Run application which require admin password in normal user account on Windows 10

[maniootek]

I have some app which ask me for administrator password to run it (when I am logged in normal user account in Windows 10 without admin privileges). All I want to do is run this app without popup to enter admin password. I tried this code but with no sucess.

#include <AutoItConstants.au3>
#include <WinAPIError.au3>
$file = @ScriptDir & "\StartUp.exe"
if not FileExists($file) then exit msgbox(0,0,"file does not exists")
RunAs("admin", @ComputerName, "pass123", 2, $file)
if @error then msgbox(0,0,_WinAPI_GetLastErrorMessage())

Error message says "Access denied"

Any idea?

Edited November 5, 2020 by maniootek

[mLipok]

#requireadmin

#include <AutoItConstants.au3>
#include <WinAPIError.au3>
$file = @ScriptDir & "\StartUp.exe"
if not FileExists($file) then exit msgbox(0,0,"file does not exists")
RunAs("admin", @ComputerName, "pass123", 2, $file)
if @error then msgbox(0,0,_WinAPI_GetLastErrorMessage())

 

[maniootek]

3 minutes ago, mLipok said:

#requireadmin

#include <AutoItConstants.au3>
#include <WinAPIError.au3>
$file = @ScriptDir & "\StartUp.exe"
if not FileExists($file) then exit msgbox(0,0,"file does not exists")
RunAs("admin", @ComputerName, "pass123", 2, $file)
if @error then msgbox(0,0,_WinAPI_GetLastErrorMessage())

 

You mean to add #RequireAdmin to the script? But this makes no sense and it is not what I mean.

From helpfile:

Quote

#RequireAdmin

Specifies that the current script requires full administrator rights to run.

 

7 minutes ago, maniootek said:

I am logged in normal user account in Windows 10 without admin privileges

 

[mLipok]

In such case how you want to Accept this request from third party app ?

 

Edited November 5, 2020 by mLipok

[maniootek]

34 minutes ago, mLipok said:

In such case how you want to Accept this request from third party app ?

 

Sorry but I don't know what you mean. So this is not possible to do what I am trying to achieve?

when I add #RequireAdmin then it's not working too, still ask me for admin password

Edited November 5, 2020 by maniootek

[Nine]

Try flag = 1

Because flag = 2 means that the process will authenticate only to network resources with the specified account, but keep using local resources with the original account.  Maybe this is why you are ask for pw

[maniootek]

31 minutes ago, Nine said:

Try flag = 1

Because flag = 2 means that the process will authenticate only to network resources with the specified account, but keep using local resources with the original account.  Maybe this is why you are ask for pw

I tried all flags. No results

[mLipok]

3 hours ago, maniootek said:

Sorry but I don't know what you mean. So this is not possible to do what I am trying to achieve?

As you say the StartUp.exe requires Admin.

So this following modified script 

#requireadmin

#include <AutoItConstants.au3>
#include <WinAPIError.au3>
$file = @ScriptDir & "\StartUp.exe"
if not FileExists($file) then exit msgbox(0,0,"file does not exists")
RunAs($file)
if @error then msgbox(0,0,_WinAPI_GetLastErrorMessage())

.... should firstly PopUp admin rights requirements/dialog and then do not ask about rising rights for running StartUp.exe

Check it if you are able with the same credentials as was trying to provide with RunAs(), maybe you provide wrong credentials ?

Edited November 5, 2020 by mLipok

[maniootek]

20 minutes ago, mLipok said:

As you say the StartUp.exe requires Admin.

So this following modified script 

#requireadmin

#include <AutoItConstants.au3>
#include <WinAPIError.au3>
$file = @ScriptDir & "\StartUp.exe"
if not FileExists($file) then exit msgbox(0,0,"file does not exists")
RunAs($file)
if @error then msgbox(0,0,_WinAPI_GetLastErrorMessage())

.... should firstly PopUp admin rights requirements/dialog and then do not ask about rising rights for running StartUp.exe

Check it if you are able with the same credentials as was trying to provide with RunAs(), maybe you provide wrong credentials ?

In my case, this makes no sense. This app is designed to be used in my worker pc, who has no password for admin account.

[mLipok]

I guess that before...... my testing example is to check if you pass the credentials correctly, and if they are passed correctly by RunAs().

I mean if you provide credentials by hand, as an effect of #RequireAdmin and not by RunAs() 
...... and it will not bring additionall request from StartUp.exe then this will mean that
AutoIt is running StartUp.exe with Run() correctly without the need to incrase your rights/credentials provided by you as a result of #RequireAdmin

It will also mean that the problem is in RunAs() 

 

btw. small fix to the testing example:

#requireadmin

#include <AutoItConstants.au3>
#include <WinAPIError.au3>
$file = @ScriptDir & "\StartUp.exe"
if not FileExists($file) then exit msgbox(0,0,"file does not exists")
Run($file)
if @error then msgbox(0,0,_WinAPI_GetLastErrorMessage())

 

[GokAy]

Hey, you may need to enable local administrator for this.

Check out the link, and decide if it suits your needs:

https://www.ghacks.net/2014/11/12/how-to-enable-the-hidden-windows-10-administrator-account/

[JLogan3o13]

@maniootek How about some clarification. You keep saying it requires "Admin Password", which I see some take (as I would) to mean you are trying to pass specific credentials. Are you meaning that the UAC prompt comes up on launch, and you are looking for a way to bypass said prompt?

[caramen]

@mLipok The issue is, he wants to run a program as administrator without elevating the script itself. This case can be useful for the propagation of an installation process under your right in a user's session. It's like to do the MAJ + RIGHT-CLICK to run as an executable. And UAC can or not be prompted depending on what the EXE will do.

@GokAy Pointing a good possibility too. A disabled session can make the admin session unable to being called.

And finally @JLogan3o13 is right to ask about UAC. But from what I understand it's not the case here. Let's see ...

Here you got an example of working on premise RunAs in a domain environment : 

$iResult = RunAs( ""&@aUserName , _
            @ComputerName , _
            ""&@aPassword , _
            1 , _
            @ComSpec & ' /c c:\temptest\Hello.exe', _
            @SystemDir , _
            @SW_HIDE , _
            BitOR($STDERR_CHILD, $STDOUT_CHILD) )

 

Edited November 6, 2020 by caramen

[maniootek]

Well, let me be more specific in this case.

Users in my PC:

- worker1 (normal account)

- boss1 (admin account)

- Amdministrator (default account which is disabled)

 

If I run some app in worker1 account, UAC ask for boss1 password. Probably it happens because this app makes some changes in the computer and must be run with admin privilages. There is small shield icon in this exe file.

I want let worker1 to run this app without entering any password.

[caramen]

Woooo Woooo Woooo Stop./

@JLogan3o13 had the good suspicion then x). 

It's not the same issue so.

[caramen]

- worker1 (normal account)

__Can run a program under admin right.

__Can't dodge UAC prompt.

- boss1 (admin account)

__Can run all program.

__Can dodge UAC prompt.

- Administrator (default account which is disabled)

__Can run all program.

__Can dodge UAC prompt.

Edited November 6, 2020 by caramen

[JLogan3o13]

There are two different issues, passing of boss1's credentials, and the UAC. If you want help with doing a RunAs, and passing specific credentials, that is great. But UAC is for when an application needs administrative access to system resources, and is a built-in MS security measure. If the issue comes down to being the UAC, aside from telling you to research how to disable it via the registry, we will not be discussing how to get around it. Just want to make this clear.

[maniootek]

So what is your idea to let worker1 use this app? I don't want give worker1 admin rights as they can install any app without my knowledge.

[caramen]

You have to be more specific on your question. 

Could you just enter the password every day ?

 

If you are the administrator you configure the UAC to not being prompt on that application only. Then you could do a RunAs After. 

Or you totally disable the UAC. 

Or you could give your right one time for ever, in scheduled task.

Edited November 6, 2020 by caramen

[maniootek]

I didn't know it's possible to disable UAC for specific application. I just searched Internet and I found some tutorial but it's not easy, it's many steps to do so (some edits in registry).