CorvettePower.COM
14Jul/04

Run as Normal User – Windows SUDO steps

I found a couple articles about how to configure your home system so that you don't have to be logged in as administrator on a daily basis, and then can launch specific applications as Administrator only when you need them. This is known in the computing world as a GOOD way to do things. Sadly most Windows applications require you to be Administrator to install software, and don't give you an option to provide an additional login/password (like when you join a machine to a domain). Here are the links and the key ways to setup applications to run as Administrator.http://blogs.msdn.com/jaybaz_ms/archive/2004/06/21/161609.aspx
http://blogs.msdn.com/jaybaz_MS/archive/2004/06/21/161724.aspx

I wish that .CPLs and .MSCs were smarter about normal users. I want to be a normal user, open a Control Panel applet, and have it prompt me for credentials if needed. Same thing for the administrative tools. I am going to create these as "Shortcuts" and put them in my user directory, and instead of Administrator, us %SUDOUSER% environment variable, so that I can set it per machine I'm on. Having CPL's and MSC's prompt for an elevated account would solve these problems. Sigh.

Here's what I do instead.

Control Panel
I create a set of shortcuts in a folder called “Control Panel”:

      runas.exe /user:Administrator "control access.cpl"

I even set the icon by pointing it back at the .CPL file.Administrative Tools
I do something similar with a folder called “Administrative Tools”:

      runas.exe /profile /user:Administrator "mmc %windir%\System32\compmgmt.msc"

Both folders go into the “Admin Tools“ folder, along with:

CMD w/ network

      runas.exe /env /user:Administrator "runas.exe /user:%USERDOMAIN%\%USERNAME% /env /netonly \"cmd\""

There’s a bug in Windows XP where certain controls running in this mode just won’t paint. It seems to be fixed in Windows Server 2003. Don’t know about Windows XP SP2.

CMD.EXE

      runas.exe /env /user:Administrator "cmd"

Explorer w/ network.
Enable “Launch folder windows in a separate process”, as both yourself & Administrator.

      runas.exe /env /user:Administrator "runas.exe /user:%USERDOMAIN%\%USERNAME% /env /netonly \"explorer\""

Task manager

      runas.exe /user:Administrator taskmgr.exe

Regedit

      runas.exe /user:Administrator regedit.exe –m

The Admin Tools folder then becomes a toolbar on my taskbar. With all this in place, I can get by as a normal user.

Trackbacks are disabled.