Replace runas with Cpau

Use Cpau to help limited users safely run programs and commands with Administrator privileges

In the current domain management, often encounter some programs or tools can not run with ordinary user rights, and must use the situation of administrator rights, and some even in the production business is closely related. There are many reasons for this problem, such as the lack of awareness of early developers, the means to intercept, modify certain documents, and so on. With the deployment of Vista, Windows 7, the problem is becoming increasingly apparent.

To this end, Microsoft provides the RunAs command to enhance user rights, but the disadvantage of RunAs is that each use must be lost password, very inconvenient.

Using a script to automate the operation, though, satisfies the requirements. However, the script is written, the amount of encryption is heavy, and is not conducive to management.

Cpau is a lightweight, flexible command-line tool that enables restricted users to safely complete operations with administrator privileges in a simpler batch manner. Support 200/xp/2003/vista. Test pass on my Windows 7 M3. (download please see 2F)

The usage of Cpau is similar to runas, but has more extended functionality.

Basic usage:

Cpau-u User [-p password]-ex "Whattorun" [Switches]

-U executes the user name of the task, and the domain environment requires a full name such as: DOMAIN\Administrator

-P The password of the user, if there is no this switch, enter after the password required (not visible)

-ex need to execute the program, for the path with a space appears, it is recommended to add double quotation marks, such as "C:\Program Files\qq.exe"

-LWP or-lwop If you are a local account, you must use this switch to authenticate interactively.

Example: cpau-u administrator-p 123456-ex CMD-LWP command line in management mode

Cpau-u administrator-p 123456-ex "cscript e:\lock.vbs"-lwp run script

Cpau-u Small-P 123456-ex "C:\Program files\qq2008 beta2\qq.exe"-LWP Run Program

Extended:

Writing a command directly to a batch or shortcut to a user is tantamount to exposing the administrator password. The CPAU provides an encryption switch to encrypt the entire command, preventing the account and password from appearing in plaintext.

First, encrypt the command to be executed, for example:

Cpau-u administrator-p 123456-ex "F:\Program files\qq2008 beta2\qq.exe"-enc-file G:\temp\start.mp3

-enc for the encryption switch

-file the output path of the encrypted file, the suffix name is not limited.

(-LWP and-LWOP switches, please ignore them temporarily.) ）

After completion if shown: the command completed successfully. Indicates a successful completion.

Use Notepad to open the encrypted file:

Now, non-admin users just need to call the encrypted file to run the program, no more plaintext passwords appear:

Cpau-dec-file G:\TEMP\START.MP3-LWP

-DEC Decryption Switch

-file the path where the encrypted file resides

(The-LWP and-LWOP switches are mended here)

Next, create a bat file or a shortcut for the user to start.

Take the shortcut as an example:

Create a shortcut for Cpau to cut the shortcut to the desktop. Modify the target path and icon.

Done!

Warning: Do not use the tool in high-security environments! Cryptographic algorithms are private to the author, and can be cracked in time of abundance. Try to use a local account instead of the domain administrator account.

Replace runas with Cpau