Windows RunAs way to tell the Originating User in the Command Shell?

[thepip3r]

so... lets say you're an admin on a machine and you runas cmd.exe so you get a command shell that's running with admin rights. if you run a SET command from that window, you'll see all the env variables propoated with your "admin account's" information. if you could NOT get out of that newly spanwed admin shell, is there a way to tell what account is the normal account actually logged into that machine? like maybe some parameter in the registry or wmi query or the like?? TIA.

[Monamo]

so... lets say you're an admin on a machine and you runas cmd.exe so you get a command shell that's running with admin rights. if you run a SET command from that window, you'll see all the env variables propoated with your "admin account's" information. if you could NOT get out of that newly spanwed admin shell, is there a way to tell what account is the normal account actually logged into that machine? like maybe some parameter in the registry or wmi query or the like?? TIA.

Here's a WMI query process I use to differentiate between the logged in user and the account that actually "owns" my script's process:

$sLoggedInUser = ""
$sLoggedInDomain = ""
$sResults = ""
$strComputer = "."
$objWMIService = ObjGet("winmgmts:" & "{impersonationLevel=impersonate}!\\" & $strComputer & "\root\cimv2")
If IsObj($objWMIService) Then
    $colComputer = $objWMIService.ExecQuery("Select * from Win32_ComputerSystem")

    For $objComputer In $colComputer
        $sLoggedInUser = $objComputer.UserName
    Next
    If StringInStr($sLoggedInUser,"\") Then
        $iSplit = StringInStr($sLoggedInUser,"\")
        $sLoggedInDomain = StringTrimRight($sLoggedInUser,(StringLen($sLoggedInUser) - $iSplit)+1)
        $sLoggedInUser = StringTrimLeft($sLoggedInUser,$iSplit)
    EndIf

    If $sLoggedInDomain <> "" Then $sResults &= "Logged in domain: " &$sLoggedInDomain &@CRLF
    If $sLoggedInUser <> "" Then $sResults &= "Logged in user: " &$sLoggedInUser & @CRLF
    $sResults &= "@UserName value: " &@UserName &@CRLF
    ConsoleWrite($sResults)
Else
    ConsoleWrite("Unable to connect to WMI Service" & @CRLF)
EndIf

[thepip3r]

you're the man Monamo... tyvm.