I don't know if this is already possible or not in Windows 7. If it's not, it would be nice if it's implemented for the next version. From time to time, I need to run programs, mainly network applications, using domain admin account. Either I would log in to domain controller or another RDP server as domain admin. It would be nice if I could run an application using another credentials without really having to "jump" to another server. PS: I know it's possible to configure things to let my own credential (and that's what I've already done for some) but I don't like this solution.

"Run network applications as somebody else?...I know it's possible to configure things to let my own credential (and that's what I've already done for some) but I don't like this solution." As opposed to what? If you're looking for a way to run network applications without using a domain admin account then the next best thing woulld likely to determine what's the least privaledges that these applications can actually use in your domain and then run them under the context of those accounts.

You can try the RUNAS command lines. Please refer: Runas Arthur Xie TechNet Subscriber Support in forum If you have any feedback on our support, please contact tngfb@microsoft.com.Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

As opposed to what? If you're looking for a way to run network applications without using a domain admin account then the next best thing woulld likely to determine what's the least privaledges that these applications can actually use in your domain and then run them under the context of those accounts. I didn't ask for that. Please re-read my post.

You can try the RUNAS command lines. Please refer: I had tried that, but: 1. I've not managed to run "explorer" with it. I've tried runas /user:mydomain\administrator explorer and I get the "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item." Then I've tried runas /user:mydomain\administrator "explorer c:" and this time, nothing appears on the screen, not even error message! 2. It would be nice if it's more GUI-oriented than command line. I'd expect a right-click on the program (or shortcut) and there's a context menu item saying "Run as..." to use.

Horinius, Explorer.exe is a special case :). if you have a system pre windows vista or pre windows server 2008. You had the option to use the /separate switch. E.g. runas /user:mydomain\administrator "explorer.exe /separate" But since windows vista and server 2008 Microsoft made a design change that doesn't allow you to run Explorer in multiple instances in the same session. so by default this option won't work on a vista box or higher. However, there are some people who claim that there are some workarounds aviable for this issue. See http://www.corelan.be:8800/index.php/2008/04/13/run-explorer-window-with-administrator-rights-in-vista/ And it might work if you kill your explorer.exe process first. What administrative tasks do you want to perform on your machine? Because you do not need to start explorer for every administrative task. For example run active directory users and computers as admin runas /user:mydomain\administrator "Dsa.msc" run the windows eventvieuwer as admin runas /user:mydomain\administrator "eventvwr.msc" Etc ... Kind Regards DFT IM me - TWiTTer: @DFTER

Hi Horinius, Why would you like to run Explorer as another account? Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”

Explorer.exe is a special case :). Oh! if you have a system pre windows vista or pre windows server 2008. You had the option to use the /separate switch. E.g. runas /user:mydomain\administrator "explorer.exe /separate" That is nice to know! I've just tried that in some XP and that works! Great! I'm thinking if it's possible to make some shortcut or change some registry to make it ask for username as well. My own working computer is Win7... too bad! But since windows vista and server 2008 Microsoft made a design change that doesn't allow you to run Explorer in multiple instances in the same session. so by default this option won't work on a vista box or higher. However, there are some people who claim that there are some workarounds aviable for this issue. See http://www.corelan.be:8800/index.php/2008/04/13/run-explorer-window-with-administrator-rights-in-vista/ And it might work if you kill your explorer.exe process first. That web page doesn't seem to provide what I'm looking for. I mean, having admin right in a local computer isn't enough to have domain right. About killing explorer.exe process... well... I'm not sure I'd like to. What administrative tasks do you want to perform on your machine? Because you do not need to start explorer for every administrative task. For example run active directory users and computers as admin runas /user:mydomain\administrator "Dsa.msc" run the windows eventvieuwer as admin runas /user:mydomain\administrator "eventvwr.msc" I knew I don't need to start explorer for every admin task. explorer was for other things, mainly for manage files in network shares. I had tried the following commands in CMD, with and without "run as admin", but none of them works runas.exe /user:mydomain\administrator "dsa.msc" runas.exe /user:mydomain\administrator "mmc dsa.msc" I get: RUNAS ERROR: Unable to run - mmc dsa.msc 740: The requested operation requires elevation. Because I'm using Win7?

explorer is just an example, but it's also something I use quite often. Let me explain. In my company, some network files and folders have special security settings. Reasons can be for confidentiality or to make sure they aren't deleted unexpectedly. Eg, I've configured a shared folder so that everybody, except domain admin, can ONLY read but not modify (including delete). My personal account is of course no exception to make sure even myself I won't delete files accidentally. But when I need to make changes to them, I would then log in as domain admin and do so.

Hi, You have to run cmd.exe as administrator. Otherwise you are not able to run programs that need high privilege.Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

You have to run cmd.exe as administrator. Otherwise you are not able to run programs that need high privilege. I was already running cmd as admin, as stated in my reply.

In one of your previous post you mentioned: I knew I don't need to start explorer for every admin task. explorer was for other things, mainly for manage files in network shares. I had tried the following commands in CMD, with and without "run as admin", but none of them works runas.exe /user:mydomain\administrator "dsa.msc" runas.exe /user:mydomain\administrator "mmc dsa.msc" I get: RUNAS ERROR: Unable to run - mmc dsa.msc 740: The requested operation requires elevation. Because I'm using Win7? That is because your domain admin may be not a member of your local admin group so the domain admin is not allowed to open *.mmc programs. You can add your domain admin account into the local admin group then the runas command lines will run properly. Additionally, if you just would like to access a network share with different credential, there is an easier way. You can run “net use [Drive]:\\[server]\[share] /user:Accounts\%user%” command lines to temporary map the shared folders to your local computer with a different credential. Net use Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

That is because your domain admin may be not a member of your local admin group so the domain admin is not allowed to open *.mmc programs. You can add your domain admin account into the local admin group then the runas command lines will run properly. Additionally, if you just would like to access a network share with different credential, there is an easier way. You can run “net use [Drive]:\\[server]\[share] /user:Accounts\%user%” command lines to temporary map the shared folders to your local computer with a different credential. Net use Domain admin is already a member of local admin group. So that's not the cause. I have just tried that "net use" command but it didn't work. I really think it's because I'm using Win 7

Hi, Maybe you can try create a task in Task Scheduler. When create a task, you can select the user or group that is used when running the task. Also you should select to run with high privileges. You may refer: Bypass UAC using a Desktop Shortcut Please note, when creating the task, in the General tab, click the button “Change User or Group” and select the domain admin account.Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

You mean to create a task to do "net use"? That's really too much hassle for little use. The time I need to create such task is longer than I log into an RDP server and do the job. So, no, thanks, I'm not going to try this. I just hope somebody could reflect this wish to Microsoft's engineer team for next version, as I mentioned in my very first post.

You may try to launch C:\Windows\Explorer.exe with argument. The argument should be the path of the network folder you want to access. Additionally I would like to tell you that this forum is always monitoring by related department. All customer feedbacks will be send to proper team.Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

It's OK, forget about it.

Hi, Does it work now? Or you found another solution?Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

No. I'd better wait for the next version of Windows.

Hi, Microsoft pays more attention to this Subscriber forum. I believe that your feedback has been noticed by proper department.Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.