Runas

啊哈、好久没写日志了、一看今天是2012-4-28日、离上次写日志、相隔时间太久了、、没所以就来写点东东了、、还记得上次写的那个关于文件的MD5值的计算的文章吧、这篇就是接那篇的做为一个企业网管一台一台和给别人安装软件（是权限问题无法安装而非技术问题）实在是一件让人头痛的事、没技术含量还费时间。

一想想、一个power user 要做一个Administrator 的事、你可以●1. 注销-切换Administrator 用户-安装软件-注销-切换power user用户●2. 在命令提示符下用runas (关于runas的语法、可用runas /? 查询)提升至管理员、用命令提示符打开要安装的软件。

●3. 就是在C:\WINDOWS\system32\cmd.exe 右击-运行方式-下列用户-输入用户名、密码、即可，再用命令提示符打开要安装的软件。

以上3种都可将权限提升到管理员会再安装程序、前一种要注销的、也就是说前一个用户的资料、如没保存即会丢失。

后两种可在当前用户下安装、但仍会很麻烦、这要用到Secondary Logon这个服务、一般情况下这个服务是开的、但要是ghost的、就两说了、那有什么方法、让用户自己就可以安装呢、而不是管理员过去一台台的输入密码、呵呵这就是我们今天的这篇文章了、本人在网上找了好多的资料、结果还真让我找一个、/Main/CodeDetail.aspx?CodeId=3658额~~好像打不开了、、不过、这家网站还是不错的打不开、我就凭记忆写写看了、我把计算机administrator 密码修改为test做一个程序界面如下图双击窗体进入Form Load 输入Text1 = "Administrator"Text2 = "test"Text3 = "" '//Domain name OptionalText4 = "gh.exe" '//Process to execute双击运行输入RunAsUser Text1, Text2, Text3, Text4, CurDir$然后我们要加一个模块，(工程、添加模块、) 写入下面代码，（果断复制）。

----------------------------------复制以下--------------------------------------------------Option ExplicitPrivate Const CREATE_DEFAULT_ERROR_MODE = &H4000000Private Const LOGON_WITH_PROFILE = &H1Private Const LOGON_NETCREDENTIALS_ONL Y = &H2Private Const LOGON32_LOGON_INTERACTIVE = 2Private Const LOGON32_PROVIDER_DEFAULT = 0Private Type STARTUPINFOcb As LonglpReserved As Long ' !!! must be Long for Unicode stringlpDesktop As Long ' !!! must be Long for Unicode stringlpTitle As Long ' !!! must be Long for Unicode stringdwX As LongdwY As LongdwXSize As LongdwYSize As LongdwXCountChars As LongdwYCountChars As LongdwFillAttribute As LongdwFlags As LongwShowWindow As IntegercbReserved2 As IntegerlpReserved2 As LonghStdInput As LonghStdOutput As LonghStdError As LongEnd TypePrivate Type PROCESS_INFORMATIONhProcess As LonghThread As LongdwProcessId As LongdwThreadId As LongEnd Type' LogonUser() requires that the caller has the following permission' Permission Display Name' --------------------------------------------------------------------' SE_TCB_NAME Act as part of the operating system' CreateProcessAsUser() requires that the caller has the following permissions ' Permission Display Name' ---------------------------------------------------------------' SE_ASSIGNPRIMARYTOKEN_NAME Replace a process level token ' SE_INCREASE_QUOTA_NAME Increase quotasPrivate Declare Function LogonUser Lib "advapi32.dll" Alias _"LogonUserA" _(ByVal lpszUsername As String, _ByVal lpszDomain As String, _ByVal lpszPassword As String, _ByVal dwLogonType As Long, _ByVal dwLogonProvider As Long, _phToken As Long) As LongPrivate Declare Function CreateProcessAsUser Lib "advapi32.dll" _ Alias "CreateProcessAsUserA" _(ByVal hToken As Long, _ByVal lpApplicationName As Long, _ByVal lpCommandLine As String, _ByVal lpProcessAttributes As Long, _ByVal lpThreadAttributes As Long, _ByVal bInheritHandles As Long, _ByVal dwCreationFlags As Long, _ByVal lpEnvironment As Long, _ByVal lpCurrentDirectory As String, _lpStartupInfo As STARTUPINFO, _lpProcessInformation As PROCESS_INFORMA TION) As Long' CreateProcessWithLogonW API is available only on Windows 2000 and later. Private Declare Function CreateProcessWithLogonW Lib "advapi32.dll" _ (ByVal lpUsername As String, _ByVal lpDomain As String, _ByVal lpPassword As String, _ByVal dwLogonFlags As Long, _ByVal lpApplicationName As Long, _ByVal lpCommandLine As String, _ByVal dwCreationFlags As Long, _ByVal lpEnvironment As Long, _ByVal lpCurrentDirectory As String, _ByRef lpStartupInfo As STARTUPINFO, _ByRef lpProcessInformation As PROCESS_INFORMATION) As LongPrivate Declare Function CloseHandle Lib "kernel32.dll" _(ByVal hObject As Long) As LongPrivate Declare Function SetErrorMode Lib "kernel32.dll" _(ByVal uMode As Long) As LongPrivate Type OSVERSIONINFOdwOSVersionInfoSize As LongdwMajorVersion As LongdwMinorVersion As LongdwBuildNumber As LongdwPlatformId As LongszCSDVersion As String * 128End Type' Version Checking APIsPrivate Declare Function GetVersionExA Lib "kernel32.dll" _(lpVersionInformation As OSVERSIONINFO) As IntegerPrivate Const VER_PLATFORM_WIN32_NT = &H2'********************************************************************' RunAsUser for Windows 2000 and Later'******************************************************************** Public Function W2KRunAsUser(ByVal UserName As String, _ByVal Password As String, _ByVal DomainName As String, _ByVal CommandLine As String, _ByVal CurrentDirectory As String) As LongDim si As STARTUPINFODim pi As PROCESS_INFORMATIONDim wUser As StringDim wDomain As StringDim wPassword As StringDim wCommandLine As StringDim wCurrentDir As StringDim Result As Longsi.cb = Len(si)wUser = StrConv(UserName + Chr$(0), vbUnicode)wDomain = StrConv(DomainName + Chr$(0), vbUnicode)wPassword = StrConv(Password + Chr$(0), vbUnicode)wCommandLine = StrConv(CommandLine + Chr$(0), vbUnicode)wCurrentDir = StrConv(CurrentDirectory + Chr$(0), vbUnicode)Result = CreateProcessWithLogonW(wUser, wDomain, wPassword, _LOGON_WITH_PROFILE, 0&, wCommandLine, _CREATE_DEFAULT_ERROR_MODE, 0&, wCurrentDir, si, pi)' CreateProcessWithLogonW() does notIf Result <> 0 ThenCloseHandle pi.hThreadCloseHandle pi.hProcessW2KRunAsUser = 0ElseW2KRunAsUser = stDllErrorMsgBox "CreateProcessWithLogonW() failed with error " & stDllError, vbExclamationEnd IfEnd Function'********************************************************************' RunAsUser for Windows NT 4.0'********************************************************************Public Function NT4RunAsUser(ByVal UserName As String, _ByVal Password As String, _ByVal DomainName As String, _ByVal CommandLine As String, _ByVal CurrentDirectory As String) As LongDim Result As LongDim hToken As LongDim si As STARTUPINFODim pi As PROCESS_INFORMATIONResult = LogonUser(UserName, DomainName, Password, LOGON32_LOGON_INTERACTIVE, _LOGON32_PROVIDER_DEFAULT, hToken)If Result = 0 ThenNT4RunAsUser = stDllError' LogonUser will fail with 1314 error code, if the user account associated' with the calling security context does not have' "Act as part of the operating system" permissionMsgBox "LogonUser() failed with error " & stDllError, vbExclamationExit FunctionEnd Ifsi.cb = Len(si)Result = CreateProcessAsUser(hToken, 0&, CommandLine, 0&, 0&, False, _CREATE_DEFAULT_ERROR_MODE, _0&, CurrentDirectory, si, pi)If Result = 0 ThenNT4RunAsUser = stDllError' CreateProcessAsUser will fail with 1314 error code, if the user' account associated with the calling security context does not have' the following two permissions' "Replace a process level token"' "Increase Quotoas"MsgBox "CreateProcessAsUser() failed with error " & stDllError, vbExclamationCloseHandle hTokenExit FunctionEnd IfCloseHandle hTokenCloseHandle pi.hThreadCloseHandle pi.hProcessNT4RunAsUser = 0End FunctionPublic Function RunAsUser(ByVal UserName As String, _ByVal Password As String, _ByVal DomainName As String, _ByVal CommandLine As String, _ByVal CurrentDirectory As String) As LongDim w2kOrAbove As BooleanDim osinfo As OSVERSIONINFODim Result As LongDim uErrorMode As Long' Determine if system is Windows 2000 or laterosinfo.dwOSVersionInfoSize = Len(osinfo)osinfo.szCSDVersion = Space$(128)GetVersionExA osinfow2kOrAbove = _(osinfo.dwPlatformId = VER_PLATFORM_WIN32_NT And _osinfo.dwMajorVersion >= 5)If (w2kOrAbove) ThenResult = W2KRunAsUser(UserName, Password, DomainName, _CommandLine, CurrentDirectory)ElseResult = NT4RunAsUser(UserName, Password, DomainName, _CommandLine, CurrentDirectory)End IfRunAsUser = ResultEnd Function-----------------------------------复制以上---------------------------------------------------------------- 然后--保存—生成—如下图、当然这是可修改程序名的、我修改为Runas.exe 如下图确定—保存—你会发现、密码竟然是名文、这可不行呀我们要修改下属性选中Text2 修改如下图这样、、password 就是****了。