How would i run my application as a admin insted of rightlicking and choose rus as?

I wrote a application that will unlock users when they get locked out. I need my application to authenticate and run as a admin user so it can unlock the locked out users when a normal user runs it. I need to have the the admin credentials stored inside my application so it authenticates first then unlocks the locked out users if you need to see my code i will be happy to post.


I dont want to add a text box for user or pass and give the person who will be using this a admin account.... not cool
and this admin account that will be stored inside my app will be monitored closely.


Thank you for your time

Summey

Quote:

---

Originally Posted by summey

I wrote a application that will unlock users when they get locked out. I need my application to authenticate and run as a admin user so it can unlock the locked out users when a normal user runs it. I need to have the the admin credentials stored inside my application so it authenticates first then unlocks the locked out users if you need to see my code i will be happy to post.


I dont want to add a text box for user or pass and give the person who will be using this a admin account.... not cool
and this admin account that will be stored inside my app will be monitored closely.


Thank you for your time

Summey

---

So, if the user doesn't have to enter a password to enable the account, I fail to see the security in that approach. Anyone could execute the program without trouble, so what would be the point?

the plant lead will have the application so if the user out on the floor locks out the terminal he can just click search and find the account and hit unlock done but because the lead is a normal user it wont work because my app requires you to run as admin ... I want to add admin creds inside my code they wont see it it wil be compiled and i cant just give them an admin account they will log in to there machine using that etc.. so i just want my program to start then when you click unlock it authenticates with Active directory with the account stored in my app then unlocks the locked out users

Hmmm...not sure how to address your problem, but my opinion is that the plant lead should still have to type in their password. That is the standard way of doing this stuff and for good reason; you cannot ensure that the program will never fall into the hands of someone else.

yeah but its only able to unlock a uses account they cant do anything else i mean of cores if they disassemble my app then yeah they could see the user and pass but those creds like i said before will be highly monitored. and and i can publish this to except updates then just change the password once a month or whatever and it will check for updates and change the password in the app.

Quote:

---

Originally Posted by summey

yeah but its only able to unlock a uses account they cant do anything else i mean of cores if they disassemble my app then yeah they could see the user and pass but those creds like i said before will be highly monitored. and and i can publish this to except updates then just change the password once a month or whatever and it will check for updates and change the password in the app.

---

what if they change their password? How will you know if you are storing credentials internally? I just don't think that it is a good approach.

there's a VBS file that you can download called ELEVATE that lets you script values into batch/powershell scripts

no they wont have a clue what creds are in the application i just want to authenticated the application to it runs as a admin instead of having to right lick and run it as a admin then entering creds .... i will be changing the password for that account with in my app using updates for the program...

sorry. edited the post. looked up info.. MSDN Magazine Copyright. Should be free

Quote:

---

Originally Posted by summey

no they wont have a clue what creds are in the application i just want to authenticated the application to it runs as a admin instead of having to right lick and run it as a admin then entering creds .... i will be changing the password for that account with in my app using updates for the program...

---

OK. The problem is that, if the user is not an admin, the program cannot run as an admin by default. That is the security model. Otherwise, what would be the point of running as a limited user if you could just run programs that did things with administrative credentials? It just doesn't make sense...

Found it.
http://technet.microsoft.com/en-us/m...t.aspx?pr=blog

You should look into Powershell 2.0 CTP

That would allow you to create a batch like environment that you can INVOKE on a target machine

thank you for the link ill check that out i use powershell.

1. Hello, I have a similar case that I need to run my desktop application as admin or at least I need my system to display a message box to grant the permission for the run of the application
2. Do you know why even when I chose to run my application as admin, the application still stops running due to violation of access permit "You dont have permission to access C:\\somefolder" for example.


THANKSSS

I'm trying to authenticate against active directory. Are you on a domain ?

this is what im talking about

http://msdn.microsoft.com/en-us/maga...135979.aspx#S9

Figure 12 Authenticating a User in AD LDS

Code:

---

// establish context with AD LDS
PrincipalContext ldsContext =
    new PrincipalContext(
        ContextType.ApplicationDirectory,
        "sea-dc-02.fabrikam.com:50000",
        "ou=ADAM Users,O=Microsoft,C=US");

// determine whether a user can validate to the directory
Console.WriteLine(
    ldsContext.ValidateCredentials(
        "user1@adam",
        "Password1",
        ContextOptions.SimpleBind +
        ContextOptions.SecureSocketLayer));

---

Quote:

---

Originally Posted by summey

I need to have the the admin credentials stored inside my application

---

Do you think that this is a good idea? What happens if the account or domain changes? Would that break your application?

Quote:

---

Originally Posted by Arjay

Do you think that this is a good idea? What happens if the account or domain changes? Would that break your application?

---

I asked the same thing, but got the reply

Quote:

---

Originally Posted by summey

no they wont have a clue what creds are in the application i just want to authenticated the application to it runs as a admin instead of having to right lick and run it as a admin then entering creds .... i will be changing the password for that account with in my app using updates for the program...

---

So who knows.

the account wont change it will be static administer account i set up in AD and monitor it for use other then being stored inside my code to run this app i just dont know how to do that.... . No way it can be changed unless someone decompiles my app changes it and recompiles it... highly unlikely ... all this does iis unlock locked out users right now i have list the locked out users in a combo box... also im going to set up updates when i build this app so it checks for updates so once a month i can change the password re build and when my app is executed it will look for updates and changes the password the user using it hasnt a clue whats going on except he is unlocking accounts.
it works great i just want a normal users account to be able to run this one app as a admin so it can unlock that locked out users.

Thank you for your time.

Storing logon hardcoded account information inside the app is a security issue - it's not about changing the hardcoded information and recompiling the app, it's about gaining access to the information.

You may consider hosting a service for this functionality. The service can run under any account information and you can limit access to the service through AD. Then the client app simply connects to the service and wouldn't need any elevated permissions.

Quote:

---

Originally Posted by Arjay

Storing logon hardcoded account information inside the app is a security issue - it's not about changing the hardcoded information and recompiling the app, it's about gaining access to the information.

You may consider hosting a service for this functionality. The service can run under any account information and you can limit access to the service through AD. Then the client app simply connects to the service and wouldn't need any elevated permissions.

---

Where would be a good place to read up on how to do something like that?

Thank you for your time
-Summey