I wrote a little program to automate:
Taking own of a file/folder for a specified User.
Get (for the same User) FULL CONTROL of the file/folder.
Now, it is well know that takeown.exe wants cmd.exe to be run as Administrator rights. So, to do in a batch file (most of the time called from a non-Administrator cmd window), I run:
call runas /noprofile /user:"!domain!\!runasUsr!" "cmd /k takeown /f ""!entity!"" /r"
However, even though I pass as !runAsUsr! a name which is contained in the Administrators Group, I get:
ERROR: the user currently connected does not have the ownership privileges on file/folder ...
I tried setting !runAsUsr! = Administrators, but unfortunately I do not remember the password (if I even set one...). For that, I could change from computer manager (or net command), but I do not well know how that command works, so I wouldn't mess things up.
But still, I do not understand why I get that error since the User I pass is within the Administrators group..
I see from computer manager that default account for computer administration is User:Administrator of the Group:Administrators, so this might be the problem. So, how to set the other account to have same rights?
I also tried
call runas /noprofile /user:"!domain!\Administrator" "cmd /k takeown /f ""!entity!"" /r"
getting following error:
ERROR RUNAS: impossible to execute - cmd /k takeown /f "C:\Program Files\Microsoft VS Code\resources\app\extensions\css" /r
1327: restriction on user account do not allow this user to get access.
For example, empty password field not allowed, access times restrictions or application of restriction criteria.
Related
Is there any way to start a cmd on a remote computer, and then start exe file with a path to it, even if some user is logged on the remote machine.
I have restricted admin rights, and I can not use psexec.
the job should be done with a batch and show the cmd window to the user logged on, so they know something is happening, because some services will bi stopped for 1h.
I tried this:
WMIC /NODE:"name remote comp" /user user /password password process call create "c:\dir1\dir2\dir3\some.exe" /M /NOREBOOT
and some other variations, nothing is happening.
Thanks in advance
I have the permission to run the exe file. I start it logged on the remote machine. I just need to automate the process in the case it should start on view computers at the same time. So I dont need to login and start it on each machine. I tried this also:
WMIC /NODE:"name remote comp" /user user /password password process call create "cmd.exe c:\dir1\dir2\dir3\some.exe" /M /NOREBOOT
WMIC /NODE:"name remote comp" /user user /password password process call create "cmd.exe /c c:\dir1\dir2\dir3\some.exe" /M /NOREBOOT
WMIC /NODE:"name remote comp" /user user /password password process call create "cmd.exe /c c:\dir1\dir2\dir3\some.exe /M /NOREBOOT"
I have a scheduled task that starts a batch script A.bat. The task is set to run whether the user is logged in or not, using my credentials (I am an admistrator for the system).
A.bat is succesfully started according to the schedule. However, A.bat uses another batch script B.bat. A.bat contains the following command.
start /b cmd /c C:\folder\sub-folder\B.bat
On a computer running windows 10 the above line of the batch script fails if I am not logged onto the machine, but works if I am logged on. On other computers that use windows 7, the script runs without issue whether I am logged on or not.
If I instead use call C:\folder\sub-folder\B.bat the script runs without issue (whether I am logged on or not) on all the machines, both windows 10 and windows 7.
Since I did not write A.bat, I would like to know if there is any reason that I should be cautious replacing start /b cmd /c with call. Additionally, is there any reason for the difference in behaviour on windows 10?
I'm trying to test a batch file that should test for administrator privileges, but I have the weird problem that I can't run it without administrator privileges.
net session >nul 2>&1
if %errorLevel% == 0 (
rem do whatever...
Sure, I can just create another user account and run it from there, but that's a bit much effort just for one little test.
The script example above may not exactly be what I wanted because I need a general solution, for example to test if an installer can run without admin rights.
Is there an easier way? A command line argument for running something without administrator privileges maybe?
BTW, I disabled UAC if that makes any difference.
You can try with
runas /trustlevel:0x20000 "cmd.exe /c ....."
use runas /showtrustlevels to see the available levels
I have a batch file that starts with elevated privileges (my installer spawns it), but at a certain point I need to run a command as the original user who started my installer (i.e. drop from the elevated privileges).
Is it possible to do so?
You can run a command with restricted privileges with:
runas /trustlevel:0x20000 "YourCommandHere"
You should provide the absolute path to your command including any arguments in double quotes as an argument to runas.
If you would like to run more than one command with restricted privileges, you can put them in a separate batch file and run it with:
runas /trustlevel:0x20000 "cmd /C PathToYourBatchFile"
Anyway, this will open a new console with restricted privileges. You also have to use this syntax whenever you wish to run with restricted privileges an internal command (like copy, del, etc.) as these are provided by the command line interpreter and do not have an associated path.
Note that 0x20000 is the trust level of standard users. You can list other available trust levels by running
runas /showtrustlevels
It's still a privileged program (though restricted) in Task Manager by using this command:
runas /trustlevel:0x20000 <cmd>
You can try the other way, which will make it unprivileged in Task Manager:
runas /savecred /user:%username% <cmd>
You still need to enter the password once but not every time.
Use explorer.exe to launch the program:
explorer.exe <cmd>
explorer.exe won't accept arguments for cmd, but you can create a temp script file and lauch it by explorer.exe if arguments are necessary.
I have written a batch file which starts OpenVPN. If the client is found, I check the connectivity by running PING. If the server is not found, then this means that although OpenVPN is running, the connection has not been established. At this point I want to restart OpenVPN. Because I am not using the admin account for this script, I always get the error "permission denied" when using TASKKILL /F. Is there anyway around this?
There are two methods of running a command with administrator privileges.
Solution 1:
Right-Click the batch-file and click run as admin.
Solution 2:
Use the runas command to run a command or batch file with administrative permissions. This way the process is still automate but you will still need to type in the password for administrator.
Example:
C:\> runas /user:administrator "taskkill /f /im explorer.exe"
Enter the password for administrator:
Type runas /? for more info.
if you are already the administrator, you can create a shortcut to your batch file and when you right click the shortcut -> properties -> advanced -> check the checkbox "run as administrator"
and voila!
everytime you run the batch script via this shortcut file, it will run as administrator and will kill without any discrimination, happily ever after