Starting exe as another user

Question

Hi,
Perhaps someone else dealt with this. I tried a lot of things, but haven't
succeeded jet.
I need to start a (LabVIEW) application, running as another user. From the
command line, runas works perfectly. But from LabVIEW, runas doesn't work.
This is documented, runas checks if it's called from the command line, and
doesn't start if it's not called from the command line. For start, there is
no commandline option for the password.
I did try to open pipes to runas, so I can pipe the password to runas, but
this doesn't work either. Runas seems to check from where it's called...
There is a tool called Sanur.exe, that can be used to pipe a password to
runas, so you can enter the password on the command line (like runas
/user:user "program.exe" | sanur password). This also doesn't work with
LabVIEW, since runas is still checking from where it is started...
So I tried some API's... CreateProcessWithTokenW with LogonUserA,
CreateProcessWithUserA with LogonUserA and CreateProcessWithLogonW... It
doesn't help that some of them are Unicode, but with MultiByteToWideChar,
that is easy to solve.
CreateProcessWithTokenW and CreateProcessWithUserA only work when the
client applications has few rights, so I got some errors about that. I
haven't tried to obtain those rights, since that is rather difficult.
The last one (CreateProcessWithLogonW) works on my PC, but gives error 6
(Invalid token) on the real environment. The API doesn't have a token input,
so something must be wrong. Nothing on internet about this either...
Anybody done this before?
Regards,
Wiebe.

Answer 1

Wiebe wrote: But runas can't be runned by an application...
Not directly but as part of a command file. I have an app named Drive Snapshot which requires admin rights and checks this during startup. As a restricted user I created a command file named DriveSnapshot.cmd with the following line:
runas /user:admin /savcred F:\Programme\SnapShot\snapshot.exe
Double clicking in Windows Explorer  requires the password entered. The next time time it will simply start without a prompt.
Next I created the following VI:
Running the VI will start the commandfile and therefore start DriveSnapShot.
Next I logout and  login as admin and changed the password. Then I login as the previous restricted user. Running the VI DriveSnapShot will not start. You need to provide the password again.
For the permanent change of passwords this is not a solution for Wiebe.
Talking to system administrators they maybe make the following solution possible:
Creating a special user in the domain with admin rights. This user wil never change his password and is only known to the application programmer and the admins.
Message Edited by waldemar.hersacher on 02-03-2009 08:12 PM
Waldemar
Using 7.1.1, 8.5.1, 8.6.1, 2009 on XP and RT
Don't forget to give Kudos to good answers and/or questions
Attachments:
cmdFromLabview.png ‏2 KB