Creating Windows 2019 User from PHP using command line

Question

I have a requirement to add a user to my windows 2019 web server from a PHP web application I am using a command line command:

NET USER sbarker mypassword /ADD /FULLNAME:"Sue Barker" /PASSWORDCHG:NO /PASSWORDREQ:YES /LOGONPASSWORDCHG:NO /EXPIRES:NEVER

This works fine from a standard command line when logged on as administrator on the server (as you would expect).

To implement this from PHP I am using the following, which I believe to be the correct syntax/format:

<?php   
    $username = "sbarker";
    $userpass = "secure1";
    $fullname = "Sue Barker";
    echo exec("start cmd /C:\Users\Administrator NET USER $username $userpass /ADD /FULLNAME:$fullname /PASSWORDCHG:NO /PASSWORDREQ:YES /LOGONPASSWORDCHG:NO /EXPIRES:NEVER");
?>

This produces no new user, probably because of permissions. What permissions do I need to set to allow user creation? What are my liabilities from a security point of view? Is there a better way of creating a windows user from a PHP web application.

EDIT:

Tried the following with no success:

<?php   
    $test = shell_exec('C:\\WINDOWS\\system32\\cmd.exe /c 2>&1 "NET USER test test /ADD"');
    echo "<pre>$test</pre>";
?>

The result was a System error 5 has occurred. Access is denied. error

Does this answer your question? [Execute batch script with admin rights in windows 8.1 by exec()](https://stackoverflow.com/questions/23410913/execute-batch-script-with-admin-rights-in-windows-8-1-by-exec) — DarkBee, Apr 08 '22 at 11:37
It appears that RunAs cannot have a password piped to it: https://stackoverflow.com/questions/16107381/how-to-complete-the-runas-command-in-one-line#:~:text=The%20runas%20command%20does%20not,you%20type%20the%20password%20manually. — arresteddevelopment, Apr 08 '22 at 15:26
Does this answer your question? [How can I auto-elevate my batch file, so that it requests from UAC administrator rights if required?](https://stackoverflow.com/questions/7044985/how-can-i-auto-elevate-my-batch-file-so-that-it-requests-from-uac-administrator) — Luuk, Jun 02 '23 at 18:46

score 1 · Answer 1 · answered May 24 '22 at 19:13

After extensive research and dead ends, it looks like Microsoft has locked this down to such an extent that programmatically adding users is not possible. Personally I wish they would give developers the choice to execute batch scripts with elevated privileges rather than 'just saying no'.

The basic answer is that it looks like this is not possible.

score 0 · Answer 2 · answered Jun 02 '23 at 18:08

0

This is very much still possible, and i just did it.

You need to set the Application Pool identity as administrator, then it shall work.

answered Jun 02 '23 at 18:08

Harsh

152
1
1
9

Creating Windows 2019 User from PHP using command line

2 Answers2