How do I 'run as' 'Network Service'

问题:

I am trying to run a process as another account. I have the command:

runas "/user:WIN-CLR8YU96CL5\network service" "abwsx1.exe"

but then this asks for the password. However there is no password set for the network service.

Is what I am trying to do possible?

回答1:

Use PsExec.exe from SysInternals.

e.g. this will open a new command prompt running as NETWORK SERVICE:

psexec -i -u "nt authority\network service" cmd.exe 

this will run it as LOCAL SYSTEM:

psexec -i -s cmd.exe 

You can verify these by running whoami from the cmd prompt.

See also:

• http://forum.sysinternals.com/how-to-start-cmdexe-as-network-service_topic15797.html

• Interactive command prompt as NETWORK SERVICE

回答2:

In Task Scheduler, create a task to run the application under the NETWORK SERVICE user. You can then run the task from the command line using

schtasks /run /TN "taskname"

Where taskname is the name of your task.

回答3:

You can only impersonate as service account from a Windows service typically, like this post mentions:

The trick is to run your code as Local System and from there you can impersonate the service accounts by using the appropriate username with no password. One way to run your code as the Local System account is to create a command line shell by using the technique shown below (taken from this orginal post), and execute your assembly from there. Calling System.Diagnostics.Debugger.Break() in your code allows you to debug.

To create a command-line shell that runs under the local system account, open a new command line window and enter:

c:\sc create testsvc binpath= "cmd /K start" type= own type= interact

followed by:

c:\sc start testsvc

A new command window should have opened up. In that window run your application.exe - you'll see that you're now running as the built-in System user account. After you've finished testing, you can delete the test service you created by entering:

c:\sc delete testsvc

If you try to do that in your own user context, then such attempts should fail.

回答4:

I have tested

PsExec -i -s cmd.exe

and

PsExec -i -u "nt authority\network service" cmd.exe

on PsExec64-v2.2, for win10-home-x64-10.0.14393 and win10-pro-x64-10.0.15063 to use normal console it's failed, use elevated console it works fine