Linux SuperUser command, but for Windows

[MrLudwig]

Hi,

 

Does anyone know of an equivalent of the Linux/Unix su command for Windows?

 

I need a way of being able to temporarily access files/folders and settings that are normally locked-down for the students, without the need to log them off and login as myself.

 

Thanks.

 

 

MrLudwig

[DMcCoy]

runas?

[Geoff]

Well, runas is more like the su command in *nix.

[NetworkGeezer]

This presupposes you have enabled file context menus (right-clicking) or the command prompt in user profiles.

[Geoff]

well you can always psexec into a machine remotely and do it that way.

[NetworkGeezer]

Yeah but no GUI and no network resources and unless you want to transmit admin credentials in clear text

 

Has any setup an SSH daemon/service or their Windows boxes?

[Geoff]

http://sshwindows.sourceforge.net/

 

Enjoy.

[CyberNerd]

also IIRC commercial ssh runs on windows and is free for edu

[NetworkGeezer]

/me rubs hands with glee

[ChrisH]

I have used a SSH server on my home PC for a bit now. If you want more than a command line interface as well bitvise tunnelier is a nice windows ssh client which makes it nice and easy to do various tasks quick and simple.

[NetworkGeezer]

Am I correct in understanding that Microsoft have made thing so that you can't run a remote desktop session on an XP box unless the console session is locked or logged out.

[ChrisH]

Yes but you could also VNC over SSH if you want.

[Geoff]

Am I correct in understanding that Microsoft have made thing so that you can't run a remote desktop session on an XP box unless the console session is locked or logged out.

 

I'm sure there's a command line option for connecting to the users desktop rather than logging them out and locking the workstation. It's something like -console.

[ChrisH]

There is a /console switch that claims to connect to the console session of a server but when I tried it I never seemed to get the syntax right as I always ended up with a GUI.

[sahmeepee]

You can make a terminal server connection to one of your servers and log in with admin credentials. That won't let you make settings in config dialogs, but I'm not sure any of the suggestions here do except runas.

 

In some cases you could probably make a shortcut to the program you want to run and under the shortcut's properties, shortcut tab, advanced, tick "run with different credentials". You can use iexplore.exe for file management under a different account but you need to F5 after deleting files for it to display properly.

 

In the case of control panel applets you'll want to makea shortcut to the actual .cpl file and modify that - otherwise "run with different credentials" will be unavailable.

[sahmeepee]

There is a /console switch that claims to connect to the console session of a server but when I tried it I never seemed to get the syntax right as I always ended up with a GUI.

 

The console command is for connecting to the session which is displayed on the physical monitor, as opposed to a terminal server session. If you try connecting with "mstsc /console /v:your2003server" you'll get the screen you'd see if you plugged a monitor into the server rather than a ctl+alt+del login prompt. I'm crap at explaining it, hope that makes sense!

 

UPDATE: BTW, you're allowed that console rdp connection in addition to the 2 normal terminal services connections on a standard server, which can come in handy on occasion.

[DMcCoy]

There is a /console switch that claims to connect to the console session of a server but when I tried it I never seemed to get the syntax right as I always ended up with a GUI.

 

The console in this case is the *primary* windows login afaik. For example is you are logged in to the server locally and connect with mstsc you will start a new session, with /console it will take control of the local session.

[DMcCoy]

I'm too slow it seems

[ChrisH]

I getchya

[Ric_]

Getting back to the su equivalent... you can also do

 

> runas /noprofile /user:MACHINENAME\administerator cmd

 

You could also use switches with 'cmd' so that you can easily identify the admin console.

[NetworkGeezer]

So you allow access to the command prompt for your students?

[MrLudwig]

So, the mstsc with the /console switch essentially has the same end result as using VNC, remote control of a machine as if you were sat in front of it.

 

But if I connected to a machine with a restricted user already logged in, wouldn't I simply be remotely controlling their session, and so still have restricted access to the system?

 

Oh, and we do disable right-click context menus and access to the command prompt for student accounts, so the RunAs option gets a bit tricky.

 

 

 

MrLudwig.

[ajbritton]

You cannot use MSTSC to remote control a limited user for the following reason;

 

When you use /console to log into the remote machine, you must log on as the same user that is logged on at the remote machine. By default, limited users cannot do this (for good reason!)

 

AFAIK the /console switch works with 2003 server and XP only. In fact, with XP it is implicit. It's not possible to connect to any session other than the console.

 

UltraVNC is the way to go.

[NetworkGeezer]

This link from AppDeploy may be useful to someone: http://www.appdeploy.com/tips/detail.asp?id=45

[ajbritton]

There's also Superior SU, which looks very impressive. It does not appear to work on my ageing Win2K Dell however.