Impersonate as another user to run a program

• Download source code - 3.75 KB
• Download demo - 3.73 KB

Introduction

This is an extension to the "runas" command in windows, so the current user can impersonate as another user to run a program. The motivation is to let a standard user run a program as Administrator without inputting the password every time, as discussed here:

• Why doesn't the RunAs program accept a password on the command line?

http://blogs.msdn.com/oldnewthing/archive/2004/11/29/271551.aspx

Background

The link above gives an in-depth insight for the "runas" command in Windows. However, although it makes sense that the "runas" command doesn't take password as parameter, it does give a lot of trouble to personal users, and to me.

Let's say, we have Windows 7 installed on a home computer, and we don't want other "non-skilled" family members (your wife, children, grandma, etc.) to change critical settings or install software. We want them to use only the software that we allow them to run.

OK, it's easy, we create a "Standard User" account and give to them, and install software under the Administrator account, which is owned and only owned by us. So your wife/children/grandma can only run the programs you install.

So, things fixed?

Now, you install a program which needs administrator privilege, which means unless you turn off user account control, the "standard user" will be prompted to input Administrator password each time they run the program. And, your wife will be yelling: "hey, what is the ****ing password?" "Why do you make such complicated settings?"

Unfortunately, there are quite a number of applications that work this way and we simply cannot let a "standard user" run the program without inputting the admin password.

This program was written to solve the problem.

Using the Code

There is really not much to say about the code. It's almost the same as the sample code on MSDN: http://msdn.microsoft.com/en-us/library/ms682431(VS.85).aspx.

The only tweak is removing several unimportant parameters (such as environment settings) and the detection for the local user and the domain user.

The core part is no more than four lines:

if (wcschr(argv[1], L'@'))
{
  isLocalUser = TRUE;
}
if (!CreateProcessWithLogonW(argv[1], isLocalUser ? L"." : NULL, argv[2], 
            0, NULL, argv[3], 
            CREATE_UNICODE_ENVIRONMENT, NULL, NULL, 
            &si, &pi))
        DisplayError(L"CreateProcessWithLogonW");

Points of Interest

The code is simple, but it could be useful for people who setup different accounts for family members. Let's say you have a program at c:\Program Files\ppstream.exe which requires admin permission to run, but you want all your family members to be able to run the program without asking you to input the password, then you can create a shortcut to c:\Program Files\ppstream.exe, and modify the shortcut to: c:\runasuser.exe administrator your_password "c:\program files\ppstream.exe".

History

Submitted on 2/24/2010.