Any Windows user can run a program in his current session on behalf of another user using RunAs. This allows you to run a script (.bat, .cmd, .vbs, .ps1), an executable .exe file, or install an application (.msi, .cab) with the permissions of another user.
For example, you can use RunAs to install apps or run MMC snap-ins under the administrator account in a non-elevated (unprivileged) user session. Also, you can use RunAs to run an application configured in another user’s profile (the application will load its settings from another user’s profile).
There are several ways to run a program or process as another user in Windows.
- How to Run Apps as Different User from File Explorer?
- RunAs Command: Run a Program Under a Different User from CMD
- Using RunAs in PowerShell
- How to Use RunAs Without Password Prompt?
- How to Create a Shortcut to Run as Different User?
- ?“Run As Different User” Option is Missing in Windows
- Add “Run As” Option to Start Menu in Windows 10
The Secondary Log-on service (seclogon) is responsible for allowing programs to run as different users in Windows. If this service is stopped, all of the described RunAs methods won’t work. You can check that the service is started with the following PowerShell command:
Get-Service seclogon
How to Run Apps as Different User from File Explorer?
The easiest way to run an application under another user is to use the Windows File Explorer GUI. Just find an application (or a shortcut) you want to start, hold the Shift key, and right-click on it. Select Run as different user in the context menu.
In the Windows Security window that appears, you need to specify the name and password of the user under whose account you want to run the application and click OK.
- If you want to run the program as an Active Directory user, you must specify its name in the userPrincipalName (
[email protected]) or samAccountName (DomainName\UserName) format ; - If your computer is joined to an AD domain, then to run the program on behalf of a local user account, specify its name in the following format:
.\localusername.
Open the Task Manager and make sure that the application is running under the specified user account.
RunAs Command: Run a Program Under a Different User from CMD
You can use the Windows built-in runas.exe CLI tool to run apps as a different user from the command prompt. The runas command also allows you to save the user’s password to the Windows Credential Manager so that you don’t have to enter it every time.
Open the command prompt (or the Run window by pressing Win+R). To start the Notepad.exe under the administrator account, run this command:
runas /user:admin "C:\Windows\notepad.exe"
runas /user:"antony jr" notepad.exe
In the next window, the prompt “Enter the password for admin” appears, where you have to enter the user’s password and press Enter.
Your application should start. In my case, this is cmd.exe. The window title says “running as PCName\username“:
For example, you can open the Control Panel under a different user:
runas /user:admin control
If you need to run a program as a domain user, use the following name format UserName@DomainName or DomainName\UserName. For example, to open a text file using notepad on behalf of a domain user account, use the command:
Enter the password for corp\server_admin: Attempting to start C:\Windows\system32\notepad.exe C:\ps\region.txt as user "corp\server_admin " ...
RUNAS ERROR: Unable to run - yourcommand 1326: The user name or password is incorrect.
or
RUNAS ERROR: Unable to acquire user password
Sometimes you need to run a program as a domain user from a computer that is not joined to the Active Directory domain. In this case, you need to use the following command (it is assumed that the DNS server that can resolve this domain is specified in the network settings of your computer):
runas /netonly /user:contoso\bmorgan cmd.exe
If you don’t want to load the user profile when starting the program as a different user, use the /noprofile parameter. In this case, the application starts much faster but may cause incorrect operation of programs that store data in the user’s profile.
Using RunAs in PowerShell
If you need to run programs/processes as another user from PowerShell scripts, you can use the Start-Process cmdlet (Managing Windows processes with PowerShell). First, you need to get the user’s credentials:
$Cred = (Get-Credential)
To start the process, command, or app as another user you can use the PowerShell command:
Start-Process -FilePath "powershell.exe" -Credential $Cred
Or you can get user credentials interactively through Windows Security prompt:
# Run as Administrator
Start-Process -FilePath "powershell.exe" -Verb RunAs
# Run as from another user
Start-Process -FilePath "powershell.exe" -Verb RunAsUser
If you need to run a program as an administrator in elevated mode (by default, UAC runs the program in a not-elevated user context), you can use the following PowerShell command:
Start-Process powershell -Credential woshub\jsmith -ArgumentList '-noprofile -command &{Start-Process "cmd.exe" -verb runas}'
Or a third-party ShelExec tool:
ShelExec /Verb:runas cmd.exe
How to Use RunAs Without Password Prompt?
You can save the user credentials (with password) that you enter. The /savecred parameter is used for this.
runas /user:admin /savecred “C:\Windows\cmd.exe”
After specifying the password, it will be saved to the Windows Credential Manager.
The next time you run the runas command under the same user with the /savecred key, Windows will automatically use the saved password from the Credential Manager without prompting to enter it again.
To display a list of saved credentials in Credential Manager, use the following command:
rundll32.exe keymgr.dll, KRShowKeyMgr
However, it is not safe to use the /savecred parameter. A user whose profile has saved someone else’s password can use it to run any app or command under those privileges or even change another user’s password. Also, it is easy to steal passwords saved in the Credential Manager so it is recommended to prevent a Windows from saving passwords (and never save the password of the privileged administrative accounts).
You can use the RunAs command to run mmc snap-ins as a different user. For example, if you want to run the Active Directory Users and Computers snap-in (from the RSAT administration toolkit) as a different user, you can use this command:
runas.exe /user:DOMAIN\USER "cmd /c start \"\" mmc %SystemRoot%\system32\dsa.msc"
In the same way, you can run any other snap-in (if you know its name).
How to Create a Shortcut to Run as Different User?
You can create a shortcut on your desktop that allows you to run the program as a different user. Just create a new shortcut, and specify the runascommand with the necessary parameters in the Location field:
runas /user:admin? “C:\Windows\notepad.exe”
When you run such a shortcut, you will be prompted to enter a user password.
If you additionally add the /savecred parameter in the runas shortcut, then the password will be prompted only once. The password will be saved in Credential Manager and automatically used when you run the shortcut on behalf of another user without prompting for a password.
Such shortcuts are quite often used to run programs that require elevated permissions to run. However, there are safer ways to run a program without administrator privileges or disable the UAC prompt for a specific application.
?“Run As Different User” Option is Missing in Windows
If the “Run as different user” option is missing from the application’s context menu in File Explorer, you need to check the values of two Windows registry parameters.
On Windows, you can hide or show the RunAs menu item in File Explorer using two registry parameters:
- The HideRunAsVerb parameter (REG_DWORD) under the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer (1 – hide the RunAs item, 0 – show it);
- EnableSecureCredentialPrompting (REG_DWORD) under HKLM\ Software\Microsoft\Windows\CurrentVersion\Policies\CredUI (1 – hide, 0 – show).
If Windows does not display the right-click menu option “Run as another user”, check the values of these registry settings and change them to 0. In a domain environment, you can deploy these registry parameters to computers using Group Policy Preferences.
The EnableSecureCredentialPrompting parameter corresponds to a separate GPO option. Open the Local Group Policy Editor (gpedit.msc) and make sure that the Require trusted path for credential entry policy is disabled (or not configured) in Computer Configuration -> Administrative Templates -> Windows Components -> Credential User Interface.
Add “Run As” Option to Start Menu in Windows 10
By default, items in Windows Start Menu do not have a ?“Run As” option. In order to add the “Run as different user” option, enable the “Show Run as different user command on Start” policy in User Configuration -> Administrative Templates ->Start Menu and Taskbar section of the Local Group Policy Editor (gpedit.msc).
Or, if the gpedit.msc is missing, create a new DWORD parameter with the name ShowRunasDifferentuserinStart and value 1 under the registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer. You can use the following PowerShell command to add the registry parameter:
New-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\Windows\CurrentVersion\Explorer" -Name ShowRunasDifferentuserinStart -Value 1 -PropertyType DWORD -Force
Update the Group Policy settings (gpupdate /force) and make sure that a new context menu More -> Run as different user has appeared for the programs in the Start menu.
The “run as different user” option is missing from the context menu of Universal Windows Platform (UWP, Microsoft Store ) apps. You can run a UWP app as a different user from the command prompt using runas.exe.
List the Microsoft Store apps on your computer using PowerShell:
Get-AppxPackage|select Name
You can find a specific app:
Get-AppxPackage|where {$_.Name -like '*teams*'} |select Name
Find the name of the desired application in the list. For example, to run the built-in Microsoft Teams Chat client as another user, do the following:
runas /user:user1 "explorer.exe MicrosoftTeams:"
10 comments
Great write up. It worked like a charm.
perfect! thank you!
This is perfect article
i use run command for different user and it ask me for writing password on new cmd window but i am unable to write . i have checked runas.exe properties in which administrator have only read and execute persmission .kindly suggest me solution
Great write up. Everything is working as described. When I use runas the application is launching in the specified users background how do I launch to the foreground so the application opens on top for the user?
The last option was perfect thanks, I can see why that might be disabled by default but I wish it wasn’t!
works well, would it be possible to specify the password within this shortcut so there is no need to type it all the time?
Beware, while “runas” creates a new user context, especially in case of admins the created processes ARE NOT elevated the same kind like when “Run as Administrator” is used.
> Do Not Use Runas to Launch an Elevated Process
> Be aware that runas does not provide the ability to launch an application with an elevated access token, regardless of whether it is a
> standard user with privileges like a Backup Operator or an administrator. The runas command grants the user the ability to launch
> an application with different credentials. The best method to use to launch an application with a different account is to perform the
> action programmatically by using a service and not rely on the user to run the component as a different user. If your program
> programmatically uses the runas command, ensure that it is not intended to launch an elevated process.
https://msdn.microsoft.com/en-us/library/bb756922.aspx
That limitation can be worked around by using additional tools like “ShelExec” the verb “runas”, which seems to behave differently and elevate a process as well.
> ShelExec /Verb:runas cmd.exe
A very useful article, thanks!
Is it possible to perform a reg query for another user via the runas command?