Running Windows Explorer with alternate credentials

For added security it is recommended that users' accounts do not have Administrator rights. This can be problematic for support technicians who may need admin rights to perform regular support tasks. Typically this is easily worked-around by using the Run As feature of Windows 2000 and Windows XP.

Windows Explorer is a commonly-used program for which Run As will not work. This is because EXPLORER.EXE doubles as the file manager and the shell. When a user attempts to launch EXPLORER.EXE in a different user context... nothing happens. This makes it problematic to perform simple tasks like moving files in restricted folders or changing NTFS permissions on network shares.

As Internet Explorer will also perform file management functions, it can be used to work around this problem. Lauch IEXPLORE.EXE Running As an admin user and simply enter the network path in the address bar instead of a URL, or you can launch IE in file manager mode directly to the path of your choice as shown below. This example assumes default paths and wraps:

runas /user:<YOURADMINUSER> "C:\Program Files\Internet Explorer\iexplore.exe \"<PATH>\""

As an added tip, you can brand the Run As IE window. Once in file manager mode, it's difficult or impossible to tell the difference between the IE window running with Admin rights and any other Explorer window. You can brand the window by "skinning" the IE window of the Run As administrator account. Save a .bmp that you want to use to skin the window (a small red square works nicely) on the local system (network paths don't work) and add the following registry entry to the profile of the Run As user. This is very important as it is the profile that will be used to actually run the application. Creating this setting in the primary user account won't work. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar and find the String value BackBitmap (create it if it doesn't exist). Set it to the full path to your skin .bmp, e.g. C:\skin.bmp

Warning: By visiting this site and/or by using any information contained herein, you agree to the Techbytes.ca terms of use.

Add a comment about this TechByte

If you wish to add a comment regarding this TechByte, please use the form below. Please note that by submitting comments using this form you are allowing all of the information submitted to be visible on this website. Any comments submitted using this form will only be shown on the website if they are approved by the administrators of this site. IF APPROVED, COMMENTS MAY TAKE SEVERAL DAYS TO BE POSTED.

Other TechBytes:

• Configuring Windows applications to run under non-Administrator accounts
• Bootable Citrix client CD
• Customize MessageBox Buttons