| Windows IT professionals often have two accounts: a limited-privilege user account that they use to log on to their own computers and a high-privilege account that they use to log on to users' computers for maintenance or troubleshooting purposes. When Windows IT professionals need to use the high-privilege account, they can use the Runas command with Windows Explorer. However, a registry edit is needed to make it work. |
In his Reader to Reader article “Access Remote Files with iexplore.exe” (InstantDoc ID 95445, June 2007), Serge Bédard mentions that his company’s IT staff members have two accounts: a limited-privilege account that they use to log on to their own computers and a high-privilege account that they use to log on to users’ computers for maintenance or troubleshooting purposes. Not wanting to constantly use the Net Use command to create a special connection, Serge discovered that he could use the Runas command with Internet Explorer (IE) 6.0 to access to computers under the high-privilege account. He mentioned that he had tried using the Runas command with Windows Explorer (explorer.exe), but it didn’t work.
You can use the Runas command with Windows Explorer, but you first need to make a registry edit. Here are the steps to follow:
- Under the Start menu, select Run and enter the command runas /user:domain\username regedit where domain\username is the high-privilege account you want to log on with. Click OK. In the command-shell window that appears, enter the relevant password and press Enter. The registry editor will appear and will be running under the high-privilege account.
- In the registry editor, navigate to the HKEY_CURRENT_USER\Software\Microsoft Windows\CurrentVersion\Explorer Advanced key. In the SeparateProcess entry, change the value from 0 to 1. I’ve noticed that this key is missing on some clients. If it’s missing, you can safely create the key. Close the registry editor.
- Under the Start menu, select Run and enter the command
runas /user:domain\username explorer.exe
where domain\username is the high-privilege account you want to log on with. Click OK. In the command-shell window that appears, enter the relevant password and press Enter. Presto—you should have a Windows Explorer window that’s running under the high-privilege account. In this window, you can access files on the target remote computers.
If desired, you can place a shortcut to Windows Explorer on your desktop (i.e., the desktop mapped to your limited-privilege user account). To do so, paste a shortcut to C:\%WINDIR%\explorer.exe on your desktop. Right-click the shortcut and click Properties. On the Shortcut tab, click Advanced and select the Run with different credentials check box. Click OK twice. Now when you double-click the shortcut, you’re presented with the Run As dialog box that lets you run Windows Explorer under the current logon account or a different account. This is where you’d use the high-privilege account.
Using the Runas command with Windows Explorer is preferable to using the Runas command with IE because, as Serge points out, the Runas command works with IE 6.0 but not IE 7.0. Although I’ve only used the Runas command with Windows Explorer on Windows XP, this fix will likely work on other OSs as well. If you try this fix on other OSs, be sure to try it on a test machine first. Thanks to Aaron Margosis for his help with creating this fix.
— Simon Drake, Network Administrator, Barnett Waddingham