator password.

If I want to allow an executable to run under a user without having to
provide an administrator password, is it possible/allowed in Vista?
 
Not if you want the executable to run as an administrator. There is no setuid
equivalent on Windows.

If you control the executable, the proper way to do that is to refactor the
executable into a service portion, which runs elevated and performs the
administrative tasks, and a user-mode portion that runs as the user.
 
The manifest governs how elevation is invoked (automatica, only for members
of the admins group, or not at all). It does not permit automatic,
password-less elevation of only certain apps.
 
Good point Alex. I didn't think of that. Does it actually do what setuid does
on Unix though? Does it let limited Windows users run administrative
applications?
 
The clear answer is that yes, it is possible. Make the program not require
administrative privileges. If it does require admin privileges, then it must
prompt the user.
 
Sorry about the response lag. ;)

I had originally just noted that it was possible to do this while installing
SUA on Vista; it has options for allowing setuid (and also sutoroot) during
install phase. I went back this morning and tried allowing setuid to work,
even reinstalling SUA, but I can't even find the binary - just the man page.

I think this is going to take someone who knows more about SUA to answer,
which kind of drives home the point that it isn't a practical solution for
most people. :)
 
Back
Top