1.4. Running Tools with Alternate Credentials


A best practice for managing Windows XP systems is to create separate administrator accounts and grant them elevated privileges, instead of letting administrators use their normal user account that they use to access network resources. This is beneficial because an administrator who wants to use elevated privileges has to log on explicitly through an admin account instead of having privileges all the time, which could lead to accidental changes. With the separate account method, the administrator would need alternate credentials to use tools to administer systems unless he or she logged on (locally or with Terminal Services) to the target machine using admin credentials.

There are several ways to specify alternate credentials when running tools. Many GUI and CLI tools have a user and password authentication option. If the tool you want to use does not have that option you can use the runas.exe command instead. The following command runs the enumprop.exe command under the credentials of the administrator account in the rallencorp.com domain:

> runas /user:administrator@rallencorp.com /netonly "enumprop LDAP://dc1/ dc=rallencorp,dc=com"

Sometimes it is convenient to create an MMC console that runs under administrator privileges. In this case, simply use mmc.exe as the command to run from runas:

> runas /user:administrator@rallencorp.com /netonly "mmc.exe"

This will create an empty MMC console from which you can add consoles for any snap-in that has been installed on the local computer. This is beneficial because all of the consoles that you add will be run under that administrative account. If you don't want to type that command over and over, simply create a shortcut on your desktop and put the command as the target path. By doing this you eliminate one of the common complaints about using alternate credentials, that is, it makes the job more tedious.

The /netonly option is necessary if the user you are authenticating with does not have local logon rights on the computer from which you are running the command, or if you want to authenticate with an account from a non-trusted domain.


There is another option for running MMC snap-ins or any GUI program with alternate credentials. Click on the Start menu and browse to the tool you want to open, hold down the Shift key, and then right click on the tool. If you select Run As, you will be prompted to enter alternate credentials with which to run the tool.



Windows XP Cookbook
Windows XP Cookbook (Cookbooks)
ISBN: 0596007256
EAN: 2147483647
Year: 2006
Pages: 408

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net