Shareware: W8-RunAsDomainAdmin

Tested on:

Windows 8 Pro

Windows 7 Enterprise 32 bit

Windows 7 Home Premium 64 bit

Windows XP SP2 32 bit

Page updated February 2012

If you is satisfied with my work, please consider to use the Donate button.

Do you wanna know why?

I'm beta testing my solution right now, and I expect that version 1.0.0.0 is ready for download around summer 2013.

When it's ready you can pay for a lifetime license. As you can see in my W8-EULA-Copyright.txt located in the C:\ITD\TrywareDk\W7-Setup\Bin folder, I give you a lifetime license after paying me:

1 computer: $19.95 - 115 DKK

5 computers: $49.95 - 290 DKK

10 computers: $99.95 - 575 DKK

100 computers: $399.95 - 2.300 DKK

1.000 computers: $999.95 - 5.750 DKK

unlimited: $1.999.95 - 11.475 DKK

Description of the issue being solved by my W8-RunAsDomainAdmin Windows Tool:

#1: End users:
Because of your company's security rules, your end users are forced to logon as not being
member of the local administrators group, and they aren't allowed to right click a file, and
UAC elevate it with another logon being local administrator.
So all thirdparty applications is deployed with your Management System, in many cases

using the local system account service.

But some thirdparty vendors installations programs, is using the end users userprofile on
C:\Users and the HKCU registry hive for critical parts of their applications, and that's almost
impossible to solve easily with a Management Systems. So the only option with such
applications, is to make your end users member of the local administrator group, which isn't
allowed in your company :O(

#2: Domain administrators:
You are forced to right click the applications file in Explorer.exe, and select the "Run as a
different user" option in the context menu, and type the wanted administrator user's
logonname and password, each and every time you want to run the application.

I recommend these other applications.

It's 100% free to have a look, but if you click here, and decides to purchase, then the vendor will pay me an afficiliate bonus, without any costs for you.

Affiliate commercial ads

SHORT explanation of how my W8-RunAsDomainAdmin Windows Tool solves these 2 issues above:

You can specify a lot of files and/or applications, that your end users can start with a shortcut on their desktop, and it will runas with your domain administrators credentials.

You are free to select a local administrators or your domain administrators password, if you need access to network files. There's no security risk involved using your domain administrators password, except doing it with e.g. editors.

But some applications can't run without being UAC elevated. So depending on the use of the UAC settings on your end users computers, your specified application might be stopped by UAC elevation, even if it's started with your domain administrators credentials. If so, you can't use my W8-RunAsDomainAdmin Windows Tool, but such an UAC issue is solved, if you decides to pay for my W8-RunDisableUAC Windows Tool instead.

SECURITY RISK: If you are using your domain administrators password, please consider not to specify e.g. editor applications or simular, with my W8-RunAsDomainAdmin Windows Tool, because they will also run with your domain administrators credentials, and might give your end users access to important files, that's only meant to be manipulated by domain administrators.

LONG technical explanation of how my W8-RunAsDomainAdmin Windows Tool solves these 2 issues above:

As you can see below in my W8-RunAsDomainAdmin.ini settings file, you can specify a lot of options about how your specified file or application will run or be limited, when your end users starts them.

The settings file operates with 2 "simular" file- and foldernames:

sCompiled(file- and folder):

This is your specified file or application, that you want to give your end users an option to run with your local or your domain administrators credentials. If your end users start this file, it runs (as usual) only with the end users credentials.
The settings value of sCompiledFolder is always:
C:\ITD\TrywareDk\W8-RunAsDomainAdmin\SW\Compiled folder

sRunAs(file- and folder):

This is the compiled file you create with my Windows Tool, and that contains your local or domain administrators credentials, and a link to which sCompiled(file- and folder to use. If your end users start this file, it runs sCompiled(file- and folder) with your local or your domain administrators credentials

sRunAsFile can only run if it's located in sRunAsFolder, and if not, it's automatically moved back to sRunAsFolder. sRunAsFile only starts sCompiledFile, if sCompiledFile is located in the same sCompiledFolder on the end users computer, as it was on your domain administrators computer, when you compiled it with my Windows Tool. And sRunAsfile only starts sCompiledFile, if the sCompiledFile has the same MD5 hash value, as the sCompiledFile did on your domain administrators computer.
You’ll get a new compiled sRunAsFile exe file, with ”RunAsInvoker UAC execution level manifest”, which means, that it runs with the credentials of your end user. My new compiled sRunAsFile exe file contains runas commands about the needed applications exe file, being run with your local or your domain administrators loginname and password. But there’s no security risk in my new compiled exe file, because your password is only part of my new compiled sRunAsFile exe file, and it can only run the specified sCompiledFile applications file, and only if my new compiled sRunAsFile exe file is located in my
C:\ITD\TrywareDk\W8-RunAsDomainAdmin\SW\Compiled folder.
Please consider to use a local or domain administrator account that doesn't change the password, because if it is changed, you need to re-compile all your sCompiledFile's, and copy them again to your end users. If so, I've created a logfile in the sCompiledFolder with a complete index with dates of all the accounts you have used when compiling sCompiledFile

My W8-RunAsDomainAdmin.ini settings file is only located on your own domain administrators computer, where you specify your local or your domain administrators logonname and password, and the password is automatically deleted in the settings file each time after you have compiled the new sRunAsFile exe file, using my W8-Aut2ExeCompile.exe file. So there isn't any security risk about your local or your domain administrators password, because the settings file is only changed, so it might not be part of your recycle.bin, and the clear text of your local or your domain administrators password is only in your own domain administrators computers RAM, while using the W8-Aut2ExeCompile.exe, so there's no "traces" of it on your end users computers, when they use the compiled sRunAsFile exe file.

So the only security concern, is the pagefile.sys on your own domain administrators computer, that "might contain" some of your computers RAM, but maybe not the your local or your domain administrators password. Your operating system is storing "some of your computers" RAM information in 4 KB chunks in the pagefile.sys file, and thirdparty hex reader software "might be" able to read those chunks and you "might be able" to extract some readable text fragments of these 4 KB chunks, but you can't recover document or application files from pagefile.sys, and I guess, that you are the only one having access to your own domain administrators computer.
If you ain't satisfied with my security options described above, then just don't type any local or domain administrator password in my W8-RunAsDomainAdmin.ini settings file. But then you are prompted about your local or your domain adminstrators password each and every time you use W8-Aut2ExeCompile.exe to compile a new sRunAsFile. If so, your local or your domain administrators password is only in your domain adminstrators computers RAM the 10-20 seconds it takes to compile new sRunAsFile exe file, so it's 100% secure

When my Windows Tool runs, it will create logfiles in the C:\ITD\TrywareDk\W8-RunAsDomainAdmin\SW\Log folder. These logfiles will be deleted/appended/created each time you use my W8-Aut2ExeCompile.exe file:

	W8-Aut2ExeCompilelog	Appended to W8-Aut2ExeCompile.bak, and deleted before execution.
	W8-Aut2ExeCompile.bak	Valid switches is appended. File is truncated to max. 100 KB.
	Error-W8-Aut2ExeCompile.log	Appended to Error-W8-Aut2ExeCompile.bak, and deleted before execution
	Error-W8-Aut2ExeCompile.bak	Error switches is appended. File is truncated to max. 100 KB.

So if you are using a Management System, you are able to track success or errors if the W8-RunDisableUAC.log file or in the Error-W8-RunDisableUAC.log that is created according to the INFO #nnn: or ERROR #nnn: numbers (all nnn numbers in 3 digits) described in W8-Setup-LogNumbers.txt located in the

C:\ITD\TrywareDk\W8-Setup\Bin folder.

It contains all lognumbers for all my FreeWare/ShareWare Windows Tools. It's currently about a couple of hundreds error and info codes, like example:

ERROR #0027: License isn't validated with correct accountname and password

INFO #0047: Please read my SYNTAX descriptions file before using my Windows Tool

As you can see in my W7-EULA-Copyright.txt located in the C:\ITD\TrywareDk\W7-Setup\Bin folder, I give you a lifetime license after paying me:

1 computer: $0

10 computers: $90

100 computers: $500

1.000 computers: $3.000

unlimited: $5.000

Before paying for a license, please do a free test if my Windows Tool works with your files, because you can't get your money back.

But you don't have license to distribute my W8-RunAsDomainAdmin Windows Tool to anybody else.

Because of e.g. the UAC issue, my W8-RunAsDomainAdmin Windows Tool might not work with the specified files you want to use it with. So it’s up to you to do a valid test, before you decides to pay me for more than 1 computer. So it’s your own risc to get more licenses, because you can’t get your money back. The reason is, that it's the vendor of the application that decides, if their installation program is compiled with a ”UAC execution level manifest”, so it’s forced to be elevated with UAC credentials. And I can't predict that on all the computers around the world.

Some of my Windows Tool files needs some switches in order to work. If you start it with the -?, -help, /? or /help switch, I will open a notepad file, and show you my syntax descriptions for the needed switches.

W8-RunAsDomainAdmin doesn't have this -help feature, because everything is handled using this settings file:

W8-RunAsDomainAdmin.ini settings file located in the C:\ITD\TrywareDk\W8-RunAsDomainAdmin\SW\Ini folder

;Version=1.0.0.0

*** IMPORTANT - IMPORTANT - IMPORTANT - IMPORTANT - IMPORTANT - IMPORTANT - IMPORTANT ***

DON'T CHANGE THE FIRST LINE ABOVE, BECAUSE IT'S PART OF THE AUTOMATICAL ALERT TO YOU,

IF THERE'S A NEW BUILD READY ON MY WEBSITE. IF YOU CHANGE OR DELETE THIS LINE, YOU

WILL BE ALERTED ABOUT A NEW BUILD IS READY, EVEN IF THERE ISN'T ANY!

*** IMPORTANT - IMPORTANT - IMPORTANT - IMPORTANT - IMPORTANT - IMPORTANT - IMPORTANT ***

These settings decides how your compiled exe file is started, when you compile it with the

sCompiledFile setting. Please don't remove my remark lines, and please be carefull and

read my syntax descriptions below before changing anything.

NOTE: For security reasons, I always delete the sDomainAdminPassword in this settings file,

each time AFTER you have compiled your exe file using my W8-Aut2ExeCompile.exe file

located in the C:\ITD\TrywareDk\W8-RunAsDomainAdmin\SW\Bin folder. So there isn't

any security risk about your sDomainAdminPassword, because this file is only changed,

so it might not part of your recycle.bin, and the clear text of your

sDomainAdminPassword is only in your sDomainAdminName's computers RAM, while using the

W8-Aut2ExeCompile.exe, so there's no "traces" of it on your end users computers.

The only security concern, is the pagefile.sys on your sDomainAdminName's computer,

that "might contain" some of your computers RAM, but maybe not the

sDomainAdminPassword. Your operating system is storing "some of your computers" RAM

information in 4 KB chunks in the pagefile.sys file, and hex reader software "might

be" able to read those chunks and YOU "might be able" to extract some readable text

fragments, but you can't recover document or program files from pagefile.sys, and I

guess, that you are the only one having access to your computer.

IMPORTANT: If you ain't satisfied with my security choice described above, then just

don't type anything in the sDomainAdminPassword setting. But then you are

prompted about your domain adminstrators password EACH AND EVERY TIME

you use W8-Aut2ExeCompile.exe to compile a new sRunAsFile. If so, your

domain administrators password is ONLY in your domain adminstrators

computers RAM the 10-20 seconds it takes to compile the sRunAsFile, so

it's 100% secure

W8-RunAsDomainAdmin is a tiny part of the many features in my W8-ContextRunAs Windows

Tool.

WARNING: Depending on the use of the User Account Control (UAC) settings on your end users

computers, your compiled sRunAsFile might be stopped by UAC elevation, and

then you CAN'T USE my W8-RunAsDomainAdmin Windows Tool, but need to examine my

W8-RunDisableUAC Windows Tool instead. It's your own risc to test if my

W8-RunAsDomainAdmin Windows Tool works on your end users computers, before paying

me for more than the 1 free trial version.

[W8-RunAsDomainAdmin] <---------------- Run with these SETTINGS FILE values ----------------

; This settings file operates with 2 "simular" file- and foldernames:

; sCompiled: Your specified file, that your end users can run with your credentials

; sRunAs: The compiled file you create to run sCompiled with your credentials

sCompiledFile=

sCompiledFolder=

iCountStartLimit=0

sDomainName=<DontTypeAnythingIwillDoItForYou>

sDomainAdminName=<DontTypeAnythingIwillDoItForYou>

sDomainAdminPassword=

iLicenseNumbersUsed=<DontTypeAnythingIwillDoItForYou>

sLicenseUsername=

iLicenseValidated=<DontTypeAnythingIwillDoItForYou>

sManagementKit=

sMD5CompiledFile=

sMsgTitle=Message from your IT-Department:

sMsgToUsers=

sRunAsFile=

sRunAsFolder=C:\ITD\TrywareDk\W8-RunAsDomainAdmin\SW\Compiled

sRunAsSwitches=

iTimeBeforeExit=0

---------------------> SYNTAX DESCRIPTIONS <--------------------------------------------------

; sCompiledFile: The file or application file you want to allow your end users to run

; using the credentials as your sDomainAdminName account. You can use

; unlimited amount of these files, to be compiled including a runas with

; your sDomainAdminName and sDomainAdminPassword. You only need to copy the

; compiled sRunAsFile to your end users computers, located in the

; sRunAsFolder folder. If the MD5 hash value of sCompiledFile on your end

; users computer isn't identical with the simular sCompiledFile on your

; domain admins computer, sRunAsFile can't start the sCompiledFile on your

; end users computer.

; If errors in this setting, the W8-Aut2ExeCompile.exe file will

; terminate with an error, without producing any compiled file.

; Syntax: Full exe file name without path. Short filename is allowed,

; but for security reasons wildcards isn't allowed.

; NoT cAsEsEnSiTiVe

;

; sCompiledFolder: The folder where sCompiledFile is located on your AND on your end users

; computer.

; If errors in this setting, the W8-Aut2ExeCompile.exe file will

; terminate with an error, without producing any compiled file.

; Syntax: Full path starting with drive letter or UNC path. Short path

; and filenames is allowed. NoT cAsEsEnSiTiVe

;

; iCountStartLimit: Specify if you want to limit the amount of times your shortcut can be

; used. This feature only works about the end users userprofile.

; If you need to format and rebuild an end users computer, remember

; to delete the computers logfile in the sManagementKit's \Log folder.

; If errors in this setting, 0 will be used, which means that both your

; shortcut and sRunAsFile can start unlimited.

; Syntax: Integers from 0-365

;

; sDomainName: The short name of the domain of your sDomainAdminName. Simular to the

; %USERDOMAIN% environment variable shown in a CMD.exe prompt when using

; the SET command. If your computer is in a workgroup, it's your computer-

; Don't type anything, the %USERDOMAIN% environment variable will automa-

; tically be used.

; Syntax: Characters from A-Z. NoT cAsEsEnSiTiVe

;

; sDomainAdminName: Before using the W8-Aut2ExeCompile.exe file, you must logon as a user

; that's member of EITHER the local adminstrators gropu, or if you need

; network accces the sDomainName's domain admininistrators group.

; IMPORTANT: Please consider to logon as a domain account that doesn't

; change the sDomainAdminPassword, because if it is changed,

; you need to re-compile all your sCompiledFile's, and copy

; them again to your end users. If so please read about the

; logfile described in sRunAsFolder, which will help you to

; decide which sCompiledFile's you need to re-compile.

; Simular to the %USERNAME% environment variable shown in a CMD.exe

; prompt when using the SET command. Don't type anything, the %USERNAME%

; environment variable will automatically be used.

; Syntax: Characters from A-Z. NoT cAsEsEnSiTiVe

;

; sDomainAdminPassword: The password of the sDomainAdminName account. For security reasons, I

; always remove the password of this setting in this settings file, each

; time AFTER you have compiled your sCompiledFile file, using my

; W8-Aut2ExeCompile.cmd located in the

; C:\ITD\TrywareDk\W8-RunAsDomainAdmin\SW\Bin folder.

; If errors in this setting, the W8-Aut2ExeCompile.exe file will

; terminate with an error, without producing any compiled file.

; Syntax: Characters from A-Z, all special characters, and integers from

; 0-9. NoT cAsEsEnSiTiVe

; Or nothing, and I will prompt you each time you are using

; W8-Aut2ExeCompile.exe to compile the sRunAsFile

;

; iLicenseNumbersUsed: The number of computers that is using your shortcut to sRunAsFile, and

; the number you have payed license for. Don't type anything yourself,

; otherwise you might get an error. I will do it for you.

; Syntax: Two 4 digit integer numbers. 9999 means unlimited license.

; Example: 0067 out of 0100

;

; sLicenseUsername: The username you created using the "Sign up for W8-RunAsDomainAdmin"

; button at www.tryware.dk/shareware/w7runasdomainadmin.html, and it's

; your email address.

; If errors in this setting, the W8-Aut2ExeCompile.exe file will

; terminate with an error, without producing any compiled file.

; Syntax: Valid email address NoT cAsEsEnSiTiVe

;

; iLicenseValidated: Serial key after license is validated using port 21. Don't type

; anything yourself, otherwise you might get an error. I will do it for

; you.

; If you try to manipulate this setting, the W8-Aut2ExeCompile.exe file

; will terminate with an error, without producing any compiled file.

; Syntax: Either an encrypted valid serial key, or e.g:

; Payed for: 0100 Needed now: 0101

;

; sManagementKit: Full path to your Management Servers Kit folder, where all my log

; files that I create in the \Kit\Log folder, about your end users that

; is using your shortcut to sRunAsFile.

; If you don't have a Management System, then use a file share on one

; of your fileservers, and grant write permissions to ALL domain users

; If errors in this setting, the W8-Aut2ExeCompile.exe file and the

; sRunAsFile will terminate with an error, without producing any compiled

; file.

; Syntax: UNC-path and subfolder, or drive letter and subfolder

;

; sMD5CompiledFile: MD5 hash control to validate if the current sCompiledFile on the end

; users sCompiledFolder is identical with the sCompiledFile you compiled

; as part of your sRunAsFile. Don't type anything yourself, otherwise

; you might get an error. I will do it for you.

; If you try to manipulate this setting, the W8-Aut2ExeCompile.exe file

; will terminate with an error, without producing any compiled file.

; If the end user try to manipulate the sCompiledFile with another exe

; file, sRunAsFile will terminate without doing anything else, than

; disable sRunAsFile only on the end users computer, and alert you

; about it with an error file in sManagementKit called

; @ERROR-<ComputerName>-<EndUserLogon>.log

; Syntax: Valid MD hash string

;

; sMsgTitle: The title if you need a messagebox to your end users, AFTER running

; your sCompiledFile. If sMsgTitle isn't specified, sMsgToUsers will

; not be used, and no messagebox will be shown.

; If errors in this setting, the W8-Aut2ExeCompile.exe file will run

; without any messagebox.

; Syntax: Characters from A-Z, no special characters except - and : and

; integers from 0-9.

;

; sMsgToUsers: The message you want to show in a messagebox on your end users AFTER

; running your sCompiledFile. It will only be used, if you specify

; sMsgTitle.

; If errors in this setting, the W8-Aut2ExeCompile.exe file will run

; without any messagebox.

; Syntax: Characters from A-Z, no special characters except ' and \

; and . and integers from 0-9. " is NOT allowed.

; \n is used to create a new line NoT cAsEsEnSiTiVe

; Please note that all the example text in the next 4 lines

; must be on 1 line after sMsgToUsers=, and with no spaces

; after \n

; Example: You currently can't play DRM protected videofiles with your\n

; Microsoft Windows Mediaplayer\n\n

; In order to fix it, please close this message,\n

; and select the Upgrade button

;

; sRunAsFile: The name of the compiled file you created of sCompiledFile, using my

; W8-Aut2ExeCompile.exe, so it's compiled including your

; sDomainAdminName's account credentials, so you can allow your end users

; to run it with these credentials.

; If errors in this setting, a valid sCompiledFile (if any) will be used,

; otherwise the W8-Aut2ExeCompile.exe file will terminate with an error,

; without producing any compiled file.

; Syntax: Full exe file name without path. Not forced to be identical

; with sCompiledFile. Short filename is allowed, but for security

; reasons wildcards isn't allowed. NoT cAsEsEnSiTiVe

;

; sRunAsFolder: The folder where sRunAsFile is located on your end users computer.

; A INI file called sRunAsFile with .ini extension instead of .exe extension

; is saved in sRunAsFolder with a copy of these settings that was used when

; you compiled sCompiledFile with my W8-Aut2ExeCompile.exe

; If you change any of your sDomainAdminrPassword's you need to re-compile

; all your sRunAsFiles involved. A LOG file called sRunAsFile with .log

; extension instead of .exe extension is saved in sRunAsFolder with a

; complete index of all the sDomainName\sDomainAdminName's you have used

; when compiling sCompiledFile with my W8-Aut2ExeCompile.exe

; Don't type anything yourself, I will do it for you with the Default

; path C:\ITD\TrywareDk\W8-RunAsDomainAdmin\SW\Compiled.

; If errors in this setting, the W8-Aut2ExeCompile.exe file will

; change sRunAsFolder to the Default path.

; Syntax: Full path starting with drive letter. NoT cAsEsEnSiTiVe

;

; sRunAsSwitches: If wanted specify the switches to sRunAsFile, like e.g. an url, or

; silent install switches, or a txt file. Please note my security

; warning about using e.g. editors in sCompiledFile, because your

; shortcut will only start the editor with sRunAsSwitches, but when

; running, your end user can use the editors file open and file save

; features.

; Syntax: Characters from A-Z, no special characters, and integers from

; 0-9. " is NOT allowed, even if sRunAsSwitches contains

; spaces. NoT cAsEsEnSiTiVe

;

; iTimeBeforeExit: Specify if you want the sCompiledFile to automatically terminate

; after some seconds. Please note that it's a hard terminate by killing

; the process ID using TaskManager. Default = 0, which means that the

; sCompiledFile's process ID will NOT be killed.

; Syntax: Integers from 0-3600 (Seconds - not milliseconds)

;

; iTimeBeforeWarning: Specify the time you want to inform your end user about when

; sCompiledFile will be terminated without saving settings. The warning

; will be shown as a tiny yellow tooltip in upper left corner of the

; screen, and in front of all other open windows. Default = 60, which

; means that the tooltip warning always will be shown the last minute.

; Syntax: Integers from 60-3600 (Seconds - not milliseconds)

;o) Your brain is also like a parachute. It works best when it's open