Run as a different user in PE

[mrbeatnik]

I need to run an application that will access the network - and this needs to be run as a user on the domain.

Using PE 2.1 / 3.0 (Vista SP1 / Win 7)

Naturally the minint admin does not have domain access.

I can't run runas because the secondary logon doesn't exist.

PSEXEC wont run locally presumabley for the same reason.

I'm unsure if I can get the secondary logon service installed and started in PE, but this sounds like the way to go.

Would anyone have any guidelines on how to do this? What files to copy across and what commands to initiate?

I have tried copying seclogon.dll and sc.exe and using the command:

> sc create seclogon binPath= "x:\WINDOWS\System32\svchost.exe -k netsvcs" start= auto DisplayName= "Seconday Logon"

Unfortunately this just shows the help text from sc, with all the possible parameters - it doesn't seem to process the command at all (no error or success message).

I also tried exporting the seclogon registry entry for the service and importing directly, but no joy (note I exported from Win XP - need to try with Win 7, but I'm not holding my breath there...)

Also, trying to start the service with the imported hive doesn't work...

> sc start seclogon
[SC] StartService FAILED 1083:
The executable program that this service is configured to run in does not implement the service.

> net start seclogon
System error 1083 has occurred.
The executable program that this service is configured to run in does not implement the service.

Otherwise there may be another way forward?

Any suggestions anyone?

Thanks!

Edited April 23, 2009 by mrbeatnik

[mrbeatnik]

Hmmmn, I don't know what, but I must have got the command slightly wrong. This works:

> sc create "SecLogon" binPath= "x:\WINDOWS\System32\svchost.exe -k netsvcs"

Seems to start and be running.

However, the next issue is RunAs.exe.

Again I copied from XP, but RunAs gives an error:

The procedure entry point NetpGetDomainName could not be located in the dynamic link library NETAPI32.dll

Thanks!

Edited April 23, 2009 by mrbeatnik

[mrbeatnik]

OK, added in runas.exe from Windows 7 (into PE 3.0) and the error doesn't appear.

However, the command doesn't seem to process correctly - nothing seems to happen.

> runas

> runas /user:administrator notepad
Enter the password for administrator:

[Tripredacus]

Try to map a network drive using the fully qualified domain login, then try to run your program.

[mrbeatnik]

Thanks for the rpely (as usual!!), but it didn't work

Did:

net use y: \\192.168.0.1\c$ /user:domain\administrator

It maps the drive OK, but still tries to launch the application (local) in the context of the local user regardless.

If I move the app to the new share, then it strill tries to launch in the local context, but on the remote drive...

So either way the command tries to run as a local user, and the function gets an access denied because it needs to be run as a domain user...