How can I create a new process with another User Account on Windows?

Question

Is it possible to create a new process on windows with a different user account? I know there are a context menu "Run as" but I want do it from Java. I have the username and the password.

Answer 1

You need to write a DLL using the Java Native Interface (JNI) as you cannot do this with pure Java code.

The DLL itself needs to call the CreateProcessAsUser function to create a process in the context of another user. To successfully create that process you need to provide an access token to the function, which was itself created by calling the LogonUser function (it takes the username and password to authentify that other user).

Answer 2

There is a program called "runas.exe." You could run that process and supply the appropriate arguments for your process and username/password. I think that's the simplest method.

Answer 3

I just ran across an alternative to the runas.exe program called MiniRunAs which will take the password on the command line - http://www.source-code.biz/snippets/c/1.htm

If you are able to install it along with your application, that may prove simpler than writing a JNI DLL.

Answer 4

Depending on your needs the Win32 API "CreateProcessWithLogonW" is easier to use than the "CreateProcessAsUser / LogonUser" functions.

From MSDN Docs:

The CreateProcessWithLogonW and CreateProcessWithTokenW functions are
similar to the CreateProcessAsUser function, except that the caller 
does not need to call the LogonUser function to authenticate the user 
and get a token

Answer 5

RUNAS has the "/savecred" switch that let you enter the credential only the first time. One potential problem is that when /SaveCred saves the credentials it saves it for whenever RUNAS invokes that user account. This can be a huge security risk so be careful using it!

Example at http://www.rgagnon.com/javadetails/java-0014.html (at the end)