Milas

runas access is denied

5 posts in this topic

Hey guys,

         for some reason when I run this command with run as in autoit it returns access is denied. but when I run the same thing in an elevated command shell it works fine. Im not sure where I am messing up.

global $rtech,$rcred, $IP
    $rtech = inputbox("","username")
    $rcred = InputBox("","password")
    $ip = inputbox("","enter IP")
    $pid = Runas ($rtech,"mhs", $rcred, 2 ,@ComSpec & ' /c reg query \\' & $ip & '"\hklm\software\microsoft\windows\currentversion\group policy\state\machine"|findstr /i "disting"', @SystemDir, @SW_hide, $STDERR_CHILD + $STDOUT_CHILD)
    Local $line
    While 1
        $line &= StdoutRead($pid)
        If @error Then ExitLoop
    WEnd
    While 1
        $line &= StderrRead($pid)
        If @error Then ExitLoop
    WEnd
    MsgBox(0, "", $line)

 

Share this post


Link to post
Share on other sites



Try the RunAs() with using 0 or 1 in stead of 2 for the third parameter to see whether that is causing it.

Jos 


Visit the SciTE4AutoIt3 Download page for the latest versions        Beta files                                                          Forum Rules
 
Live for the present,
Dream of the future,
Learn from the past.
  :)

Share this post


Link to post
Share on other sites

#4 ·  Posted (edited)

@JohnOne I had #RequireAdmin at the start of the GUI this was a part of and then I ran into the issue that everything the GUI ran it did with admin when I needed functions to run as the logged in user. So then I added the input boxes for admin and password and now some functions do not work.

@Jos I have used RunAs() with 0,1,2,and 4 and it all fails.

Whats blowing my mind is that almost every function uses this same format. All my "wmic" functions work fine. for example:

$pid = Runas ($rtech,"mhs", $rcred, 2 ,@ComSpec & " /c wmic /node:" & GUICtrlRead($IP) & " computersystem get name", @SystemDir, @SW_HIDE, $STDERR_CHILD + $STDOUT_CHILD)

_The above works great_

Here are the facts:

All my format for commands remain the same throughout

All commands can be put into cmd and run successfully

All commands work when #RequireAdmin is included instead of starting with " Runas ($rtech,"mhs", $rcred...)

Wmic commands all run successfully

getmac /s command runs successfully

net user commands fail with "Access Denied"

reg query commands fail with "Access Denied"

 

Solution will be to find whats different about the wmic/getmac and the reg query/net user commands

 

Edited by Milas

Share this post


Link to post
Share on other sites

RunAs does not give process that is run the Admin Token.  It only runs the process as the specified user.  #RequireAdmin request the Admin Token.  There are ways to do without using #RequireAdmin, but it will require re-execution of your script, or a secondary script called by the main script.  Here are a few threads that may help.

 

 

Here are some additional threads.  

https://www.google.com/search?q=site:www.autoitscript.com+runas+admin

You can do this without storing credentials in the script.  I just depends on how you want to organize your script to get it done.

 

Adam

 

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now

  • Similar Content

    • luckyluke
      By luckyluke
      Hello,
      Im trying to read the output from CMD using Dllcall, here is my code:
      #include <WinAPI.au3> #include <array.au3> Global Const $STD_OUTPUT_HANDLE = -11 Global Const $_CONSOLE_SCREEN_BUFFER_INFO = _ "struct;int dwSizeX;" & _ "short dwSizeY;" & _ "short dwCursorPositionX;" & _ "short dwCursorPositionY;" & _ "short wAttributes;" & _ "short Left;" & _ "short Top;" & _ "short Right;" & _ "short Bottom;" & _ "short dwMaximumWindowSizeX;" & _ "short dwMaximumWindowSizeY;endstruct" $pCmd = Run( "cmd.exe" ) Sleep(1000) $hCmd = WinGetHandle("") ConsoleWrite('handle:' & $hCmd & @CRLF) $aRet = DllCall("kernel32.dll", "int", "AttachConsole", "dword", $pCmd) ;_ArrayDisplay($aRet) If $aRet[0] <> 0 Then $vHandle_data='' $vHandle='' $vHandle_data = DllStructCreate($_CONSOLE_SCREEN_BUFFER_INFO) ; Screen Buffer structure $aRet1 = DllCall("kernel32.dll", "hwnd", "GetStdHandle", "dword", $STD_OUTPUT_HANDLE) if not @error Then $vHandle = $aRet1[0] $aRet = DllCall("kernel32.dll", "int", "GetConsoleScreenBufferInfo", "hwnd", $vHandle, _ "ptr", $vHandle_data) MsgBox(0, '1',DllStructGetData($vHandle_data, 'dwSizeX') & _WinAPI_GetLastErrorMessage()) EndIf It did not work, i got the message 'The handle is invalid'. Please help?
      Thank you in advance!
    • mihaijulien
      By mihaijulien
      Hello,
      I compiled a script I made that takes a command line parameter (the version of a .msi installer) when launched. The script was compiled with the /console option. The script (.au3) works fine but the executable returns  the following error:  
      Error: array variable has incorrect number of subscripts or subscript dimension range exceeded  
    • fosil
      By fosil
      Hi everyone.

      I'm currently working a program that constantly prints out log files through "consolewrite" and the "#AutoIt3Wrapper_Change2CUI=y" wrapper.

      Part of this program requires me to run a batch script.

      My issue is the batch script launches from the same window as consolewrite. I need the batch file to be launched through a different window as currently this causes an issue with the logs (which need to be very precise) but also causes the batch file to produce some funny behavior...

      Does anyone know how I can force the file to run on a second DOS window?

      Thanks in advance!!!
       
      Edit: Im using the "run" command if that helps. I tried "shellexecute" but that seemed to not launch the batch scripts at all.
    • Baboo85
      By Baboo85
      Hi all,
      I need to start a script that include:
      - admin privileges
      - multiple cmd commands
      - no bat, no exe, no tmp files created anywhere (especially in the user temp folder)
      In a bat file it would be simple, but users shouldn't see what commands I'm sending.
      Example of the script:
      echo off cls echo. echo I AM A TOOL echo. echo NOTE: echo - note 1 echo - note 2 echo - etc set USER1=0 set COMPUTER1=0 if /i %username% equ user.user ( set USER1=1 set COMPUTER1=1 ) if /i %username% equ another.user set USER1=1 if /i %computername% equ notebook set COMPUTER1=1 if %USER1% EQU 1 ( if %COMPUTER1% EQU 1 ( reg delete "HKLM\SOFTWARE\blablabla" /f ) else ( echo Computer not authorized. Contact assistance.) ) else ( echo User not authorized. Contact assistance.) echo. pause exit With the send("") is a disaster.
      I'm a noob here, so what can I do?
       
      EDIT: OR ELSE I explain the situation and what I need, so if there is a simple solution I can use that.
       
      SITUATION: our domain users have Users rights on the machine. Some of them need administrator rights.
      We create a local user with administrator rights, so that the users must insert username and password when asked to run something with administrator rights.
      We have an internal domain group policy that blocks EXE, BAT, COM, TMP files from the user local temp directory, for a security reason (malware). That also blocks most software installation.
      But some users are often out of office, away from workplace and in another country, they need a complete control on their computers.
       
      WHAT I NEED: I need to check the username and the computer name. If the username is the one with local administrator rights and the computer name is a computer that is qualified to temporary remove the policy, then I need to execute a REG DELETE command with administrator rights.
       
      I hope I explained myself.
       
      Thank you very much.
    • TLOTS
      By TLOTS
      Hi!
      I'm triying to get the session id to close automatically a RDP session.
      I tried doing this:
      #RequireAdmin #include <Constants.au3> $DOS = Run('C:\Windows\System32\query.exe user', "", @SW_HIDE, $STDERR_CHILD + $STDOUT_CHILD) ;Run(@ComSpec & " /c " & 'Query User', "", @SW_HIDE, $STDERR_CHILD + $STDOUT_CHILD) ;Run(@ComSpec & " /c " & 'quser', "", @SW_HIDE, $STDERR_CHILD + $STDOUT_CHILD) ProcessWaitClose($DOS) $Message = StdoutRead($DOS) MsgBox(0,'',$Message) But the $Message is always empty, if I execute any of these commands in a cmd window, it works
      Any idea on why is this falling? there is another way to get this info?
       
      PS: Sorry for my english, i'm not native.