How to start a program requiring admin rights as an admin user from a nonadmin account

Question

Design Flow: Non-Admin User ----> Program A (Non-Admin) --> Program B (Requires Admin)

I'm writing a program to launch a program that requires admin rights from a non-admin account. The program is launched on start-up with any user and it launches the second program (requiring admin rights) as a different user who has admin rights. The issue I am having is the program is saying that to launch a program as a different user it requires admin rights. I know this not to be true so I know I have something incorrect in my code to launch the second process.

The code is as follows:

try
{
    ProcessStartInfo myProcess = new ProcessStartInfo(path);
    myProcess.UserName = username;
    myProcess.Password = MakeSecureString(password);
    myProcess.WorkingDirectory = @"C:\Windows\System32";
    myProcess.UseShellExecute = false;
    myProcess.Verb = "runas"; //Does not work with or without this command
    Process.Start(myProcess);
}

The exception is as follows:

System.ComponentModel.Win32Exception (0x80004005): The requested operation requires elevation
   at System.Diagnostics.Process.StartWithCreateProcess(ProcessStartInfo startInfo)
   at System.Diagnostics.Process.Start()
   at System.Diagnostics.Process.Start(ProcessStartInfo startInfo)
   at Loader.Program.RunProgram(String path, String username, String password)

My guess is your first process does not even have access to the executable by virtue of the non-admin user's file permissions? (System32 is usually not accessible by non-admin users, not sure where the executable lives) Can you move the program to a directory you know you have permissions for and try again? — lc., Aug 01 '13 at 01:18
The exception is posted above "Process.Start" requires elevation. — CoderWalker, Aug 01 '13 at 01:20

score 3 · Answer 1 · answered Aug 01 '13 at 02:25

3

I guess you're referring to is to trigger an UAC prompt on the newly created process. If so, just a few lines will do the trick, specifically removing the user/pass properties (since they'll be asked by Windows) and setting UseShellExecute to true:

ProcessStartInfo myProcess = new ProcessStartInfo(path);
myProcess.WorkingDirectory = @"C:\Windows\System32";
myProcess.UseShellExecute = true;
myProcess.Verb = "runas";
Process.Start(myProcess);

Two caveats I've noticed with this approach is that, if the user cancels the prompt, an exception will be thrown saying that the user has cancelled (which you must be ready to cancel your processing). Also, if UAC is disabled/not present on the system, the process will NOT be elevated. To counter that, the launched program must be ready to check if it was really given admin permissions.

A complete different approach would be to just add a manifest to the target application (if yuo're able to recompile it) specifying that it requires admin permission.

answered Aug 01 '13 at 02:25

Alejandro

7,290
4
34
59

Thanks for the comment however I'm looking for a way of starting an Admin program from a Non-Admin account so the user wouldn't be able to pass the UAC prompt with admin rights. I know it's possible because Fog Tray, and Novell Desktop Management accomplish this. Ideas? – CoderWalker Aug 01 '13 at 23:54
To clarify, I want the program to auto-start with any user account and to use the Admin account I created for the program to carry out Admin operations without authentication from the user on Windows Vista and 7. Thanks again! – CoderWalker Aug 02 '13 at 00:32
I'm pretty sure Windows also won't allow you to redirect standard input/output/error across the admin/non-admin security boundary. You'll have to find a different way to get output from the program running as admin - Reference: http://stackoverflow.com/a/8690661 – Kiquenet Aug 28 '14 at 09:18
At most, I could think that you can leave a service running in the background (as services are immune to UAC) and use IPC to direct it to perform the work, that's what many programs do with the UI just being a dumb program sending instructions to a worker elevated process. Or you can abuse task scheduler to do the elevation for you. Both come with security problems, however. – Alejandro Aug 28 '14 at 09:59

How to start a program requiring admin rights as an admin user from a nonadmin account

1 Answers1