Run batch file rename a folder as administrator!

[Paul Black]

I am trying to rename the CBS [C:\Windows\Logs\CBS] folder to CBS_OLD but got an Access Denied error.
I have tried numerous combinations of commands but to no avail and Google has been no help!
Is there an easy way [probably not] to run commands as an Administrator from within a batch file please?
I am not interested in running from the command line or right-clicking and Run as administrator.

This is the latest code I have...

@echo off
echo.
net stop wuauserv
rem net stop bits
takeown /f %systemroot%\Logs\CBS /r /d y
ICACLS %systemroot% /grant %username%:F /T
rename %systemroot%\Logs\CBS %systemroot%\Logs\CBS_OLD
net start wuauserv
pause

Here is the current output...



Thanks in advance.

 

[samuria]

Run as Different User

 

[iko22]

takeown gives ownership to the current user, rather than the administrator, until you include the /a switch as a parameter to the takeown command. Depends on if that is what you want to do.

 

[Paul Black]

Thanks for the replies samuria and iko22,

takeown gives ownership to the current user, rather than the administrator, until you include the /a switch as a parameter to the takeown command. Depends on if that is what you want to do.

I have got a small menu driven batch file. I have administrator rights so for me there is not a problem. I would like the batch commands to run as administrator for those who are normal users. i.e. changing the CBS [C:\Windows\Logs\CBS] folder to CBS_OLD etc, if possible!

Thanks in adcance.

 

[samuria]

If you use the runasin the script as post 2 it should work

 

[Paul Black]

Hi samuria,

If you use the runas in the script as post 2 it should work.

That will not run within the code though. I want to be able to achieve this from within the script!

 

[iko22]

Cannot tell where it has fallen over, because you have Echo Off in your example output screen.

 

[Paul Black]

Here is an amended screen shot without @echo off...



The thing is I think this is wrong because I need it to be set as Administrator and to run as Administrator!

Thanks in advance.

 

[iko22]

Then correct the iCACLS command line with a runas, as Samuria suggested. For Example: RUNAS /profile /user:system-admin-pc\system-admin "ICACLS %systemroot% /grant %username%:F /T"

Does that get you what you want, if you replace that line in the script?

 

[Paul Black]

Thanks again iko22,

This is not critical BTW and is not networked!

The idea behind this is I want to upload a batch file that members can use. It has a menu. I want them to be able to run the menu items. i.e. If they wanted to run SFC, then I thought it would be a good idea to rename the CBS folder to CBS_OLD first for example. I just wondered if there was an easy way to get the code to run with administrator rights.

Thanks.

 

[Snick]

Thanks again iko22,

This is not critical BTW and is not networked!

The idea behind this is I want to upload a batch file that members can use. It has a menu. I want them to be able to run the menu items. i.e. If they wanted to run SFC, then I thought it would be a good idea to rename the CBS folder to CBS_OLD first for example. I just wondered if there was an easy way to get the code to run with administrator rights.

Thanks.

You're trying to circumvent win security protocol. Batch file run from guest cmd & elevate guest to admin rights?
Don't believe that's possible!
How to open an elevated cmd using command line for Windows ...
#62 green check

 

[Paul Black]

Hi Snick,

You're trying to circumvent win security protocol. Batch file run from guest cmd & elevate guest to admin rights?
Don't believe that's possible!
How to open an elevated cmd using command line for Windows ...
#62 green check

I didn't think it was but I thought I would ask!

What does #62 green check mean?

 

[Paul Black]

Would opening PowerShell from within the batch file and performing the processes [then closing PowerShell] overcome the administrator restrictions?

I would assume that it doesn't!

 

[iko22]

No joy? I'd thought you'd have this up and running by now! I did a bit more homework on the two commands, and I tried this on a folder called Demo, and it seems to work perfectly.

[FONT="Courier New"]RUNAS /profile /user:user1 "iCACLS c:\users\user1\desktop\demo /deny user1:(OI)(CI)F"
RUNAS /profile /user:user1 "iCACLS c:\users\user1\desktop\demo /grant user1:(OI)(CI)F"
[/FONT]

This returns success on mine, so I'd assume it would also work on c:\windows\logs\cbs on your computer. Assume user1 has admin rights.

I think Snick is correct, you cannot run an elevated command prompt from a batch file. This example does not attempt to break that restriction.

 

[Paul Black]

Hi iko22,

No joy? I'd thought you'd have this up and running by now!

I have had limited time to spend on this for the last couple of days, but I will get around to it this afternoon, hopefully!

I think @Snick is correct, you cannot run an elevated command prompt from a batch file. This example does not attempt to break that restriction.

That was what I thought, but I wondered if there was a clever workaround, obviously not, which makes sense because it is to keep the integrity of the system secure!

Thanks again.

 

[Paul Black]

Hi iko22,

No joy? I'd thought you'd have this up and running by now! I did a bit more homework on the two commands, and I tried this on a folder called Demo, and it seems to work perfectly.

[FONT=Courier New]RUNAS /profile /user:user1 "iCACLS c:\users\user1\desktop\demo /deny user1:(OI)(CI)F"[/FONT]
[FONT=Courier New]RUNAS /profile /user:user1 "iCACLS c:\users\user1\desktop\demo /grant user1:(OI)(CI)F"[/FONT]

No go I'm afraid!

Says error with RUNAS and I can't leave the password blank [even though it is not passworded]!

I will try and have a better look later.

 

[Paul Black]

UPDATE:

I ran this...

echo.
net stop wuauserv
icacls "c:\windows\logs\cbs" /grant system-admin:(OI)(CI)F /T
ren c:\windows\Logs\CBS\ c:\windows\Logs\CBS_OLD\
net start wuauserv
pause

...and got this...



Thanks in advance.

 

[iko22]

Hello Paul

THe syntax for the REN statement says you are trying to RENAME the entire folder. DO you not want to rename the CBS.log within the CBS folder?

 

[Paul Black]

Hi iko22,

The syntax for the REN statement says you are trying to RENAME the entire folder. DO you not want to rename the CBS.log within the CBS folder?

Yes. I would however, also find it useful to be able to rename the parent folder [CBS] if I so wished.

I was trying out both, hence the confusion!

 

[Snick]

Well, my reference to #62 green was the response number that was marked with a green check-mark.
It's not there anymore. Many other responses not there either, must be admin vetting.
The gist of the response was that you can't elevate from guest to admin from within the guest process. Don't recall who claimed to be the respondent.