The Runas command for launching programs on behalf of another user
For programs that are frequently launched on behalf of another user, it is inconvenient to press "Shift" and right-click every time. It is easier to use the special built-in Runas command. To do this, create a shortcut that will launch the required program on behalf of another computer user. You can read about how to create a shortcut here. In the "Object" field, enter the following command:
runas /user:пользователь программа
where,
user — the account from whose name the program needs to be launched. It is written in the format account_name@computer_name or computer_name\account_name, although just account_name also works.
program — the name of the executable file that we want to launch. If the executable file is not in the system environment variables, you must specify the full path to it.
runas /user:Андрей notepad.exe
If the user name or program path contains spaces, you need to enclose them in double quotes separately.
runas /user:"Дмитрий Петров" "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe"
Save the shortcut. Now, when you launch it, a black window will appear asking you to enter a password. Note that when entering the password, nothing appears on the screen; simply type it and press the "Enter" key.
Everything works well, but constantly entering the password quickly becomes annoying. In this case, the Runas command has a special switch /savecred. When using it, the password is entered only once during the first launch; it is saved deep within Windows and is automatically substituted during subsequent launches. The entire command looks like this:
runas /savecred /user:Андрей notepad.exe
Attention! The /savecred switch does not work in Home versions of Windows.
It seems like happiness, but there are certain inconveniences. For example, some programs refuse to launch in a standard user account. You launch it using the method described above, and everything works fine. Now consider a slightly different scenario. You are the computer administrator, but your child has a standard user account, and a game refuses to launch under their account. You do not intend to give them the administrator password, so you create a shortcut, specify the /savecred switch, enter the password for the first time, and rub your hands in satisfaction.
Further events depend on the technical proficiency of the person to whom you gave such a shortcut. If the user is a computer novice, you can sleep peacefully. Otherwise, one fine day, they might figure out how to change the executable file path in the shortcut to another one and will be able to launch other programs as an administrator.
They will also gain access to all files on the computer's hard drive, even if access to them is denied by their user account, including other users' folders such as "My Documents". Admittedly, this is a fairly serious security hole when using the Runas command with the /savecred switch.
The Runas utility has limitations when launching certain system programs under the computer administrator account, including Explorer. In Windows XP, this can be bypassed by using the /separate switch: runas /savecred /user:Andrey "explorer.exe /separate". In later versions of the Windows operating system, this switch does not work, but you can use any other file manager to access files under the admin account.
In this case, the solution is to configure security settings so that the required program runs under a standard user account, or to use third-party programs for launching applications as administrator.
If these methods are not suitable, you can try to make it as difficult as possible for a user to unauthorizedly launch other programs under another computer user account. To do this, several additional steps are required.
First and foremost, do not tell him that the program is running under another user account. Although he might find out about this himself in the Task Manager.
Second, use a batch file for launching. Open a text editor, such as Notepad, and type the command that you previously entered in the "Object" field of the shortcut. Save the file with the .bat extension. Now, when you run this batch file, the command written inside it will be executed in the same way. However, this is not enough, as its contents can be viewed and modified in a simple text editor.
If the username or file path contains Cyrillic characters, you need to save the file in DOS 866 encoding, or insert "chcp 1251" on a separate line at the beginning of the bat file.
Third, make the bat file unreadable to hinder the user from analyzing how the program is launched. To do this, convert our bat file into a standard exe file. You can use one of the converter programs, such as the free "Bat To Exe Converter" program, which can be downloaded here. Run the program and specify your bat file in the "Batch file" field. In the "Save as" field, specify where and under what name to save the result. For additional concealment, you can specify an icon for our future exe file in ico format in the "Icon file" field on the "Version informations" tab. You can leave the other parameters unchanged. When everything is ready, click the "Compile" button to get your exe file.
Now, opening it in a text editor is useless. Copy it to the folder with the executable program, name it something similar to the program name, and create a standard shortcut to it on the desktop.
Fourthly, the final telltale sign that reveals it is a batch file is the brief appearance of a black window on the desktop. It is not possible to completely eliminate it with a simple method, but you can easily minimize its visibility. In the shortcut properties, go to the "Shortcut" tab and select "Run minimized." Now, only for a fleeting moment will the command prompt window appear in the taskbar.
That's it. Now, if the person from whom you want to hide the admin password is a novice or an average everyday user, you can rest easy. Of course, a knowledgeable user could figure out the contents of the exe file we created, but in the grand scheme of things, that is not required. It is enough to guess that the runas command is being used and simply create your own shortcut to launch the desired program. Thus, despite all the tricks, this will only protect you from a beginner user.
How to delete a saved password in the Runas command
Once you have saved a password for an account using the runas command, you can subsequently launch programs without entering it again. However, you may need to block the ability to launch programs on behalf of another user account on the computer using the saved password in runas.
To delete the saved password, go to "Start" ⇒ "Control Panel" ⇒ "User Accounts and Family Safety" ⇒ "Credential Manager".
In the "Windows Credentials" section (interactive logon), delete any unnecessary entries from the store.