What is UAC (User Account Control)?
One of the reasons is the UAC – User Account Control, which presents a pop-up asking for admin login and password because it’s trying to make changes to the system. For example, suppose you downloaded a movie/song/picture and then all of a sudden it’s asking you to run it as administrator – it will immediately raise a red flag. Achtung, something dodgy!
Also, if you were to leave your computer unattended, somebody could use it to install, for example, a keylogger, which could easily intercept your passwords and send them to the attacker… well, there are many other things that could happen.
Getting around the UAC
Anyway, sometimes it could be necessary to allow certain programs to run as Administrator while using a standard user account. System management tools, antivirus programs, “tweakers” all get around this restriction by running themselves as a service plus graphical application but most programs aren’t supposed to be run as services yet they still require admin rights.
What can one do when it’s necessary to allow standard users to have programs run as admin? For example, you want to allow your kids to play games on a regular user account but want to have some kind of monitoring program to run at all times? I’ve been searching for a solution for several hours and finally found something. It’s rather crude and not very secure but works nonetheless. Also, most people won’t be able to figure out how to exploit the vulnerability anyway. Security through obscurity?
There is a service utility “runas” that allows specifying alternate credentials. For example, launching “runas /user:Administrator devmgmt.msc” will allow using Device Manager as Administrator and not just a standard user. The difference? You can install drivers, disable/enable devices and so on. The problem? It’s going to ask for the admin password!
That’s just fine when you are the computer owner and have both admin and standard account but certainly not acceptable when you don’t want someone else to know your password. However, there is a little-known switch “/savecred” that allows storing admin credentials on a standard user account. Basically, you would just create a shortcut and run it once with the /savecred switch and be done with it…
Well, it used to work several years ago but doesn’t work in Windows 10 now. When you run the command, it will say RUNAS ERROR: Unable to run… 740: the requested operation requires elevation Duh… Of course, it does, that’s what we are trying to achieve here! Turns out, you can still run CMD (command prompt) as admin, so… this trick allows encapsulating whatever needs to be run in the cmd command.
Follow me: runas /user:Administrator /savecred “cmd /c “mmc devmgmt.msc”” Here ” … ” is used to put an extra set of parentheses inside another. Whoila! Once you run this command in a standard user account, you can create a shortcut to it and give to your “less privileged” user. I’m not sure how long this will work or how long the supplied credentials last but it seems to work after a reboot.
