Run internal function in second process.

[Mikeman27294]

Hey guys,

I just came across this thread;

Where the poster asked how to run an internal function with admin rights. As far as I am aware, there has never been a script example of this. As is debated for the next 10 or so posts, this is not actually running the function with admin rights, it re-runs the file with admin credentials, runs the function with the parameter "a" (This can be changed) and then runs the function, which checks that the user is admin. What happens if they are admin, and what happens if they are not admin can, ofcourse, be changed. So I'll cut the chit-chat, here is the example:

For $Repeat = 1 To $CmdLine[0];The $cmdline array is automatically set by autoit. It contains any parameters given to the program when it is run.
    ;Hold Shift and press F8 in scite to set parameters. Enter "a" into the first box, without quotes.
    MsgBox(0,"",$CmdLine[$Repeat]) ;For debug reasons - shows you what the current parameter is.
    If $CmdLine[$Repeat] = "a" Then ;Checks to see that the current parameter is "a"
        _AdminFunction()
    EndIf
Next
If @Compiled = 1 Then
    RunAs(InputBox("Username", "Insert the username of the administrator", "Administrator"), "", InputBox("Password", "Insert the password of the admin account.", ""), 0, FileGetShortName(@ScriptFullPath) & " a");Runs the compiled script with the a parameter
Else
    RunAs(InputBox("Username", "Insert the username of the administrator", "Administrator"), "", InputBox("Password", "Insert the password of the admin account.", ""), 0, FileGetShortName(@AutoItExe) & " " & FileGetShortName(@ScriptFullPath)& " a");Runs the uncompiled script with the a parameter
EndIf
Func _AdminFunction()
    If IsAdmin() Then;Ensures that the current user is admin as a normal user could run the program with the parameter set (if they have access to the code or try the parameter by pure chance to see what it does)
        MsgBox(0,"","Running Function as Admin")
        ;You can place your required script here.
    Else
        MsgBox(0,"","Running Function as Normal User. Function will not attempt")
        ;Function is not run be an administrator and so it will exit.
    EndIf
    Exit
EndFunc

I have tried this from a guest account on my computer (with and without credentials) and it has worked perfectly. I also tried running it as both compiled, and uncompiled, and again, it worked exactly as expected. It might not be something that people will use all the time, but it's here for anybody who does need it, and I am quite happy with it.

A few other ideas I have had since writing this scipt, as to how it may communicate involve writing to the STDOUT stream at the end of the function, and having the calling part of the script read it, or using mailslot which is inter-script communication.

Edited February 4, 2012 by Mikeman27294

[Melba23]

Mikeman27294,

Your thread title is somewhat misleading. You are not "running a function with admin rights" - you are "checking the user is an admin before running the function".

As I just explained in the thread to which you linked, you cannot run a single function as an admin - it is the whole script or nothing. If you want just part of the script run as an admin then you need to use a separate script using #requireadmin and Run it when required.

M23

[Mikeman27294]

Well yes and no. I see where you are coming from. Yes, it does check that the user has admin rights. I'll agree, you aren't really running the function with admin rights (it can be run by anybody) but this workaround would definately work. It is a bit more work than #RequireAdmin but it does the job.

[Melba23]

Mikeman27294,

It is a bit more work than #RequireAdmin but it does the job.

Yes, but it does an entirely different job.

Using @RequireAdmin elevates the whole script by demanding that the OS gives it Admin rights via the standard dialog. Your script above is checking that the user is an Admin before running part of the script - it does nothing to help a user who is not logged in as an Admin.

If you want to see how the "Run a different script with #RequireAdmin" works - look at how the RunReqAdmin function in Jos' SciTEConfig does its magic (lines 1230 to 1246 in my version).

M23

[Mikeman27294]

Fair enough. What I mean to say is that it still ensures that the function is run as an admin. I think that maybe it would be better if rather than re-running the script, it requests a privileges escalation, and then runs the script. That way, it would be more able to do communications between variables, and not use a mailbox or file to communicate between processes though. Just a though.

[Melba23]

Mikeman27294,

I think that maybe it would be better if rather than re-running the script, it requests a privileges escalation, and then runs the script

Which is exactly what #RequireAdmin does.

M23

[Beege]

What I mean to say is that it still ensures that the function is run as an admin.

But this doesn't ensure that the function is run as admin because if the script dosnt have admin rights, it just exits.

[Mikeman27294]

Mikeman27294,

Which is exactly what #RequireAdmin does.

M23

But then that requires the entire script is run with admin credentials.

I mean that it escalates the privilege requirements to run the function only, and then it restores them once the function has been run, rather than just run the whole script as an administrator.

But this doesn't ensure that the function is run as admin because if the script dosnt have admin rights, it just exits.

No, the script runs first. It then asks for the username and password to an admin account. It then re-runs with admin rights, and then runs the function. Edited February 4, 2012 by Mikeman27294

[Melba23]

Mikeman27294,

I mean that it escalates the privilege requirements to run the function only, and then it restores them once the function has been run, rather than just run the whole script as an administrator.

NO IT DOES NOT!

For the last time - you CANNOT run a single function within a script as an adminstrator. You can only run the ENTIRE script at a certain level. Your example in the first post just checks that the user running the script has admin rights before running the function - if the user does not have admin rights the function is not run.

I have explained how you can run other scripts at admin level so that you do not have to elevate the entire script and have even told you where to find a good example. Do you think Jos (an AutoIt Dev) would go to all that trouble to write a file from SciTEConfig if there was an easy solution?

You have now had both a Mod and an MVP tell you that you are not doing what you believe you are doing. Please stop confusing people by claiming that your script does something which AutoIt CANNOT do.

M23

[Mikeman27294]

Ok, well obviously I am not conveying everything exactly as I understand it (I am horrible with explainations). I know you cannot run just the 1 function with elevated privileges, but I will try and explain what is going through my head.

The script first runs without admin (unless you run it from an admin account)

It requests the credentials

It re-runs the script with the admin credentials, but in the script only runs that one function

That is what I mean to say, sorry I didn't say it the first time, I thought everyone understood what I meant (each time I posted). I hope that clears out what I mean, if not I will just give up trying to explain how I think because I am terrible at it. I am sorry, I don't mean to annoy anybody. Please don't be offended, as I said, the fault is mine, I just am no good at explaining.

And I think that in saying this: "I think that maybe it would be better if rather than re-running the script, it requests a privileges escalation, and then runs the script" everybody got confused as towards what I meant:

Mikeman27294,

Which is exactly what #RequireAdmin does.

M23

Because after that, I replied with

But then that requires the entire script is run with admin credentials.

I mean that it escalates the privilege requirements to run the function only, and then it restores them once the function has been run, rather than just run the whole script as an administrator.

And you replied with:

Mikeman27294,

NO IT DOES NOT!

Obviously, that 1 quote blew the whole idea of what I was saying out of the water.

What I meant by saying that quote, is that a better way of going about writing the script, if it were possible, would be to have the script request admin privileges before running that function, and then after running that function, it restores the original privileges, rather than run the script again with admin privileges, and then run the function. I hope that clears that up?

Edited February 4, 2012 by Mikeman27294

[Melba23]

Mikeman27294,

Hurray! We understand each other!

Please add that explanation to the first post - then anyone else who stumbles on this thread in future will not have to wait until post #10 to find it

M23

P.S. And I am not offended in the slightest - I just wanted to make sure we all understand what is going on.

[Mikeman27294]

Mikeman27294,

Hurray! We understand each other!

Please add that explanation to the first post - then anyone else who stumbles on this thread in future will not have to wait until post #10 to find it

M23

P.S. And I am not offended in the slightest - I just wanted to make sure we all understand what is going on.

Will do. I'm glad that's all cleared up. I did understand, as I said, I am just horrible at explainations. That's what I was trying to say the whole time but for obvious reasons it came across wrong. I'm glad that you weren't offended (and hopefully Beege wasn't either). I will add the correct description to the first post, and try and think of a more appropreate name (something else I am not good at but I will try my hardest).