Windows: Running privileged command from non-privileged using CMD (or Java)

Question

I will have a service that runs as administrator and listens on a port. My GUI program will talk to the administrator service for the items that require administrator privileges.

If the service is not yet running, I will need to start it. How can I get my GUI program to run a command as administrator? I assume the user will be asked if they want to continue.

I am hoping there is something I could type in a CMD window because that should fit very well into my Java program. I am thinking something like run-as-admin javaw my-service.jar where run-as-admin is the command that asks whether to continue or not.

Answer 1

You can't execute a batch file as administrator. You need to create a shortcut to that file and then set the flag in the Shortcut 'Execute as Administrator', if this is really what you want to do.

To do this from the desktop, select the Shortcut, right click and Properties->Shortcut tab->Advanced button. Then check Execute as Administrator checkbox.

To do this programmatically, see How to set "Run as administrator" flag on shortcut created by MSI installer

Answer 2

Windows contains the tool "runas" which can be used to start any executable with a different user account.

On the commandline you would then use:

runas /user:Administrator "javaw -jar my-service.jar"

The only drawback is, that you need to type in the password, you cannot supply the password as an argument to the runas command

Answer 3

We use the Wrapper library for this: http://sourceforge.net/projects/wrapper/

The official website seems to be suffering from dynamic dns issues at the moment, so here is the wayback archive version.

From the command line (and by extension, Java) you can install, uninstall, start, and stop your Java application as a service.

Answer 4

You have a problem here. Non admin processes cannot start services. The very simplest thing to do is to arrange that the service starts automatically. I'd strongly recommend you take that route.

What you are thinking of doing would involve creating a helper application that includes the UAC manifest with requestedExecutionLevel set to requireAdministrator. This helper app could then start the service. The problem with this is that it requires that the logged on user is in the administrators group which you cannot guarantee will be the case.

All in all, starting the service automatically is to be preferred.