使用Process.Start作为本地管理员帐户启动单独的程序

Question

We have a piece of software used in our business that requires admin rights to run. However the staff are not allowed access to accounts with admin rights. This is within a windows 7 environment.

We have set-up a local admin accounts on the required computers through GPO. The aim of the software I am creating to to launch the software that requires admin rights as this local admin account.

So far the software is working correctly in that it is launching the software as the account but it is still giving the errors that it gives when it does not have admin rights. If you right click and runas on the software and type in the account details manually it works fine.

SecureString pwd = new SecureString();
foreach (char c in "somepassword") { pwd.AppendChar(c); }
var psi = new ProcessStartInfo
{
    FileName = location,
    UserName = "localadminaccountname",
    Domain = Environment.MachineName,
    Password = pwd,
    UseShellExecute = false,
    Verb = "runas"
};
try
{
    Process.Start(psi);
}

There is an exception catch statement with error reporting included with the code. There are no exceptions thrown when Process.Start(psi) is called. (Updated)

Thanks.

EDIT The company build of windows 7 has User Access Control set to "Never Notify" so no UAC pop-up is shown when Process.Start(psi) is called.

Answer 1

Have you tried setting 'Load user profile' true for the IIS app pool? I had a similar situation. This worked for me.

Refer for more info: Security exceptions in ASP.NET and Load User Profile option in IIS 7.5

Answer 2

If UAC is set to "Never Notify" then it is disabled - the user runs with the maximum set of privileges.

That means that if the user is an admin account, using the "runas" verb is unnecessary. It also means that if the user is NOT an admin account, it's possible that your application may stil fail to work (because the user can't elevate and OTS (over-the-shoulder) elevation is disabled.