This chapter is from the book
This chapter is from the book
This chapter is from the book
Managing Resources Using the Run As Command
The Run As feature gives administrators (and other users) the ability to run programs and system utilities under the security credentials of one user while being logged on to the server as a different user. For example, an administrator named DanB can be logged on to a server or a workstation with an ordinary user account that is only a member of the Domain Users group. While logged on as the ordinary user, DanB, he can right-click any MMC snap-in tool, such as ADUC (dsa.msc), and select Run As from the pop-up menu. The Run As dialog box appears with two options to run this program—Current User (with Restricted Access) and the Following User. By selecting the second option and typing in the appropriate administrative username and password (see Figure 2.10), DanB can log in using the alternate credentials without logging out of the machine.
)
Figure 2.10 Running a program as a different user with the Run As right-click menu option.
You can use the Run As command for all types of programs, utilities, and even Control Panel applets. For using Run As on Control Panel tools, hold down the Shift key while you right-click a Control Panel icon to display the Run As option. You might need to hold down the Shift key while you right-click to access the Run As option for other applications as well. Using Run As is a more secure way for accessing security-sensitive utilities rather than always logging on to systems as a user who is a member of the Administrators group.
You can even use the Run As command to launch an instance of the Windows Explorer under the security credentials of a different user. For example, if you are currently logged on as JoeUser, at a command prompt or at the Start, Run box, you can type runas /noprofile /user:domain1\administrator explorer.exe to launch an Explorer window under the security context of Domain1's Administrator account. Any folders or files that you access from that Explorer window are subject to the Access Control List (ACL) for the Administrator user account, not the ACL for JoeUser.
Using Run As from the Command Line
You can also use the Run As feature from a command window, both for GUI tools as well as for command-line tools. For example, you can run the Computer Management console as the administrator for the Windows2003.local domain by clicking Start, Run; typing runas /user:windows2003\administrator "mmc %windir%\system32\compmgmt.msc" in the Open box; and clicking OK. From a command prompt, you can type runas /? and press Enter to view the many options and syntax for this command.
You can also open a command-prompt window as a different user—as the administrator for a domain named Windows2003.local, for example—by clicking Start, Run; typing runas /user:windows2003\administrator cmd.exe in the Open box; and clicking OK. In addition, you can create shortcuts to administrative tools that require the administrator's password to run. For an example of how to create such a shortcut, follow these steps:
- Right-click the Windows desktop and select New, Shortcut.
- Type a command string such as runas /user:windows2003\administrator "mmc %windir%\system32\compmgmt.msc" in the Type the Location of the Item box.
- Click Next.
- Input a name for the shortcut in the Type a Name for This Shortcut box, such as Admin Computer Mgmt.
- Click Finish.
When you double-click the shortcut, you are prompted for the administrator password. If you do not type in the correct password for the administrator user account, the program (Computer Management, in this example) does not run.