How to run an app NOT as administrator?

I have a headache now. I searched answers on google for days but no help at all. Here it is:

There is an app (A) running as administrator. I use A to run another app (B) by clicking a button on A.
B gets administrative rights from A after it is started.
But I want B run NOT as administrator. Any help?

I don't need code. I just want to know how. Thanks in advance!

from what i understand you maybe creating a trojan bot aka rat-remote admin

what? where do you get THAT from?


anyways, normally the request goes the other way around... it has to do with thread ownership and inheriting from the parent... is there a reason to run thread B as the context user, rather than the elevated admin?

-tg

You could do that by using this code:

Module code

vb Code:

'Controls user program elevation
Option Explicit
 
Private Const BCM_SETSHIELD As Long = &H160C&
 
Private Declare Sub InitCommonControls Lib "comctl32" ()
 
Private Declare Function IsUserAnAdmin Lib "shell32" () As Long
 
Private Declare Function SendMessage Lib "user32" _
    Alias "SendMessageA" ( _
    ByVal hWnd As Long, _
    ByVal wMsg As Long, _
    ByVal wParam As Long, _
    ByRef lParam As Any) As Long
 
Private Declare Function ShellExecute Lib "shell32" _
    Alias "ShellExecuteA" ( _
    ByVal hWnd As Long, _
    ByVal lpOperation As String, _
    ByVal lpFile As String, _
    ByVal lpParameters As String, _
    ByVal lpDirectory As String, _
    ByVal nShowCmd As VbAppWinStyle) As Long
 
Private mblnIsElevated As Boolean
Private objForm As Object
 
Public Function IsElevated() As Boolean
    IsElevated = mblnIsElevated
End Function
 
Public Sub OperationRequiringElevation(ByRef Params As Variant)
    MsgBox "Insert logic here for: " & vbNewLine _
         & Join(Params, vbNewLine)
End Sub
 
Public Sub RequestOperation( _
    ByVal hWnd As Long, _
    ByVal Focus As VbAppWinStyle, _
    ByRef Params As Variant)
 
    ShellExecute hWnd, "runas", App.EXEName & ".exe", _
                 Join(Params, " "), CurDir$(), Focus
End Sub
 
Public Sub SetShield(ByVal hWnd As Long)
    SendMessage hWnd, BCM_SETSHIELD, 0&, 1&
End Sub
 
Private Sub Main()
    If Len(Command$()) > 0 Then
        'Assume we've been run elevated to execute an operation
        'specified as a set of space-delimited strings.
        OperationRequiringElevation Split(Command$(), " ")
                  'unload all forms
                   For Each objForm In Forms
                   Unload objForm
                   Set objForm = Nothing
                   Next objForm
                      Else
        mblnIsElevated = IsUserAnAdmin()
        InitCommonControls
        load
    End If
End Sub

vb Code:

'Detect user elevation (could probably go in the first module too)
Option Explicit
 
Public Sub load()
Dim ff, Params As Variant
 
       Params = Array(App.EXEName, "By Nightwalker83", "http://aaronspehr.net/")
    If IsElevated() Then
        OperationRequiringElevation Params
    Else
        RequestOperation frmMain.hWnd, vbHide, Params
    End If
         frmMain.Show
End Sub

You also need:

A form called "frmMain"
2 bas files
Set the Startup Object as "Sub Main"

For the second project just comment out:

vb Code:

Dim ff, Params As Variant
 
       Params = Array(App.EXEName, "By Nightwalker83", "http://aaronspehr.net/")
    If IsElevated() Then
        OperationRequiringElevation Params
    Else
        RequestOperation frmMain.hWnd, vbHide, Params
    End If

and

vb Code:

Public Sub OperationRequiringElevation(ByRef Params As Variant)
    MsgBox "Insert logic here for: " & vbNewLine _
         & Join(Params, vbNewLine)
End Sub
 
Public Sub RequestOperation( _
    ByVal hWnd As Long, _
    ByVal Focus As VbAppWinStyle, _
    ByRef Params As Variant)
 
    ShellExecute hWnd, "runas", App.EXEName & ".exe", _
                 Join(Params, " "), CurDir$(), Focus
End Sub
 
OperationRequiringElevation Split(Command$(), " ")

I don't think there is any technique provided for an elevated process to spawn a standard user process.

There are workarounds that involve playing with security tokens, starting a scheduled task, calling CreateprocessAsUser(), etc. But normally this isn't done.