Windows下以管理员权限安全调用命令
我需要准时调用需要用户帐户启动的软件的管理员权限的命令（net share、netsh...）。
在 Unix 变体下，我会在用户模式软件旁边安装一个小的、谨慎编写的脚本，带有 suid 位，它将调用所需的命令。
Microsoft Windows 下的等效最佳实践是什么？ 我对 Vista 友好但与 XP 兼容的解决方案特别感兴趣。
I need to punctually invoque commands (net share, netsh...) requiring admin rights from a software launched by a user account.
Under a Unix variant, I would install alongside my user mode software a small, cautiously written script bearing a suid bit and which would invoke the needed command(s).
What is the equivalent best practice under Microsoft Windows? I would especially be interested in a Vista friendly, but XP compatible solution.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
正如 BobbyShaftoe 所说，在 Windows 中解决此问题的规范方法是通过服务，因为服务默认在 LocalSystem 帐户下执行。 任何其他方法都需要以管理员用户身份登录，这需要凭据。
对于 Vista，您需要的额外信息是客户端应用程序需要通过某种形式的可以跨越会话边界的 IPC 与服务进行通信，因为在 Vista 上控制台和服务位于不同的会话中。 在这种情况下使用的正常 IPC 方法是命名管道。
同样的解决方案在 XP 中也能正常工作。
As BobbyShaftoe says, the canonical way to solve this problem in Windows is via a service, since services by default execute under the LocalSystem account. Any other method is going to need to logon as an admin user, which would require credentials.
The additional bit of information that you'd need for Vista is that the client application would need to talk to the service via some form of IPC that can cross session boundaries, since on Vista the console and services are in different sessions. The normal IPC method used in this case is a named pipe.
The same solution will work fine in XP.
一种方法可能是让服务以管理权限运行。 然后从您的应用程序告诉服务调用这些命令。 我假设您不希望用户需要知道管理凭据。
One method could be to have a service that runs with administratively privileges. Then from your application, tell the service to invoke those commands. I'm assuming that you do not want the user to be required to know administrative credentials.
您可以使用 WinAPI 函数 LogonUser 和 < a href="http://msdn.microsoft.com/en-us/library/ms682429(VS.85).aspx" rel="nofollow noreferrer">CreateProcessAsUser 以编程方式启动具有不同访问权限的新进程权利。
对于您的场景，我将使用所需的
net命令编写一个批处理脚本，并根据需要创建一个新的 cmd.exe 进程，以获取脚本名称作为参数。此解决方案要求您以某种方式将 LogonUser 中使用的凭据存储在应用程序中，因此可能存在安全风险。
You can use the WinAPI functions LogonUser and CreateProcessAsUser to programatically start a new process with different access rights.
For your scenario I would write a batch script with the required
netcommands, and if needed create a new cmd.exe process that gets the script name as a parameter.This solution requires you to store the credentials used in LogonUser in your application somehow, so there might be security risks.