Login with Admin user to some domain and copy files client machines with C#

Question

Hi , I have got a project that can copy files to another client's desktops in my domain.There is 300+ client machine.But there is a problem.When i run this project in a non admin user account in my domain.It cant copy files getting error about Access Denied , user restrictions.I wanna do this program like this , in non admin user account when user start to copy files ; first my program will get admin access by loggin in my admin user accoun to domain than will copy files.Than logout.How can i do this ? I wanna do this with C#.

Answer 1

you need to change the thread to the context of an admin user. How you do that in a secure way is the challenge. This sounds like a quick utility program where the security may not be a big deal, however. Just change the admin's password once the utility has been run.

Answer 2

You can switch privileges when starting the program from itself or from another program. You can do this with two programs, one that runs as the user account and then launches your privileged application. (or launch itself with a different command line to indicate the different run-mode.)

To launch a program in C# as a different user, do this,

// Create a secure version of the password
SecureString pass = new SecureString();
foreach ( char c in _pass.Text )
{
   pass.AppendChar( c );
}

Process process = Process.Start( "PrivilegedProgram.exe", _arguments, _user.Text, pass, _domain.Text );

Answer 3

I had a similar problem: Production needed to run one of my programs that processes files on a location on the network where they don't have any access.

I ended up using Impersonation, which allowed me to run the file processing thread under a set of credentials set at runtime by my program.

In AD I created a special user account with all required permissions for exclusive use by this program.

I know it’s not at all secure, but it works and the odds that it would even occur to someone to hack my program to get these credentials is remote.

Anyway, look into Impersonation I found these resources helpful:

Safely Impersonating Another User

Brian Low's ImpersonationHelper class

-Jay