Thursday, April 24, 2008

RunAs

Add user account (or yourself) to the local machine - Computer Management - Local Users and Groups - Groups

C:\>runas /profile /user:whoopie\my.serviceAccount "c:\winnt\notepad.exe"

Notes:

a.) Better to use full path to actual executable

b.) In Local Security Settings \ User Rights Management, a 'deny' property overrides an 'allow' property. So, if whoopie\my.serviceAccount is in 'Administrators' & 'Administrators' have "Allow to log on ..." but whoopie\my.serviceAccount is also in group 'Foobar' and 'Foobar' has "Deny log on ..." then whoopie\my.serviceAccount will not be able to log on even though the 'Administrators' group is higher than the 'Foobar' group.